The following essay is reprinted with permission from the AIDS & Public Policy Journal, Vol. 19, No. 1/2, pp. 54-66. Copyright © 2004, University Publishing Group. All rights reserved.

Abstract

On 18 April 2003, the Centers for Disease Control and Prevention (CDC) announced a new HIV prevention initiative, “Prevention for Positives,” which emphasizes partner-notification activities for individuals who have already been diagnosed with HIV. The CDC failed, however, to address significant criminal law issues that are presented by this initiative. The proposed partner notification activities involve patients’ voluntary identification of contacts at risk for HIV transmission. But because all states have laws that make it a crime to knowingly expose another person to HIV, information provided by patients for partner-notification purposes is in most cases evidence of a crime. Little if any confidentiality protections prevent law enforcement officials from obtaining test results, records of counseling sessions, or similar information from the records of health or social service providers. Prevention for Positives thus exposes patients to an unacknowledged risk of criminal prosecution, which may severely inhibit future cooperation among those infected. This problem should be addressed by law and policy reforms, including enhanced confidentiality of partner-notification records and the availability of “use and derivative use” immunity that bars prosecution of patients based on the information they provide in partner-notification programs.

Essay: Self-Incrimination, Partner Notification, and the Criminal Law: Negatives for the CDC’s “Prevention for Positives” Initiative

David W. Webber

In a major policy shift announced on 18 April 2003, the Centers for Disease Control and Prevention (CDC) initiated a “new strategy” in HIV prevention efforts: Prevention for Positives, that focuses on changing the sexual and syringe-sharing behavior of persons already identified as being infected with HIV.¹ The CDC’s new strategy is intended to reduce the infection rate that has remained at 40,000 annually for more than the past decade in the United States. Partner notification is an integral part of this initiative. Although partner notification programs are already in place in some states such as New York,² the CDC’s initiative, which includes increased funding for such programs on the state and local levels, promises to extend this approach to a national level. This article assesses the CDC’s failure to address significant criminal law issues in implementing its initiative.

As the CDC acknowledges, not all of the new HIV infections are the result of transmission from those who are not aware of their infection. For example, studies of treatment-resistant infection among the newly infected indicate that a small percentage of individuals diagnosed and being treated for HIV infection with retroviral medications are infecting others.³ A recent survey of HIV-infected individuals shows a similar result.⁴ But the extent to which new HIV infections are actually the result of nondisclosure of HIV status by those aware of their infection is apparently not known.

The Prevention for Positives strategy involves first identifying patients to be “at greatest risk for transmitting HIV.”⁵ These patients are then provided with “behavioral risk-reduction interventions”—referrals for counseling, education, and provision of condoms. Perhaps the most important element, however, is partner notification, which is to be facilitated through partner counseling and referral services (PCRS). As described by the CDC, patients’ identification of their partners is voluntary and is to include both current and former partners. Partner notification can be done by the patient, but more often notification is done by health department personnel. When clinic staff or health department personnel make the disclosure, the patient’s identity is not disclosed to the partner. Re-notification is recommended, particularly in cases when the partner has concluded that someone else was the infected partner. The program also seeks to identify infections among persons at risk for HIV, primarily by increasing HIV testing and then through partner notification activities.

Whether Prevention for Positives is an effective policy choice is a discussion well beyond the scope of this article, although the CDC itself concedes that “No studies have directly shown that PCRS prevents disease in a community.”⁶ One recent partner notification study reports a high rate of relationship dissolution and acquisition of new partners among those participating in partner notification, which could result in new infections.⁷ But that study also questions causality, suggesting that dissolution rates in general are high, and that, therefore, partner notification “may not have much influence on the breakup of partnerships.”⁸ Partner notification programs have been criticized in the past for both their confidentiality risks and lack of practical value,⁹ but those criticisms have not extended to the criminal law implications of partner notification.

There has been a curious congruence between the CDC’s policy change and the news media and popular culture. The day before the CDC described its Prevention for Positives initiative in its Morbidity and Mortality Weekly Report, the Indianapolis Star published an examination of the role of HIV confidentiality laws in the context of persons with HIV who knowingly expose others, contrasting the public health approach (civil proceedings, secrecy) with that of law enforcement (criminal proceedings, public notification).¹⁰ Two weeks later, an article in the New York Times Magazine described the activities of African-American men “on the down low”—seemingly heterosexual men who lead secret bisexual lives in which they eschew safe sex, or even embrace high-risk sex.¹¹ During this same time period, best-selling novelist E. Lynn Harris, whose books feature situations in which bisexual African-American men are involved with women who are not aware of the risk of being infected with HIV, was on a highly publicized national book tour to promote his new memoir.¹² In reporting on the prosecution of five people who were charged with selling their HIV-infected blood plasma, the Indianapolis Star emphasized in July 2003 that the state HIV confidentiality law delayed the identification of the individuals who were subsequently charged in the case.¹³ Then, in September 2003, news coverage of the prosecution of a former San Francisco Health Commissioner, Ron Hill, for intentionally infecting a sex partner with HIV, suggested that the fox was guarding the henhouse.¹⁴ In reporting on this case, the San Francisco Chronicle made a direct connection between the CDC’s Prevention for Positives initiative and “holding those who are already infected responsible for the health of people with whom they have consensual sex.”¹⁵ The subsequent dismissal of the intentional transmission charge in the Hill case provided further opportunity for law enforcement officials to bemoan the inadequate HIV exposure criminal laws in California.¹⁶ Finally, the New York Times ran what was ostensibly a news story with the ominous headline “HIV Secrecy Is Proving Deadly,”¹⁷ about the publication of Klitzman and Bayer’s Mortal Secrets: Truth and Lies in the Age of AIDS.¹⁸ In fact, that book discusses the criminal law response to the epidemic as a potential option, but stops short of explicitly endorsing it. Although this is not an exhaustive survey of news media coverage of HIV prevention and criminal law issues, it gives a fair indication of the way that the media frequently frame discussion of these issues.

