Release of health data to law enforcement raises privacy concerns

The release of private health information of Tennesseans who have tested positive for COVID-19 to law enforcement by Gov. Bill Lee’s administration is facing pushback from lawmakers, advocates for minority communities and at least one police force that originally agreed to get the information. 

The Tennessee Black Caucus on Saturday called on Lee to end the practice of sharing names and addresses of residents on daily lists sent by the Tennessee Department of Health to sheriffs and police chiefs. 

“Our membership has heard from many in the African-American community who are concerned by this release of personal data without their knowledge, as well as many in the Hispanic community who fear possible other uses of the information,” a statement from the caucus said.

On Friday, a public relations firm representing the Chattanooga Housing Authority, a public housing agency with its own police force, said in an email that “the CHA has taken the step of removing the Authority from receiving any personal data about COVID-19 patients who reside in any of CHA’s communities.”

“The CHA is doing all it can to provide testing to the community’s most vulnerable populations and is committed to ensuring the privacy of anyone who is tested,” the statement said. 

The housing authority was one of at least 67 law enforcement departments across the state that signed an agreement — a memorandum of understanding or MOU — with the Tennessee Department of Health to receive the daily lists of positive individuals. 

The department made the offer In letters sent to local police chiefs and sheriffs in April. The letters, obtained by Tennessee Lookout, said the offer was at Lee’s request. 

“Governor Lee encourages each of you to enter into the MOU with Health to allow your officers and employees to protect themselves by having the information Health is providing.”

“Health will continue to provide daily lists to you through the duration of the state of emergency for COVID-19,” the letters said. 

A spokesman for Lee did not respond to questions about whether the governor would revisit his decision to make the information available. A Saturday statement by the Black caucus said that the governor “has promised to work with the caucus and look into how the process could be altered.”

Law enforcement agencies are not the only public entities in the state receiving daily lists of people who have tested positive for COVID-19, Tennessee Lookout has learned.

Separately, the health department also entered similar agreements with two state agencies: the Department of Safety & Homeland Security and the Department of Commerce and Insurance. There are additional separate agreements to share Tennesseans’ health information with local jail administrators.

In the state’s agreement with the Department of Safety & Homeland Security, which oversees the Tennessee Highway Patrol, the purpose of the information sharing is “so first responders answering a call at a listed address may take extra precautions, such as the enhanced use of personal protective equipment. Health believes these disclosures are necessary to prevent or lessen a serious and imminent threat to first responders and to the public health, safety and welfare.”

The agreement says the department can provide the Tennessee Highway Patrol dispatchers and first responders a list of names and addresses of COVID-19 positive individuals in their jurisdiction.

The Department of Commerce and Insurance has oversight over the Tennessee Emergency Communications Board, which regulates 911call centers. The agreement says that the board will “act as a clearinghouse by routing a list of names and addresses of individuals documented as having tested positive, or received treatment, for COVID-19 to the applicable jurisdiction,” to inform firefighters, paramedic and other first responders.

“Health (department) further believes that, armed with this information, ECD may prevent or lessen this threat by making the information available to first responders,” the agreement says.

A statement from the Department of Commerce and Insurance on Monday said:

“With guidance from the U.S. Department of Health and Human Services, the Tennessee Emergency Communications Board implemented this procedure in coordination with the Governor’s Office and the Tennessee Department of Health for the limited purpose of safeguarding the health of Tennessee’s first responders. As we continue to combat the COVID-19 pandemic, this procedure will give first responders the notification to take extra precautions, including enhanced use of personal protective equipment (PPE), when serving COVID-19 patients across the Volunteer State, and allowing for the conservation of PPE on non-COVID-19 related response calls.”

The information is scrubbed daily and once individuals have been cleared they are removed from the list, a spokeswoman said. First responders only learn of a person’s status if they are the person subject to an emergency response.

Another memorandum offers the daily lists to county jails.

Immigrant community advocates have worked hard during the pandemic to combat mistrust of public institutions to ensure individuals step forward to get tested and treated, said Lisa Sherman-Nikolaus, policy director for the Tennessee Immigrant and Refugee Rights Coalition. 

“Today’s reports are deeply concerning because the impact of information sharing between public health agencies and local law enforcement may worsen the deficit of trust that governments have been working to improve with many communities, including immigrants and communities of color,” Sherman-Nikolaus said Friday. 

“We will work to get more information about the MOUs, how they are being implemented, and what privacy protections are in place for all Tennesseans who access testing,” she said. 

At least 35 police and 32 sheriffs departments across the state have entered into an agreement to obtain lists which include the names and addresses of individuals who have tested positive for the virus. 

“Additional entities are being added daily,” said Shelley Walker, a spokeswoman for the health department.

The agencies receiving personal health information include major police departments such as the Knoxville Police as well as smaller forces, including the Belle Meade Police Department, the Nashville Airport Authority and the Austin Peay State University Police. 

“It’s just for safety reasons,” Manchester Police Chief Mark Yother told the Chattanooga Times Free Press. “It’s just another step in trying to keep officers safe.”

Yother said the names and addresses are held by dispatchers who alert officers if there’s a police call at an address where someone who has been confirmed with COVID-19 lives.

Dispatchers do not provide information over the radio, the chief said, they ask the officer to call in for information.

“We’re trying to protect their privacy as much as possible without endangering an officer,” he said. “Fortunately, we don’t have a lot of cases here like they do in the bigger cities,” he said, “but it’s still concerning.”

Nashville, Memphis and Chattanooga police and sheriff’s departments have not signed onto those information-sharing agreements with the state’s health department.

“The DCSO (Davidson County Sheriff’s Office) has not signed it and has no intention of signing it at this point,” spokeswoman Karla West said. 

But in Nashville, Tennessee’s largest city, local health officials have shared their own data. 

Metro Nashville Police Department spokesman Don Aaron said in an emailed statement on Friday that police were receiving the “addresses of persons who have tested positive or are quarantining for COVID-19” but not from the state department of health.

Instead the information comes from Nashville’s local health department, he said.

“The information is entered into a computer dispatch system so that first responders “can take additional precautions (maximum PPE use and/or distancing protocols) if called to respond to a listed address,” Aaron said. 

The information is removed once a person has been cleared of testing positive for COVID-19 and is not shared with U.S. Immigration and Customs Enforcement (ICE) or the Davidson County Sheriff’s Office, Aaron said.

Colby Sledge, a Metro Nashville council member, said he was frustrated that local elected officials had not been informed about the sharing of private patient information. 

In heat maps shared by the Metro Nashville health department, the highest concentrations  of COVID-19 patients are in predominantly immigrant residential areas in south Nashville.

“It’s mind-boggling to me that for our most vulnerable communities, their data is being shared,” said Sledge. 

COVID-19 guidelines issued by the federal government allow public agencies to release the names of individuals infected or exposed to the virus to law enforcement, paramedics and other first responders without their permission.

At least four other states have authorized the release of some information to law enforcement, according to the Electronic Frontier Foundation, an organization that advocates for civil liberties in the digital world. They are Massachusetts, Alabama, Florida and North Carolina.