How your vaccination record can be accessed by local municipalities

Local health directors, doctors and school nurses are now, by executive order of the governor, allowed to access the vaccination records of every Connecticut resident.

Though privacy advocates warn that Gov. Ned Lamont’s order should not set a precedent, it is not one they are fighting in the midst of the ongoing coronavirus pandemic.

“This should not and cannot become the norm for how we handle public health emergencies in the future,” ACLU of Connecticut Executive Director David McGuire said.

The executive order, signed by Lamont on Aug. 19, does not conflict with the federal Health Insurance Portability and Accountability Act, commonly referred to as HIPAA, according to John Cogan, an assistant professor of law at the University of Connecticut.

“People get all wigged out about the release of medical information,” he said.

Prior to taking his post at UConn’s school of law, Cogan worked for the federal department of Health and Human Services, where he was involved in drafting the HIPAA privacy provisions.

He said those regulations are often misinterpreted, and assumed to cast a far wider net than they were intended to cover.

“The privacy regulations were designed to limit the use and disclosure of protected health information under certain circumstances by a limited number of entities,” he said.

HIPAA, Coga explained, only applies to very specific groups of people. Doctors, for example, and health insurance companies, are prohibited by law from sharing a patient’s personal medical information without the person’s consent.

But the governor’s executive order specifically grants the state commissioner of public health the power to “disclose information reported to the Department of Public Health regarding a COVID-19 vaccine recipient’s immunization information, for the purposes of reducing the spread of COVID-19.”

HIPAA, Cogan said, does not prevent the state Department of Public Health from sharing that data.

“If I’m walking down the street, and I find all your medical records in a box, I can give them to whoever I want,” he said. “That is not a violation of HIPPA because I am not a covered entity under HIPAA.”

“This information isn’t barred by HIPAA,” Cogan said. “To my knowledge, release of this information is not barred by any other law.”

The question for Cogan and McGuire, is how this order is implemented. Cogan said he does not expect this information will be used in any coercive manner. “Nobody’s going to appear at your door with a needle,” he said.

But McGuire said the ACLU will be paying attention. He’s concerned about “mission creep,” he said, and how this sort of order is replicated either by Lamont or his successors.

“We have to make sure this is not precedent, whether for this governor or future governors,” he said. “This is an order that should be used judiciously by public health officials.”

Though he said there is “the possibility that it will be overused or misused by a municipality,” McGuire said, “I don’t think it’s intended and should not be used as an in to use pressure tactics on people.”

Lisa Morrissey, who has been a public health official for nearly a decade, said the idea that local health officials will be accessing individual vaccination records and accosting unvaccinated residents is “farfetched.”

“We just don’t have that capacity,” said Morrissey, who is New Milford health director and the interim public health director for the Pomperaug health district. “I don’t think you would find any public health official who would even support such a measure.”

The access granted by the governor’s executive order helps when residents have lost their vaccination cards, Morrissey said, and when a person does contract the virus, it helps local health officials make sure everyone else is safe.

“Sometimes people say that they were vaccinated and they don’t have to quarantine,” she said. “We look up in the system to see if they are vaccinated.”

State law has long granted access to students’ immunization records, and doctors have always had access to their own patients’ medical data. Even Morrissey said much of the information was already obtainable by local health directors through the state’s CT WiZ system.

Max Reiss, a spokesperson for Lamont, said the existing statute “does not address disclosure of adult COVID vaccinations which the CDC required vaccine providers to report to their home state immunization system.”

“The executive places the access by providers, school nurses and local health departments to COVID-19 vaccine information in the same position as childhood immunization information,” Reiss said.