In this broader context, the CDC’s new policy might easily be viewed as abandoning the long-accepted precept that the prevention of HIV transmission is the responsibility of both the infected and uninfected. The focus on the already diagnosed suggests that the epidemic is fueled by individuals who know their infected status and fail to disclose it or take measures to prevent infection to others, a suggestion that opens the door to holding such individuals legally accountable. We do that by defining their conduct as criminal, then prosecuting, convicting, and punishing them for those crimes.

The history of the epidemic thus far indicates that the use of the criminal law to address HIV transmission has had limited use, even if the occasional case results in banner headlines. As Lazzarini and her colleagues show in a survey of print news media coverage and case reports of HIV exposure criminal prosecutions nationwide from 1986 to 2001, the number of reports of prosecutions has remained extremely low in comparison to the estimated number of individuals with HIV and the number of new infections each year.¹⁹ The years 1986-1988 and 2000-2001 had the lowest numbers of reported prosecutions, with 10 or fewer in each of those years, while there were no more than 20 prosecutions in most other years. The highest level of reported prosecutions occurred in 1998 (more than 50) and 1993 (30). The authors suggest that their total is probably an underestimate of the true number of cases; indeed, whether judicial case and media reports are a reliable measure of the actual number of cases prosecuted is very likely a question that cannot be answered. In terms of the trends in numbers of cases prosecuted, whether there are fewer prosecutions or merely less media coverage of the prosecutions, perhaps as a result of declining sensational impact of such stories, also is not known. But what this study indicates is that, in a significant portion of the criminal prosecutions (at least 24 percent), defendants receive significant jail time (in 135 cases with minimum sentences of less than life, the median sentence was six years) for having engaged in conduct that did not involve any risk of HIV transmission.

The Lazzarini study and its valuable web site counterpart, the HIV Criminal Law Project,²⁰ document that every state has criminal laws adequate to prosecute any HIV-infected person who, aware of his or her infection, engages in sexual activity, shares hypodermic needles, or otherwise puts others at risk for infection. This should come as no surprise, because Congress required states to certify as much in order to receive funding under the Ryan White Comprehensive AIDS Resources Emergency (CARE) Act as enacted in 1990.²¹ Significantly, however, the Lazzarini study found “no systematic enforcement of HIV exposure laws” and concluded that a criminal prosecution is the result of “the accident of being caught and brought to the attention of a willing prosecutor.” The study, however, does not take account of race or class as factors that influence the “accidental” nature of law enforcement in this area. The study also concludes that, at this point, criminal prosecutions have not been shown to reduce HIV transmission. Of course, advocates of a criminal law response to the epidemic might respond by pointing out that deterrence would increase with more effective and systematic enforcement, and that the rate of HIV transmission would be even higher if there were no prosecutions.

One way that what Lazzarini called “the accident of being caught” can take place is when the possessor of confidential HIV information is authorized by law to disclose that information to a third party who is at risk for infection. Unlike the Prevention for Positives initiative, which relies on patients’ cooperation, partner notification in a number of states can take place without a patient’s consent. In fact, it can take place over the explicit objection of the patient. The law of confidentiality, which usually applies to health information, has been modified to allow such disclosure in many circumstances. On the federal level, the Health Insurance Portability and Access Act (HIPAA) regulations include a broad general exception to confidentiality in the partner notification context by authorizing the disclosure of so-called protected health information to a “person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if the covered entity or public health authority is authorized by law to notify such person.”²² In particular, spouses of the HIV infected, presumed to be unaware of the risk of HIV infection and thus particularly vulnerable, have been the subjects of protective legislation on both the federal and state levels. The 1996 amendments to the CARE Act, for example, included a spousal notification requirement.²³ To be eligible for CARE Act funding, states must take “administrative or legislative action to require that a good faith effort” is made to notify the spouse of a known HIV-infected patient of the spouse’s potential exposure to HIV. Illinois, New York, and Texas, for example, authorize non-consensual disclosure of HIV status to the patient’s spouse.²⁴ For veterans who receive healthcare services from the Veterans Administration, spousal notification of HIV infection is permitted, although it is not mandatory.²⁵ Some legislatures are more careful than others to make the concept of “spouse” equivalent with “at actual (past or future) risk.” In contrast, Congress took an expansive view of the “spouse at risk” by defining that term to include any “marriage partner” of the HIV-infected patient at any time within the 10-year period prior to diagnosis. Many states, however, authorize the disclosure of HIV information that would otherwise be confidential not just to spouses, but to non-spousal sex or needle-sharing partners.²⁶

