Here are my responses to the questions: 1. G. All of the above. A single HIV sequence added to a database can provide information about genotypic drug resistance, possible transmission linkages, direction of transmission, genotypic/demographic data about the individual, and who may be at increased risk for acquisition. 2. E. Poor - HIPAA provides some protections but better options exist, and as seen in examples privacy breaches can still occur even when HIPAA is followed. 3. 2. Yes - since HIV sequence data is nearly unique to an individual, it constitutes identifiable private information and is therefore considered a HIPAA identifier. 4. I. All of the above. PHI

1. AIDS CLINICAL ROUNDS
The UC San Diego AntiViral Research Center sponsors weekly
presentations by infectious disease clinicians, physicians and
researchers. The goal of these presentations is to provide the most
current research, clinical practices and trends in HIV, HBV, HCV, TB
and other infectious diseases of global significance.
The slides from the AIDS Clinical Rounds presentation that you are
about to view are intended for the educational purposes of our
audience. They may not be used for other purposes without the
presenter’s express permission.

2. Privacy vs. Public Health
November 15,2013
Sanjay Mehta MD
Susan Little MD

3. Molecular Epidemiology to Prevent
HIV Infections
Vs.
www.dailytech.com and www.fanpop.com

4. Question #1
What can be learned from a single pol HIV
sequence (ie drug resistance test) added to a
database of locally sampled HIV sequences?
A.
B.
Genotypic Drug Resistance
Possible Transmission linkage (ie from who or to who HIV
may have been transmitted)
C. Direction of an identified transmission
D. Genotypic and Demographic Information about the individual
E. Who may be at Increased Risk for HIV Acquisition
F. A&B
G. All of the Above

5. Question #2
How well does HIPAA protect patient privacy if
guidelines are followed?
A. Extremely Well- privacy will remain unequivocally protected
B. Very Well –privacy remains protected nearly all of the time
C. Well – privacy remains protected most of the time, and is
usually adequate.
D. Fair – privacy is somewhat protected, but better options do not
exist
E. Poor – privacy is somewhat protected but better options do
exist

6. Question #3
Is an HIV sequence a HIPAA identifier?
1) Yes – all genetic data is explicitly
designated as a HIPAA identifier
2) Yes – since HIV sequence data is nearly
unique to an individual, it is an identifier
3) No – it is not listed as one of the 18 HIPAA
identifiers.

7. Question #4
Protected Health Information (PHI) can be
released/used without authorization for the
following purpose(s):
A.
B.
C.
D.
E.
F.
G.
H.
I.
Treatment
Billing
Other Healthcare issues
Public Health
Research
A&B
A,B,&C
A,B,C,&D
All of the Above

8. Question #5
How worried are you that your personal health
information would be unintentionally released
during normal public health investigations?
Eg. 1) Partner notification
2) Epidemic Outbreak Investigations
3) Year End Summary Reports
A) I think this is a real risk
B) This would only happen with a breach in
security
C) I have no concerns

9. Question #6
What do you feel is the appropriate threshold to
disclose PHI for public health benefit?
A. Only a raging epidemic of a deadly disease with
thousands affected. (eg TB,HIV, malaria)
B. An epidemic of a deadly disease with 100s of
individuals affected (Ebola, polio)
C. Any raging epidemic of infectious origin (eg
influenza, west nile virus)
D. Prevention of any infectious disease (eg norwalk
virus, MRSA)

10. Question #7
If you could predict which individuals were at
risk for transmitting or acquiring HIV using
viral sequence data, would it be reasonable
to act on this information (i.e., prioritize
prevention and treatment services to these
individuals)?
A. Yes
B. No

11. Case #1
On 2-11-2005 the NYC Dept of Health reported
that a 46 yo MSM using crystal
methamphetamine and regularly having
unprotected sex was found to have acquired
multidrug resistant HIV that rapidly
progressed to AIDS (Patient X)
MMWR July 28, 2006

12. Case #1
Timeline showing total lymphocyte count and serologic
testing results (arrows). Infection is presumed to have
occurred ~October 2004 (double line)
Markowitz et al, Lancet 2005

13. Case #1
• Host and viral
genotyping results
**Virus was 36%
more fit than wild type
HIV (i.e., potential for
increased virulence)
Markowitz et al, Lancet 2005

14. Case #1
“Rare strain of multi-drug resistant HIV
that rapidly progresses to AIDS.”
Tom Freiden
The potential for transmission
of a highly virulent virus was
deemed an emergency by the
NYC Dept of Health!
NewYorkTimes.com

15. Case #1
CDC and NYCDOH requested that Patient X’s
pol sequence be compared to sequences from
1) Sequence databases of the 28 laboratories
conducting HIV genotyping in NYC
2) CDC sequence database
3) New York State Department of Health Wadsworth
Center sequence database
4) Databases from 3 large US commercial laboratories
5) Databases from 2 laboratories in Canada
6) Database from a commercial lab in Europe

