AG: State's universities should report where COVID-19 students work, live
PHOENIX -- Touting the importance of transparency, Attorney General Mark Brnovich said Friday that state government and its universities should disclose where employees and students who came down with COVID-19 were working and living.
In a formal legal opinion, Brnovich acknowledged that there are various laws governing both patient and student privacy. And he said that employers and schools may not release any information that identifies a specific student or that person's medical history.
But Brnovich also said there is a public interest, particularly right now, in getting as much information out as possible.
"Given the current health emergency, universities should apply the (legal) exceptions and disclose sufficient information related to positive COVID-19 cases so those potentially affected students, staff, visitors, etc., can self-monitor and potentially self-quarantine,'' he wrote.
"At a minimum, universities should disclose information identifying the campus attended by the infected student and buildings or dorms frequented by the infected student during the incubation period and/or while exhibiting symptoms,'' Brnovich continued. "Further, warning other students, parents of student, school staff, and others about potential contact with an affected student is appropriate when, as here, those person's knowledge is necessary to protect the health or safety of the student or other individuals.''
The opinion followed a request by Rep. Mark Finchem, R-Oro Valley, who said he has been tracking data on both the number of cases as well as hospitalizations. He said that led him to conclude that some state agencies -- and, specifically, Arizona State University -- were not putting out information that might help people who might have had contact with someone who is infected protect themselves.
"That's not acceptable,'' he said.
Chris Sigurdson said the University of Arizona does disclose the number of cases on its web site but does not distinguish between students, faculty and staff.
He said there are some situations where the university will inform students who live in a dorm where someone has been infected. But Sigurdson said that does not involve making that information public.
Anyway, he said the university is following the advice of county health officials who say "it's really on the individual to tell the people they were in contact with, to inform them.'' And Sigurdson said he believes the university is doing what Brnovich is recommending.
Brnovich detailed various laws that protect privacy, ranging from the Americans with Disabilities Act to the Family and Medical Leave Act and the Health Insurance Portability and Accountability Act.
The common thread, he said is that employers cannot disclose information that would reveal an employee's identity or confidential medical information. But Brnovich said there is a reason to do something.
"The employer should take all necessary steps to ensure employees and other persons potentially affected are aware that an employee (or other person) who has been physically present in the office has tested positive for COVID-19,'' he wrote. Brnovich said the confidentiality provisions of federal law do not preclude providing others with an infected employee's "non-identifying information such as the infected employee's assigned state agency or work location, so long as doing so would not reveal the identity of the employee.''
Universities provide a different situation, with specific prohibitions against disclosure of "education records,'' something Brnovich said includes student health records.
Still, he said, there is a recognized exception if "the disclosure is in connection with a health or safety emergency.'' In fact, Brnovich reads the law to even allow personally identifiable information to be disclosed to "appropriate parties ... if knowledge of the information is necessary to protect public health or safety of the student or other individual.''
At ASU, spokesman Jay Thorne said his school's policy is based on a different reading of the law.
"Our position is we're following public privacy laws, HIPAA laws, which prohibit disclosure of information such as that,'' he said. What ASU has done instead, Thorne said, is "contact tracing.''
"So any students that were in contact will be informed as a result of that,'' he said, versus public disclosure of the information of the student's dorm or other activities.
Beyond that, Thorne said ASU's advice to all staff and students is "to behave as if people around you are infected.''
"So that means monitoring your symptoms,'' he said. "And that means observing all social distancing protocols.''
Thorne said he has no reaction to Brnovich's opinion as it has not been reviewed by school attorneys.
On Twitter: @azcapmedia