Case law on third-party notification does not exist in all jurisdictions, but the outcome in the few reported cases is dependent on the statutory and common law standards that vary from state to state. In N.O.L. v. District of Columbia, for example, a husband’s emotional distress claim against the hospital that failed to disclose his wife’s HIV status was held to be barred by a confidentiality statute prohibiting disclosure of reportable diseases.²⁷ But in Chizmar v. Mackie, disclosure of an HIV test result that turned out to be a false positive to the patient’s husband was held to be proper and not a basis for suit.²⁸ Often, in the absence of a statutory standard, general tort law principles favor disclosure of information in circumstances in which the disclosure is intended to prevent the commission of a future crime. Because knowing exposure to HIV is criminal in all jurisdictions, this principle would serve as a defense against a claim of invasion of privacy.²⁹ But despite the laws that authorize disclosure to third parties at risk, without authorization from the patient, the extent to which partner notification actually takes place may vary significantly from jurisdiction to jurisdiction.

Although it is reasonable to suppose that clinicians will encounter situations in which a patient withholds consent for partner notification yet admits behavior that has placed or will place a known partner at risk for HIV infection, the CDC offers no specific guidance on how that situation might be handled. While acknowledging that some health departments require the reporting of any partner at risk, the CDC simply advises that clinicians should “know and comply with” any state law or health department partner notification laws.³⁰ But this is not much guidance for clinicians in jurisdictions where the disclosure is discretionary, not mandatory. Furthermore, disclosure of a patient’s HIV status to a partner without the patient’s consent, even without disclosure of the patient’s identity, risks undermining the therapeutic relationship. It may also damage the individual or institutional careprovider’s reputation for commitment to patients’ confidentiality more widely in the community, thus making patients’ cooperation with partner notification efforts in the future less likely.

In contrast to laws and regulations that authorize partner notification without the patient’s consent, the CDC’s approach to partner notification relies explicitly on patients’ cooperation. The HIV-infected patient identifies the contact who was or is at risk for infection. When the patient identifies the contact, at a time when the patient was aware of his or her HIV infection, however, the patient is admitting a criminal offense. In many jurisdictions that offense is a felony, for which consequences may be severe. The Lazzarini study reports that the average minimum sentence the patient would receive upon conviction, assuming it is less than a life sentence, is 14.3 years. Unless covered by an applicable evidentiary privilege or statutory protection, any record of the information provided by the patient about the contact might later be used in a criminal prosecution as evidence. Thus, patients’ cooperation in the CDC’s PCRS context poses an entirely different criminal prosecution risk than does partner notification activities undertaken at the point when a patient first tests positive. In the latter circumstance, the patient’s identification of past contacts would not pose the risk of criminal prosecution, because, at the time of the contact, the patient was not aware or his or her HIV infection.

Although the CDC’s reliance on patients’ cooperation makes the disclosure of partners to clinic staff consensual, provision of information regarding the criminal law implications of identifying the partner at past or future risk is not required in obtaining the patient’s cooperation. On that account, the consent of the patient may be invalid. If an informed consent were required prior to the patient’s disclosure of a partner in a clinical setting, there would be little question that the patient should be informed about and understand the potential criminal law implications of the disclosure.

Perhaps the authors of the CDC’s Prevention for Positives guidelines were unaware of this issue. Perhaps it is an issue that the CDC would rather not introduce into the discussion. After all, who would cooperate with the partner notification process with awareness of the criminal law implications? In its blueprint for Prevention for Positives, the CDC simply fails to mention, yet alone discuss, this significant difficulty with its latest initiative for HIV-infected patients.

While it can be said that partner notification is a way that an individual with HIV “gets caught” for having committed the offense of knowing (or intentional) transmission, perhaps primarily by their own doing, what remains in Lazzarini’s formulation is for that person to be “brought to the attention” of law enforcement authorities. In regard to the Prevention for Positives initiative, the patient’s HIV information is disclosed to a third party (the past or current partner) over whom neither the clinical staff, public health officials, nor the patient himself or herself has any control. Even without being told who the source patient was, the notified partner may be able to infer with ease that individual’s identity. Although the notified contact might appreciate the patient’s act of solicitude, the contact may as likely respond angrily and have powerful motives to invoke the criminal law against the patient. The partner may, for example, seek retribution, particularly in the case where the partner learns of his or her own HIV infection as a result of the notification and believes that the patient was the reckless or even intentional source of his or her infection. Or the partner may feel an altruistic desire to deter or prevent the patient, or others, from engaging in risk behaviors involving another partner in the future. Pursuing the criminal option may entail nothing more than telephoning local police or prosecutors. In jurisdictions that allow the filing of private criminal complaints, the process can be initiated directly by the notified contact (even then, many jurisdictions allow the prosecutor’s office to veto private complaints). Ironically, in situations in which the patient’s identity is known to the notified contact, as is the case under many laws that authorize disclosure of the HIV status of sexual assault defendants to complainants, the law often requires that the complainant not further disclose that information. Of course, the complainant may have his or her own self-interest in not disclosing, but in reality such confidentiality provisions may be largely unenforceable. In terms of partner notification, in contrast, the identity of the contact is not directly disclosed, and thus the laws do not impose any confidentiality duty on the notified contact. Even if they did, it is not clear how such confidentiality standards could be enforced. Moreover, once one criminal complaint is made and publicized, including the fact of the defendant’s HIV infection, other contacts of the defendant may come forward, resulting in additional charges against the defendant. In early 2003, for example, Adam Musser was charged in the first of four separate cases involving knowingly transmitting HIV in the Iowa City, Iowa, area. He was subsequently convicted in all four cases and sentenced to 25 years in each.³¹ Three of the cases involved former sexual partners who apparently came forward after learning of Musser’s HIV status from publicity resulting from his initial arrest. One of the complainants, who tested HIV positive after having sexual contact with Musser, appeared on local television to encourage additional complainants to contact prosecutors.³²

