How your vaccination record can be accessed by local towns

Local health directors, doctors and school nurses are now, by executive order of the governor, allowed to access the vaccination records of every Connecticut resident.

Though privacy advocates warn that Gov. Ned Lamont’s order should not set a precedent, it is not one they are fighting in the midst of the ongoing coronavirus pandemic.

“This should not and cannot become the norm for how we handle public health emergencies in the future,” ACLU of Connecticut Executive Director David McGuire said.

The executive order, signed by Lamont on Aug. 19, does not conflict with the federal Health Insurance Portability and Accountability Act, commonly referred to as HIPAA, according to John Cogan, an assistant professor of law at the University of Connecticut.

“People get all wigged out about the

release of medical information,” he said.

Prior to taking his post at UConn’s school of law, Cogan worked for the federal department of Health and Human Services, where he was involved in drafting the HIPAA privacy provisions.

He said those regulations are often misinterpreted, and assumed to cast a far wider net than they were intended to cover.

“The privacy regulations were designed to limit the use and disclosure of protected health information under certain circumstances by a limited number of entities,” he said.

HIPAA, Coga explained, only applies to very specific groups of people. Doctors, for example, and health insurance companies, are prohibited by law from sharing a patient’s personal medical information without the person’s consent.

But the governor’s executive order specifically grants the state commissioner of public health the power to “disclose information reported to the Department of Public Health regarding a COVID-19 vaccine recipient’s immunization information, for the purposes of reducing the spread of COVID19.”

HIPAA, Cogan said, does not prevent the state Department of Public Health from sharing that data.

“If I’m walking down the street, and I find all your medical records in a box, I can give them to whoever I want,” he said. “That is not a violation of HIPPA because I am not a covered entity under HIPAA.”

“This information isn’t barred by HIPAA,” Cogan said. “To my knowledge, release of this information is not barred by any other law.”

The question for Cogan and McGuire, is how this order is implemented. Cogan said he does not expect this information will be used in any coercive manner. “Nobody’s going to appear at your door with a needle,” he said.

But McGuire said the ACLU will be paying attention. He’s concerned about “mission creep,” he said, and how this sort of order is replicated either by Lamont or his successors.

“We have to make sure this is not precedent, whether for this governor or future governors,” he said. “This is an order that should be used judiciously by public health officials.”

Though he said there is “the possibility that it will be overused or misused by a municipality,” McGuire said, “I don’t think it’s intended and should not be used as an in to use pressure tactics on people.”

Lisa Morrissey, who has been a public health official for nearly a decade, said the idea that local health officials will be accessing individual vaccination records and accosting unvaccinated residents is “far-fetched.”

“We just don’t have that capacity,” said Morrissey, who is New Milford health director and the interim public health director for the Pomperaug health district. “I don’t think you would find any public health official who would even support such a measure.”

The access granted by the governor’s executive order helps when residents have lost their vaccination cards, Morrissey said, and when a person does contract the virus, it helps local health officials make sure everyone else is safe.

“Sometimes people say that they were vaccinated and they don’t have to quarantine,” she said. “We look up in the system to see if they are vaccinated.”

State law has long granted access to students’ immunization records, and doctors have always had access to their own patents’ medical data. Even Morrissey said much of the information was already obtainable by local health directors through the state’s CT WiZ system.

Max Reiss, a spokesperson for Lamont, said the existing statute “does not address disclosure of adult COVID vaccinations which the CDC required vaccine providers to report to their home state immunization system.”

“The executive places the access by providers, school nurses and local health departments to COVID-19 vaccine information in the same position as childhood immunization information,” Reiss said.

The executive order amends the existing statute to allow access to adults’ vaccination records. Usually, only the state legislature, not the governor, has the power to create or amend law, according to Cogan.

“The governor’s order purports to modify a statute,” he said. “The order also states that the governor has the power to do so under ‘the Constitution and the laws of the State of Connecticut.’ However, the order does not specify the exact source of that authority.”

That authority is derived from the governor’s power under the emergency declaration. Specifically, state law stipulates that “following the governor’s proclamation of a civil preparedness emergency” — or a public health emergency — “the governor may modify or suspend in whole or in part by order … any statue, regulation or requirement or part thereof whenever the governor finds such statute, regulation or requirement or part thereof is in conflict with the efficient and expeditious execution of civil preparedness functions or the protection of the public health.”

“We’re in a unique period,” McGuire said. “There is a compelling interest for the governor to go further than usual.”

The executive order reminded Cogan of a landmark case in public health law, Jacobson v. Massachusetts.

In that 1905 case, a resident of Cambridge, Mass., refused to be vaccinated against smallpox, and though Cogan said many people recall the details incorrectly, “the case was not about holding Jacobson down and plunging the needle into his arm.”

“It was about whether he had to pay a fine or not,” Cogan said. In that case, the U.S. Supreme Court ruled in favor of the state and ordered Jacobson to pay the $5 fine for not being vaccinated.

Cogan speculated the governor’s executive order may have the effect, intended or otherwise, of allowing vaccine mandates by municipalities and companies.