The Maine Medical Association (MMA) appreciates this opportunity to address the Maine Department of Health and Human Services (DHHS) and the Maine Centers for Disease Control and Prevention (CDC) concerning Proposed Rule 2016-P083, 10-144 CMR, Chapter 175, relating to the release of data by the CDC about public health issues.

The Maine Medical Association comprises over 3900 Maine physicians and medical students. Its mission is to support Maine physicians, to advance the quality of medicine in Maine, and to promote the health of all Maine citizens. We are keenly interested in matters relating to the health of all Maine residents. The MMA is also particularly interested in protecting the privacy of all patients and others with health concerns; our legal staff frequently presents to medical practices around the State on HIPAA and other confidentiality laws and the importance of safeguarding protected health information. Many of our individual members, as well as the MMA as an organization, have a long history of collaboration with the CDC to achieve the common goal of protecting the public health, particularly at times when outbreaks of communicable disease threaten Maine people.

The proposed rule at issue, 10-144 CMR Chapter 175, seeks in part to limit the release of information to the public that might possibly indirectly identify certain persons who have communicable diseases, or who have had certain immunizations, or who have been exposed to health risks in their environment. It is unclear from the text of the proposed rule whether it is a blanket rule, to be used indiscriminately under all circumstances, or whether there is any mechanism for balancing the interests of personal privacy with those of public health needs. Certainly the rule does not contain any explicit description of such a mechanism. As a result, it has the potential to restrict significantly the dissemination of data that may be necessary in times of significant public health risk to prevent the further spread of life-threatening illnesses. Its terms appear to reach beyond the requirements of safeguarding individuals’ protected health information.

Our specific concerns are as follows:

Section 2: Internal users and external users.

The definition of external users is simply all users who are not internal users. The definition of internal users is limited to CDC employees and contractors under direct CDC supervision. It does not include school nurses. Due to the nature of children’s interactions with each other and their concentration in small spaces, schools are significant and high-risk locations for the spread of communicable diseases. The definition also does not include physicians and other health care providers specializing and working in the area of infectious diseases. Thus these definitions exclude from the class of allowable recipients of information the very experts who are at the front lines of communicable disease management and control. The rule also does not differentiate between public health and infectious disease experts and the general public. While in many circumstances there should be no difference in what is released to those two groups, it is easy to envision times when information should be released first to those in a position to act upon it and only later to the general public. The MMA requests that the CDC reconsider these definitions in light of the significant risks to public health that would result from withholding important information from persons in a position to affect significantly the health of persons in their charge or the general public health.

Section 2.2: Indirect identification.

In its current form the definition of indirect identification is, in our opinion, overly broad and goes well beyond the level of secrecy necessary to safeguard protected health information of individuals. In addition, it does not differentiate among classes of information in relation to risks presented. It removes from the analysis any form of professional medical judgment about the danger of certain health risks, many of which cannot be predicted in advance. Instead it substitutes for that judgment a simple and undiscriminating mathematical formula. There are some situations of risk that make their appearance among small numbers of people. That does not necessarily mean the individuals involved are at risk of protected health information disclosure.

Furthermore, the definition includes among situations requiring secrecy those involving small numerators with large denominators. Thus an occurrence of 5 cases in a population of 1999 would have to be kept secret. It must be kept in mind that these are situations where there is no directly identifying information as set forth in the definition of that term. The description of geographic areas or organizations within the State also does not appear to limit nondisclosure to the enumerated situations. Rather, it states that in those situations nondisclosure is “deemed,” while apparently leaving open the possibility of broader secrecy if the CDC finds it advisable.

Section 3.B.2: External users.

The MMA notes that the rule provides for decision on the release of the information in question “at the sole discretion of the Department,” without any check or balance on this exercise of secrecy. Such power is inappropriately great in the functioning of a public body, particularly a public body which is charged with safeguarding the public health. The rule does not establish any standards relating to how this power will be exercised. It assumes that the Department will always be aware of all arguments on all sides of the question of disclosure, and by doing so it silences important voices which may raise issues not considered by the CDC in making its determinations. Such a limitation on external points of view and information poses a serious risk to the health and safety of Maine residents and others.

Finally, the rule also does not appear to allow for any challenge to or appeal of such a determination by the Department. This lack of an appeal mechanism also places the public health at risk and requires a greater degree of reliance on unspecified Department personnel than the law allows in other situations, even those where the public health and safety are not at risk.

In summary, the Maine Medical Association asks the DHHS and the CDC to reconsider this proposed rule in light of the serious nature of the risks involved and the extreme degree of unquestioned power it places in the hands of a poorly defined group of individuals within the State government. In reconsideration, adequate allowance should be made for the release of information to individuals and organizations who are in a position to have a positive effect on protecting the public health.

Respectfully submitted,

The Maine Medical Association