While there would appear to be no limits on subsequent disclosure by the notified contact, there may nevertheless be limitations on law enforcement access to confidential information about the patient’s HIV status and behavior involving a risk of HIV transmission. One factor contributing to a prosecutor’s willingness to bring a case against a patient with HIV is the degree of likelihood of conviction, and that question turns on the nature of readily available evidence of the crime. The precise elements of HIV transmission offenses may vary somewhat from jurisdiction to jurisdiction, but in general, a complainant’s statement that the potential defendant had, for example, unprotected sexual contact on a specific date establishes at least one element of the offense. In addition to evidence of that element, all a prosecutor would need, under most such laws, is evidence that on that date, the defendant knew he or she was infected with HIV and knew that his or her behavior posed a risk of transmission. What better way to obtain that evidence than from records of HIV testing and counseling, perhaps from a private clinic’s files or those of other careproviders, or from a local or state health department?

Although criminal prosecutions of individuals with HIV are relatively rare, concerns about the use of confidential healthcare or public health information in such prosecutions are by no means hypothetical. Several such cases have been reported, contrary to the finding of the Lazzarini study.³³ In some cases, confidential HIV information has been disclosed directly from public health officials to law enforcement. In 1992, in the first reported case of this sort, State v. Stark,³⁴ the Court of Appeals of Washington affirmed Calvin Stark’s 10-year sentence upon conviction of intentionally exposing his sexual partners. In that case, Stark was alleged not to have complied with a civil cease-and-desist order issued by the county public health authority, and as a result the county health officer contacted the county prosecutor to seek enforcement of that order by way of a confidential civil proceeding resulting in civil commitment, as then authorized by Washington State law. The prosecutor, however, used the information provided by the public health officer concerning Stark’s HIV status and history of counseling to commence a public criminal prosecution and obtain Stark’s conviction and sentence. Treating the public health official’s disclosure as though it was made for criminal enforcement purposes, the Court of Appeals ruled that although the applicable Washington statute did not explicitly authorize disclosure of confidential HIV public health information to prosecutors for criminal enforcement purposes, that disclosure was impliedly authorized by the legislature’s enactment of the criminal HIV intentional exposure statute. The ruling sets no limits on when or under what circumstances confidential public health information can be disclosed from public health to law enforcement authorities. Apparently, under State v. Stark, any disclosure intended to result in enforcement of the criminal statute is permissible. Such information sharing takes other forms as well. In another case involving public health authorities’ collaboration with law enforcement, the Supreme Court of South Carolina affirmed a conviction based on evidence of the defendant’s HIV status that the prosecutor obtained by court order from the state health department.³⁵ In that case, “John Doe” was charged with knowingly exposing a sexual partner to HIV in violation of a state statute. The state health department agreed that there was a “compelling need” for its disclosure of HIV test results and records indicating that the defendant had acknowledged receiving HIV counseling, and thus that issue was not in dispute. The court’s holding, however, that the records of test results could be admitted into evidence as “business records” (a category of evidence also applicable to government records, in which the matters set forth in those records can be taken as true even without live witness testimony), and that the state need not establish any chain of custody for them, significantly eased the evidentiary burden on the prosecution.

In the context of criminal law enforcement, federal or state confidentiality statutes offer little if any protection in most circumstances. Federal healthcare confidentiality standards, as set forth in the Health Insurance Portability and Access Act (HIPAA) regulations, provide a broad exception for law enforcement access to so-called protected health information (PHI).³⁶ Covered entities may disclose PHI to federal, state, or local law enforcement officials in compliance not only with a court order or court-ordered warrant, but also to comply with “an administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demand, or similar process authorized under law,” provided that the information sought is “relevant and material to a legitimate law enforcement inquiry.” Disclosure of PHI under this provision requires neither the patient’s authorization nor notice to the patient providing an opportunity to agree or object. Whether or not the covered entity receiving the “request” or “demand” for PHI could challenge its relevance or materiality, or the “legitimacy” of the inquiry, the entity may have little incentive to do so.

Some states have a similar lack of confidentiality for HIV information sought for law enforcement purposes. In one such case, Weaver v. State,³⁷ the Court of Appeals of Arkansas affirmed three concurrent 30-year sentences for violation of an Arkansas statute that prohibited exposing another person to HIV. The conviction was based on the defendant’s medical records, which the prosecutor obtained from the county health department by issuing an investigative subpoena, which, under state law, did not even require court approval. The subpoena was issued by the prosecutor to investigate “reports that [Weaver] had exposed others to the HIV virus” in violation of state law. The court of appeals held that the prosecutor’s use of the investigative subpoena to obtain medical records from the health department was proper as authorized by statute, and that a judicially issued search warrant based on probable cause was not required.