16. Case #1
NYC providers were asked to report any new
HIV and recent MDR HIV to authorities
NYCDOH then performed
- Partner tracing on 14 identified partners
- 10/14 previously known to be HIV positive
- Genotypes different
- Other 4 unavailable, HIV negative, or refused

17. Case #1
What did the molecular epidemiology show?
-- 3 individuals identified with >95%
sequence similarity to Patient X. All had
attended similar venues or events as
Patient X, but no direct contact. All 3 were
stable on ARV
Markowitz et al, Lancet 2005

18. Case #1
1) Did the molecular epidemiology analysis
provide useful information?

19. Case #1
Many cases when Molecular Epidemiology has
provided important information
1) Detection of Enterobacteriaceae Isolates Carrying
Metallo-Beta-Lactamase --- United States, 2010
-
MMWR Weekly June 25, 2010 / 59(24);750
2) Listeria Cantalope, Multistate Outbreak of Listeriosis
Associated with Jensen Farms Cantaloupe --- United
States, August--September 2011,
- MMWR Weekly October 7, 2011/ 60(39);1357-1358
Personal.psu.edu
Pritzkerlaw.com

20. Case #1
2) Was the Department of Public Health
justified in using phylogenetic analysis to
identify and investigate potential sourcepartner pairs involving this hypervirulent
strain as a matter of public health concern?
When looking back at epidemiologic data,
1/1000 HIV infected individuals have this
type of rapid infection.

21. Case #2
In 2020
- Dept. of Public Health has access to
everyone’s vaccination records.
-The city launches a campaign to find
individuals delinquent on their vaccinations in
the name of public health.
- Each time a person is identified that has
missed at least one vaccine dose, the county
van drives to his/her house.

22. Case #2
1) What is the public health benefit gained
by getting everyone completely
vaccinated (e.g. Mumps, Measles)

23. Case #2
• Marginal benefit
depends upon
R0, vaccination
rate in the
population, and
severity of
disease
Cohen et al. Medical Decision Making 2013

24. Case #2
Cohen et al. Medical Decision Making 2013

25. Case #2
2) Was the benefit to the public outweighed by
the privacy issues associated with
notification?
Depends upon
1) Disease --- variations in severity and R0
2) Vaccination rate in the population
3) The negative consequence of privacy loss

26. Case #3
A young woman in her mid to late 20s is
called by the Department of Public Health.
She is notified that she may be at risk for
syphilis, and that she should come to the
agency to get tested and treated.

27. Case #3
The woman has only been sexually active with
one individual in the last 5 years. The
information provided by the Department of
Public Health was HIPAA compliant, yet
personal identifying information was
unintentionally released as a part of the
partner notification program.

28. Case #3
Given this information by Public Health
She knows that Brian, her partner
1) Has syphilis
2) Has not been in a monogamous
relationship with her

29. Case #3
What is HIPAA?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Name
Geographic subdivision smaller than State*
All dates related to an individual (except year) and age if 89 or older**
Phone number
Fax number
Electronic mail address
Social Security number
Medical record number
Health plan beneficiary number
Account numbers
Certificate/License number
Vehicle Identifiers and serial numbers
Device identifiers and serial numbers
Web Universal Resource Locators (URLs)
Internet Protocol (IP) address numbers
Biometric identifiers
Facial photographs
Any other unique identifier, characteristic or code
*street address, city, county, precinct, zip code
**birth date, admission date, discharge date, date of death

30. Case #3
What is wrong with HIPAA?

31. Case #3
1) Excess paperwork
2) Complicates patient care
3) But does it even work?
-HIPAA was followed in this case, but disclosure
resulted
-Not only can actual data broach privacy… but
the process in which data is released can
as well

32. Case #3
Another Example
Gymrek et al (Science, Jan 2013) deduced the
identity of individuals from personal genome
information

33. Case #3
• Subjects – individuals donating samples for genetic analysis,
and signing releases that they understood privacy
breach was a potential risk
• Resources
– Free Genealogy Databases (eg ysearch, SMGF)
• Associate Y-chromosome tandem repeats (Y-STR) with
surname
– Genetic databases: include age, state of residence
• Not HIPAA identifiers
– Public record search engines
• Can search for people by age, state and surname

34. Case #3
• With these resources were able to identify a
median of 12 individuals associated with a
genetic sample
• Focusing on 3 individuals with published genomes
Gymrek, 2013

35. Case #3
• Next
– Evaluated the Utah Residents with
Northern and Western European
Ancestry (CEU) Database
– 10 Y-STR haplotypes from Illumina seqs
from 1000 genomes project
– 8 of 10 were associated with Mormon
Ancestry using ysearch, SMGF
– In 5 cases – able to identify and link not
only subject but paternal distant
relatives

36. Case #3
Genetic Information
• Advances in technology have not kept pace
with guidelines for use of genetic data that
minimize privacy risks
• Genetic Information Non-discrimination Act of
2008 (GINA) was written to prevent
discrimination based on genetic information
• GINA does not address: community level
genetic information or non-host genetic
information.

