Calif. agency violated state law, shared HIV patient data, groups say

By Lisa Leff, Associated Press writer

SAN FRANCISCO - California health officials violated state privacy laws
by giving personal information about thousands of HIV-positive welfare recipients to
a nonprofit group serving people infected with the virus, three legal groups
said Thursday.

The ACLU of Northern California, Lambda Legal and the AIDS Legal Services Alliance
fired off an angry letter to California Department of Health Care Services director
David Maxwell-Jolly demanding an explanation for what the groups termed "a gross
affront" to patient confidentiality.

Norman Williams, a health department spokesman, said staff members and lawyers have
reviewed the situation and do not see a problem. The records released to the AIDS
Healthcare Foundation did not include the patients' HIV status or the names of their
doctors, medications or insurance carriers, he said.

"We provided very limited information to AHF about certain beneficiaries, and that
was to be used for the purpose of contacting individuals to let them know they were
eligible for these additional services," Williams said. "We believe our actions
comply with the law."

ACLU staff attorney Elizabeth Gill said health officials have acknowledged turning
over the names, addresses and telephone numbers of an estimated 5,000 HIV patients to
the Los Angeles-based foundation during the past two years.

AIDS Healthcare Foundation president Michael Weinstein said his group sought the information to recruit clients for a statewide outreach, education and case management program for low-income, HIV-positive Californians the foundation was under contract with the
state to run.

Gill, however, said the disclosures were improper because California has specifically
prohibited the release of patients' identifying information to third parties since
the early days of the AIDS epidemic, when public fear and confusion about how the
disease was spread put people at risk of losing jobs and homes.

"This is the most sensitive medical information out there," Gill said. "It should
take one second to come to the conclusion that gee, someone on this list may not be
open about their HIV status, and if they get a call or a letter from an AIDS-only
service provider, isn't that going to be a problem for them? No one thought this
through? It's shocking."

Sharing a person's HIV status without permission or without authorization for public
health purposes is a violation of state law punishable by a civil fine of up to
$25,000.

Weinstein said his foundation sent letters with only its initials on the envelope to
a minimal subset of the 5,000 people with HIV who were identified through the state,
even though the group prefers to recruit participants through referring doctors or
existing clients.

Much of the contact information the foundation received from the health department
was outdated, he said.

Weinstein criticized the legal groups for "trying to protect people's rights by
depriving them of care" by arguing his organization -- one of the nation's
largest providers of medical care for people with HIV/AIDS -- should not have received
the patient information.

"Not employing proven methods for improving outcomes because of the virtually
nonexistent possibility that it's going to lead to disclosure and it's going to cause
discrimination is way out of whack," he said.

Because of the difficulty it faced in recruiting patients, the foundation sponsored a
bill in the California Legislature this year that would have allowed the health
department to share all the information it has about welfare recipients being treated
for HIV.

The bill was amended to limit the types of information that could be released but
never made it out of committee. The foundation spent about $1 million under its state
contract to enroll about 400 people in the program, according to a legislative
analysis.

The foundation stopped trying to find new participants at the end of last year,
Weinstein said.

Lambda Legal staff attorney Peter Renn said state officials should not have assumed
it was proper to give confidential information to the foundation any more than it
would have been to release it to a group hostile to people with AIDS.

"There isn't an exception in the privacy laws simply because someone might think the
third party would be friendly to the patient," Renn said. "Would we want the
government giving out home phone numbers of people with depression to the makers of
Prozac or people with erectile dysfunction to the makers of Viagra?"