State general health information or HIV-specific confidentiality laws frequently include exceptions allowing law enforcement access.³⁸ Or, even when such authorization is not explicit, the courts have found such authorization implicit in the statutes. The Supreme Court of Missouri affirmed the convictions of two defendants, Charles Mahan and Sean Sykes, who were prosecuted for exposing their sex partners to HIV.³⁹ Mahan received a sentence of five years; Sykes was given two consecutive five-year terms. The state supreme court rejected their challenges to their convictions, which were based on municipal health department records of their HIV test results, explaining that a “prosecutor who is contemplating bringing charges against someone under [the Missouri statute] needs to know the HIV status of that individual.”

State statutes frequently allow access to confidential HIV information by court order. In some jurisdictions, the law does not define the circumstances under which a request for a court order should be granted.⁴⁰ In many states, however, the release of HIV information can be ordered by a court only upon a showing of a “compelling need,”⁴¹ a standard that a criminal investigation or prosecution is likely to meet.⁴² The few reported cases rely on interpretations of these state laws. In People v. Hawkrigg, for example, a local court in New York State held that absent a statutory exception or the patient’s waiver of the statutory right, it is improper to admit medical records before a grand jury.⁴³ Nevertheless, the court concluded that the defendant’s disclosure of HIV status to sexual partners constituted a waiver of the confidentiality right. Even when a prosecutor fails to comply with statutory confidentiality standards, however, that violation of the law may be irrelevant to a successful prosecution. In State v. Gonzalez,⁴⁴ the Ohio Court of Appeal affirmed the conviction under a failure to disclose statute, resulting in a sentence of 16 years. The court concluded that the prosecutor’s failure to obtain court authorization on a “compelling need” basis to disclose the HIV information violated the state’s HIV confidentiality statute. That statutory violation, however, was deemed “harmless error,” given the other evidence of the defendant’s HIV status. In one of the few cases to preserve patients’ confidentiality, State v. J.E., a New Jersey court concluded that, without statutory authorization for disclosure of the defendant’s HIV information to the complainant in a sexual assault case, the defendant’s interest in confidentiality of the physician-patient relationship outweighed the need for disclosure.⁴⁵ That case, however, turned on the fact that eight months had passed since the alleged assault, and thus the complainant’s own HIV antibody tests would determine whether he or she was infected with HIV.

The Fourth Amendment requires that prosecutors must obtain a search warrant based on a neutral and impartial judge’s finding of probable cause that a crime has been committed (in this case, knowing exposure to HIV) and that evidence of the crime (proof of the suspect’s knowledge of his or her HIV infection) is to be found in the location specified in the warrant (the suspect’s HIV testing and counseling records) at the time of the search. Thus, in very few cases does the Fourth Amendment’s probable cause requirement pose an impediment to law enforcement demands for confidential information.

The Supreme Court’s recent Fourth Amendment ruling in the context of hospital records, Ferguson v. City of Charleston, has little relevance to the confidentiality of HIV information sought for law enforcement purposes.⁴⁶ The Court held that the Fourth Amendment prohibits a state hospital’s program of taking urine samples from pregnant women suspected of illegal drug use for the undisclosed purpose of giving the test results to criminal prosecutors. What made the underlying urine testing a “search” for Fourth Amendment purposes was the predetermined plan of disclosure for law enforcement purposes. The Court did not address the issue of a law enforcement demand, authorized under state law, for records made by health agencies in the ordinary course of their activities.⁴⁷ Furthermore, the precedent applies only to government agencies’ disclosures, not those of private, nongovernmental hospitals or clinics. Thus, even if a nongovernmental clinic, for example, were to seek out HIV information for the primary but undisclosed purpose of turning it over to prosecutors, the Fourth Amendment would not be implicated. Based on a notified contact’s complaint of sexual contact without disclosure of HIV status, on the other hand, prosecutors may have little difficulty in obtaining a valid search warrant.⁴⁸ Only if constrained by a state constitutional or statutory prohibition on the use of such information will a prosecutor’s search for and use of the resulting evidence be limited.⁴⁹ Such constraints appear to be rare.⁵⁰

The Fifth Amendment protects individuals from being compelled by the government to answer questions that may tend to incriminate them. But when patients participate in partner notification activities, the participation is voluntary, not compulsory, and thus the right against self-incrimination would not apply. The Fifth Amendment privilege against self-incrimination also offers only limited protection against the forced disclosure of confidential health information for law enforcement purposes.⁵¹ But, in most cases, law enforcement officials seek the information not from records in the patient’s possession, but from those in the possession of a corporate or governmental entity, such as a clinic or other careprovider or a public health agency. The patient would have no Fifth Amendment privilege against production of records that are not in his or her personal possession, nor could the custodian of the records assert the privilege on the patient’s behalf.⁵² The custodian of the records could, however, assert that they are protected by a physician-patient or similar privilege, but the existence and scope of such a privilege would be defined by state law and thus may vary from state to state.⁵³ Agencies involved in partner notification and similar activities should consider, as a matter of their own professional ethics, how they will respond in the event that law enforcement officials attempt to obtain records pertaining to their patients.

