Tennessee will stop providing COVID-19 patient data to law enforcement, first responders

NASHVILLE, Tenn. (WTVF) — The State of Tennessee will stop sharing COVID-19 patient data with local law enforcement and first responders.

The state says it will stop providing the names of patients who've tested positive for the virus, effective Sunday, May 31.

According to the state, its memorandum of understanding (MOU) regarding the disclosure of protected health information was enacted during the early stages of the pandemic, partly due to a lack of PPE for first responders.

In an email, the state told first responders and local law enforcement that the MOU is no longer needed because the PPE supply chain has stabilized and our understanding of COVID-19 has increased, saying the disclosure of information is “no longer warranted.”

"Throughout the implementation of the MOUs, meant to responsibly disclose PHI to control and prevent the spread of COVID-19 in the state, Health has tried to maintain a balance between respecting patient privacy rights and preventing and lessening a serious health threat to first responders and law enforcement. Even as we continue to address many COVID-19 challenges, two developments make this an appropriate time for Health to cease these COVID-19 PHI disclosures," the email said.

The controversial policy, which was first uncovered by Tennessee Lookout, met bipartisan opposition. Representative Scott Cepicky, R-Culleoka, sent a letter with concerns about privacy. The following day, Governor Bill Lee said, "Well, all along the policy was a temporary one. So we know that. The only decision we have is when to suspend it."

More than 70 departments including sheriffs and police chiefs will no longer be able to have access to the data. Larger counties like Davidson aren't included since they finance their own health department.

The Metro Nashville Police Department continues to receive information but in a statement, spokesperson Don Aaron said additional safeguards have been added.

The names of people who tested positive for the virus are purged from the MNPD database every week, and addresses are purged 30 days after entry. Officers are only aware of a positive case if they are dispatched to a location reflecting positivity, or if they are dealing with a specific individual who is listed as positive.

Earlier this month, the Metro Public Health Department also confirmed that it shared COVID-19 patient data with Metro Police, saying that "sharing this information with [Metro Police] in a secure way is good for the community and it's good for our first responders."

When asked if the database sharing could violate the Health Insurance Portability and Accountability Act (HIPAA), a federal law that aims to protect patient information, Metro Public Health Department Spokesperson Brian Todd said the law allows for health departments to share limited information when it is for "the safety of the community."

The Metro Public Health Department said it is reviewing the State’s decision but will continue to release the information for now.

An earlier Metro Health Dept. Statement:

"Additional safeguards were added this month. Effective May 18, the names of persons who have tested positive for COVID-19 are purged from the MNPD database every week on Monday. The database is repopulated with currently active cases after the purge, so that the names of those who have recovered are not in the system.

The addresses of persons who have tested positive for COVID-19 are purged from the Computer Aided Dispatch System 30 days after their entry (essentially the addresses electronically expire in the system).

Officers are only aware of a positive case if they are dispatched to a location reflecting positivity, or if they are dealing with a specific individual who is listed as positive. There is not a mechanism for officers to do a query for COVID positive persons or addresses. If an officer should respond to a call at a positive address or find themselves dealing with a positive individual, they know that such information is not for public dissemination and is for official use only. Unauthorized dissemination is a violation of MNPD policy, and the department has the capability of auditing who accessed a particular record."