37. Case #3
Questions
1) Do alternatives to HIPAA exist?
2) Is there anyway to protect privacy when
using partner notification?

38. Case #3
Public Health Perspective:
“Good quality partner notification should not
compromise rights to confidentiality but
should give practical support to disclose in a
safe way. Increasing our skills and practice in
this area will go a long way to solving the
problems associated with non-disclosure.
Moralising about the responsibilities of
individuals living with HIV will not.”
-Sarah Radcliffe (senior policy officer)
BMJ 2013;346:f2148

39. Case #3
How do you balance Risk to Privacy vs Public
Health Benefit?
Risk = Probability X Quality X Magnitude
1) Probability – Probability of Risk Occurring
2) Quality – How severe is the risk to the individual
3) Magnitude – How significant a breech will it be

40. Case #4
An individual who frequents prostitutes is
diagnosed with HIV.
- He becomes irate and wants to find the
person that has given him the disease.
- He finds out that he can figure this out using
viral sequence data.
- He gets his own virus sequenced and then
gets access to the local resistance database
-He finds a sequence that is very similar to
his own, from a woman living in Encinitas.

41. Case #4
He remembers vaguely that he had slept
with a prostitute from Encinitas in the last
couple of weeks.

42. Case #4
Partner Tracing –
If it is acceptable in the context of Public Health
(with the associated risk of privacy breach),
then should individuals be able to collect
these same data.

43. Case #4
1) If our subject wanted to pursue charges
against the prostitute, would this information
be sufficient for a case?

44. Case #4
German Singer Arrested for
Spreading HIV
Singer arrested in 2009 for “inflicting grievous
bodily harm” by sleeping with three men when
she knew she was HIV+, infecting one of them.
Received two-year suspended sentence and 300
hours of community service.

45. Questions again!

46. Question #1
What can be learned from a single pol HIV
sequence (ie drug resistance test) added to a
database of locally sampled HIV sequences?
A.
B.
Genotypic Drug Resistance
Possible Transmission linkage (ie from who or to who HIV
may have been transmitted)
C. Direction of an identified transmission
D. Genotypic and Demographic Information about the individual
E. Who may be at Increased Risk for HIV Acquisition
F. A&B
G. All of the Above

47. Question #2
How well does HIPAA protect patient privacy if
guidelines are followed?
A. Extremely Well- privacy will remain unequivocally protected
B. Very Well –privacy remains protected nearly all of the time
C. Well – privacy remains protected most of the time, and is
usually adequate.
D. Fair – privacy is somewhat protected, but better options do not
exist
E. Poor – privacy is somewhat protected but better options do
exist

48. Question #3
Is an HIV sequence a HIPAA identifier?
1) Yes – all genetic data is explicitly
designated as a HIPAA identifier
2) Yes – since HIV sequence data is nearly
unique to an individual, it is an identifier
3) No – it is not listed as one of the 18 HIPAA
identifiers.

49. Question #4
Protected Health Information (PHI) can be
released/used without authorization for the
following purpose(s):
A.
B.
C.
D.
E.
F.
G.
H.
I.
Treatment
Billing
Other Healthcare issues
Public Health
Research
A&B
A,B,&C
A,B,C,&D
All of the Above

50. Question #5
How worried are you that your personal health
information would be unintentionally released
during normal public health investigations?
Eg. 1) Partner notification
2) Epidemic Outbreak Investigations
3) Year End Summary Reports
A) I think this is a real risk
B) This would only happen with a breach in
security
C) I have no concerns

51. Question #6
What do you feel is the appropriate threshold to
disclose PHI for public health benefit?
A. Only a raging epidemic of a deadly disease with
thousands affected. (eg TB,HIV, malaria)
B. An epidemic of a deadly disease with 100s of
individuals affected (Ebola, polio)
C. Any raging epidemic of infectious origin (eg
influenza, west nile virus)
D. Prevention of any infectious disease (eg norwalk
virus, MRSA)

52. Question #7
If you could predict which individuals were at
risk for transmitting or acquiring HIV using
viral sequence data, would it be reasonable
to act on this information (i.e., prioritize
prevention and treatment services to these
individuals)?
A. Yes
B. No

53. Acknowledgements
Michael Kalichman
Sergei Kosakovsky Pond
Davey Smith
Staal Vinterbo
Joel Wertheim