Some advocates for a law enforcement response to the epidemic would argue that exceptions to confidentiality for criminal law enforcement purposes are appropriate. Those who knowingly violate the law by placing others in deadly danger, they would argue, should lose its protection. That view, however, collides directly with the premise of the CDC’s Prevention for Positives initiative. After all, many of the patients participating in the Prevention for Positives initiative are admitting the commission of criminal offenses, thus risking prosecution, yet the CDC pins its hopes for success of its program on their cooperation. Not only do the criminal laws and lack of confidentiality for incriminating evidence provide a potent disincentive for cooperation, in the event that a patient involved in Prevention for Positives is prosecuted, the nature of the risks involved in participating will be widely and rapidly publicized.

There are several ways to respond to these potential problems both through policy and law reform. First, if the CDC wants people with HIV to incriminate themselves in the process of preventing new infections, the information they provide should not be available to law enforcement for criminal prosecution. This can be accomplished simply by closing the significant confidentiality loopholes that currently exist in many states. For example, Texas has addressed this problem in part by with a statute mandating that “partner names” can be used exclusively for public health investigation and notification, not for law enforcement.⁵⁴ This is an important first step, but it does not help when a prosecution is based not on information directly obtained from partner notification activities, but from information that reaches law enforcement indirectly, as is the case when the notified contact seeks a criminal prosecution and law enforcement authorities look to a source other than the partner notification records for confirming evidence of the potential defendant’s test result and counseling records. New York’s partner notification program, on the other hand, includes broad confidentiality standards and a public pledge on the department of health’s web site that the “Department will NOT disclose this information [about an HIV-infected patient] to other government or private agencies like the . . . police.”⁵⁵ At least one commentator has recommended limitations on evidence to be used in HIV criminal prosecutions in general, so that confidential medical records are not used.⁵⁶ This outcome might depend entirely on a prosecutor’s exercise of discretion in declining to prosecute cases based on such medical records. Other commentators have recommended that public health agencies avoid direct collaboration with law enforcement.⁵⁷ These are all potential means of remedying the problem; none are mentioned, yet alone recommended, by the CDC.

Putting aside the general and entirely legitimate question of whether someone with HIV should ever be prosecuted for an HIV transmission offense,⁵⁸ we should confront directly the more specific question of whether anyone with HIV who cooperates with authorities in identifying their partners should ever be prosecuted. If the government wants information in the nature of an admission of a crime, and cannot ensure the confidentiality of that information, then why should the patient not receive immunity from prosecution for providing it? Indeed, an offer of immunity would serve as a powerful incentive for individuals to identify contacts, if the patient knows that once the contact is identified, then no resulting complaint from the named contact will result in prosecution. The granting of what is called “use and derivative use” immunity—that is, no prosecution could use information provided by the patient, or evidence derived directly or indirectly from the information provided by the patient—would accomplish this purpose.⁵⁹ Such a practice also is fair. If an individual discloses her or his HIV status to a contact or former contact, she or he should at least have the assurance that the disclosure will not result in a criminal prosecution. On a practical level, public health officials do not have the authority to grant immunity from prosecution. Nevertheless, public health officials are in the position to negotiate with local prosecutors regarding their exercise of prosecutorial discretion and adopt immunity policies in favor of encouraging cooperation from persons with HIV.

In the past, the CDC has not been shy about recommending policies and legal reforms at the state or local levels that will, in the CDC’s view, serve the public health.60 In the case of Prevention for Positives, however, the CDC has failed to address critical issues that may affect the success of the initiative. Moreover, the initiative unfairly puts participating patients at risk for criminal prosecution, particularly at a time when public frustration with the seemingly intractable nature of the epidemic may make prosecution an attractive official response. The CDC’s silence on this issue also results in a lack of guidance for clinicians and public health officials involved in implementing the initiative at the local level on the potentially thorny ethical and legal questions regarding their relationship with criminal law enforcement authorities. To date, there apparently have not been prosecutions directly resulting from increased partner notification activities under Prevention for Positives. But if such prosecutions take place, the adverse impact on the success of the initiative could be enormous.

ACKNOWLEDGMENT

The author thanks Peter Goldberger and Catherine Hanssens for their valuable comments on earlier drafts of this article.

NOTES

1. CDC, “Advancing HIV Prevention: New Strategies for a Changing Epidemic—United States, 2003,” Morbidity and Mortality Weekly Report 52, no. 15 (2003): 329-32.

2. N.Y. Comp. Codes R. & Regs. tit. 10, § 63.4(b) (West 2001) www.health.state.ny.us/nysdoh/rfa/hiv/full63.htm (requiring physicians to notify known contacts, including spouses, of patients diagnosed with HIV and to report to health commissioner the identity of known contacts for partner notification purposes).

3. A.M.J. Wensing et al., “Analysis from More than 1600 Newly Diagnosed Patients with HIV from 17 European Countries Shows that 10% of the Patients Carry Primary Drug Resistance: The CATCH-Study,” (abstract of the International AIDS Society www.iasociety.org/abstract/show.asp? abstract_id=11112).

4. D.H. Ciccarone et al., “Sex Without Disclosure of Positive HIV Serostatus in a US Probability Sample of Persons Receiving Medical Care for HIV Infection,” American Journal of Public Health 93, no. 6 (2003): 949-54 (finding 13 percent of serodiscordant partnerships involved unprotected anal or vaginal sex without disclosure).

5. CDC, “Incorporating HIV Prevention into the Medical Care of Persons Living with HIV,” Morbidity and Mortality Weekly Report 52, no. RR-12 (2003): 1-24.

6. See note 5 above, p. 15.

7. P.J. Kissinger et al., “Partner Notification for HIV and Syphilis: Effects on Sexual Behaviors and Relationship Stability,” Sexually Transmitted Diseases (January 2003); 75-82.

8. See note 7 above, p. 81.

9. R. Doughty, “The Confidentiality of HIV-Related Information: Responding to the Resurgence of Aggressive Public Health Interventions in the AIDS Epidemic,” California Law Review 82 (1994); 111-84, pp. 167-75.

10. C. Kightlinger, “Privacy vs. Protection: Lack of HIV Disclosure Places Some at Risk,” Indianapolis Star, 17 July 2003.

11. B. Denizet-Lewis, “Double Lives on the Down Low,” New York Times Magazine, 3 August 2003.

12. E. Wellington, “A Coming Out,” Philadelphia Inquirer, 15 July 2003.

13. J. Tuohy and D. Penner, “Privacy Law Hurt Plasma Case,” Indianapolis Star, 19 July 2003 (quoting prosecutor’s comment that the delay allegedly caused by the HIV confidentiality law was “ridiculous” and that “privacy concerns may have put the public at risk”).

14. J. Van Derbeken, “Ex-S.F. Official Jailed on HIV Charge,” San Francisco Chronicle, 18 September 2003.

15. S. Russell, “Shift in AIDS Prevention Strategy: Emphasis Now on Accountability of Those Infected,” San Francisco Chronicle, 21 September 2003.

16. J. Van Derbeken, “HIV Transmission Case Tossed Out,” San Francisco Chronicle, 10 December 2003 (referring to prosecutors’ lament that “the state Legislature set the bar high on the law so that someone could not be prosecuted simply for withholding his or her HIV status from a partner”).

17. H. Markel, “HIV Secrecy Is Proving Deadly,” New York Times, 25 November 2003.

18. R. Klitzman and R. Bayer, Mortal Secrets: Truth and Lies in the Age of AIDS (Baltimore, Md.: Johns Hopkins University Press, 2003).

19. Z. Lazzarini et al., “Evaluating the Impact of Criminal Laws on HIV Risk Behavior,” Journal of Law, Medicine & Ethics 30 (2002): 239-53; see also S.J. Bray, “Criminal Prosecutions for HIV Exposure: Overview and Analysis,” Yale University Center for Interdisciplinary Research on AIDS 3, no. 1 (2003) (available from HIV Criminal Law Project, www.HIV criminallaw.org).

20. HIV Criminal Law Project, www.HIV criminallaw.org.

21. 42 U.S.C. § 300ff-47, repealed by Ryan White CARE Act Amendments of 2000, Pub. L. No. 106-345, § 301(a), 2000 U.S.C.C.A.N. (114 Stat.) 1319, 1345.

22. 45 C.F.R. § 164.512(b)(1)(iv) (2003).

23. 42 U.S.C. § 300ff-27a.

24. 410 Ill. Comp. Stat. Ann. 305/9(a) (West 1997 & Supp. 2004) (authorizing physician disclosure to spouse if spouse is not otherwise informed); N.Y. Pub. Health Law §§ 2780, 2782 (West 2002) (authorizing physician disclosure to spouse); Tex. Health & Safety Code Ann. § 81.103(7) (West 2001) (same).

25. 38  U.S.C. § 7332(f).

26. E.g., Cal. Health & Safety Code Ann. § 121015 (West 1996) (exception to confidentiality for physicians’ disclosure of HIV test result to person reasonably believed to be the sex partner of the patient);  N.Y. Pub. Health Law §§ 2780, 2782 (West 2002) (authorizing physician’s disclosure to spouse, or sex or needle-sharing partner); S.C. Code Ann. § 44‑29‑146 (physicians and state agencies exempt from liability for disclosure to spouse or other known contact).

27. 674 A.2d 498 (D.C. 1996).

28. 896 P.2d 196 (Alaska 1995).

29. Restatement (Second) of Torts § 595, Comment g (1977) (general privilege to report that “another intends to . . . commit some . . .   serious crime against a third person”); ibid. § 652G (privilege applies to invasion of privacy tort). See also Bartnicki v. Vopper, 532 U.S. 514, 539 (2001) (Souter, J., concurring) (“Where publication of private information constitutes a wrongful act, the law recognizes a privilege allowing the reporting of threats to public safety”).

30. See note 5 above, p. 16.

31. “Man Found Guilty on 4th HIV Count,” Iowa City Press-Citizen, 13 April 2004.

32. “Woman Who Contracted HIV Speaks,” 13 WHO-TV (Des Moines, Iowa), 17 May 2004, www.whotv.com/global/story.asp?s=1874442.

33. Z. Lazzarini et al., “Evaluating the Impact of Criminal Laws on HIV Risk Behavior,” Journal of Law, Medicine & Ethics 30 (2002): 239-253 (finding no reported cases involving disclosure of public health data to law enforcement officials).

34. 832 P.2d 109 (Wash. Ct. App. 1992).

35. Department of Health and Environmental Control v. Doe, 565 S.E.2d 293 (S.C. 2002).

36. 45 C.F.R. § 164.512(f) (2003).

37. 990 S.W.2d 572 (Ark. Ct. App. 1999).

38. E.g., N.J. Rev. Stat. § 26:5C-9(a), (b) (West 1996) (“criminal investigation” exception to HIV confidentiality).

39. State v. Mahan, 971 S.W.2d 307 (Mo. 1998).

40. E.g., Va. Code Ann. § 32.1-36.1 (Matthew Bender 2004) (allowing access by “court order”).

41. E.g., Cal. Health & Safety Code Ann. § 120292(a)(2) (West Supp. 2004) (judicial order required for disclosure of confidential HIV information in criminal proceeding); Fla. Stat. Ann. § 381.004(3)(e) (West Supp. 2004) (“compelling need” required for judicial authorization of disclosure of or access to confidential HIV information); N.Y. Pub. Health Law § 2785 (West 2002) (same); Pa. Stat. Ann. tit. 35, § 7608 (West 2003) (same).

42. Department of Health and Environmental Control v. Doe, 565 S.E.2d 293 (S.C. 2002) (public health agency conceded “compelling need” for its disclosure of HIV information for law enforcement purpose); In re Gribetz, 605 N.Y.S.2d 834 (Rockland County Ct. 1994) (disclosure of defendant’s HIV information to provide evidence of crime); People v. Anonymous, 582 N.Y.S.2d 350 (Monroe County Ct. 1992) (same); see also Community Healthcare Centerone, Inc. v. Florida, 852 So. 2d 322 (Fla. Dist. Ct. App. 2003) (allowing prosecutor’s subpoena for HIV patient records in Medicaid fraud investigation on basis that criminal investigation is a “compelling need” justifying invasion of patients’ privacy rights), appeal denied, 868 So. 2d 522 (Fla. 2004).

43. 525 N.Y.S.2d 752 (Suffolk County 1988).

44. 796 N.E.2d 12 (Ohio Ct. App. 2003).

45. 606 A.2d 1160 (N.J. Super. Ct. 1992).

46. 532 U.S. 67, 78 (2001) (“The reasonable expectation of privacy enjoyed by the typical patient undergoing diagnostic tests in a hospital is that the results of those tests will not be shared with nonmedical personnel without her consent.”).

47. The reliance on Ferguson v. City of Charleston by Lazzarini et al., see note 33 above, for the principle that “information gathered for health purposes should not be used by law enforcement” is therefore misplaced.

48. In re Gribetz, 605 N.Y.S.2d 834 (Rockland County Ct. 1994) (disclosure of defendant’s HIV information to provide evidence of crime); People v. Anonymous, 582 N.Y.S.2d 350 (Monroe County Ct. 1992) (same).

49. See, e.g., 28 C.F.R. §§ 59.1-59.6 (2004) (self-imposed restrictions on issuance of federal search warrants for professional records that implicate the privacy rights of third parties).

50. See, e.g., Limbaugh v. Florida, No. 4D03-4973, 2004 WL 2238978, 2004 Fla. App. LEXIS 14653 (Fla. Dist. Ct. App. Oct. 6, 2004) (state’s seizure of medical records pursuant to validly issued search warrant is not limited by state constitutional right to privacy).

51. United States v. Hubbell, 530 U.S. 27 (2000).

52. Braswell v. United States, 487 U.S. 99 (1988); Rogers v. United States, 340 U.S. 367 (1951).

53. See Northwestern Memorial Hosp. v. Ashcroft, 362 F.3d 923 (7th Cir. 2004) (discussing Illinois medical record privilege law, asserted by hospital on behalf of its patients, in context of a federal government subpoena for hospital records in civil litigation).

54. Tex. Health & Safety Code Ann. § 81.051(c) (West 2001).

55. New York State Department of Health, “HIV Reporting and Partner Notification: What You Need to Know About the Law,” www.health.state.ny.us/nysdoh.hivaids/hivpartner/qanda.htm.

56. D.L McColgin, “Criminal Law,” in AIDS and the Law § 7.1, ed. D.W. Webber (New York: Wiley, 1997), 264-65.

57. J.G. Hodge and L.O. Gostin, “Handling Cases of Willful Exposure Through HIV Partner Counseling and Referral Services,” Women’s Rights Law Reporter 23, no. 1 (2001): 45-62.

58. Although it is not relevant to the thesis of this article, it should be noted that taking the position that persons with HIV infection have a moral and ethical duty to avoid transmitting HIV to others does not compel the conclusion that they should be criminally prosecuted for doing so. For an detailed review of this issue, see L.E. Wolf and R. Vezina, “Crime and Punishment: Is There a Role for Criminal Law in HIV Prevention Policy?” Whittier Law Review 25 (2004): 821-86.

59. This grant of immunity is more limited than “transactional” immunity, which provides complete immunity for the offense to which the patient’s information relates. See Kastigar v. United States, 406 U.S. 441 (1972).

60. For an example of the CDC’s role in recommending law reforms at the state level, see Model State Public Health Privacy Law, http://www.critpath.org/msphpa/privacy.htm.