RAQs: Recently Asked Questions

Topic: Contact tracing and privacy in libraries - 5/28/2020
Given libraries are preparing plans to reopen, I am looking for a follow up to the 3/19/2020 quest...
Posted: Thursday, May 28, 2020 Permalink

MEMBER QUESTION

Given libraries are preparing plans to reopen, I am looking for a follow up to the 3/19/2020 question posted to Ask The Lawyer pertaining to being informed that an individual who has been confirmed to have COVID visited one of our libraries. (participated in a program).

With the new tracing protocols (COVID-19) required by Re-Open New York, what, if any, impact will there be on CPLR 4509? Will libraries be required to provide information and if so, to what extent? Currently we require a judicial subpoena in order to provide any information regarding a patron - including identifying if a patron has been in the library.

Your guidance is much appreciated.


 

WNYLRC ATTORNEY'S RESPONSE

The short answer

This answer is being written on May 28th, 2020.

At this time, in addition to Executive Order 202 issued on March 7, 2020 and declaring a state of emergency in New York through September 7th, 2020, there are 30 Executive Orders.

These Executive Orders create temporary modifications to a wide and ever-increasing array of state law and regulations. They have impacted elections, public health practices, landlord tenant relations, and countless operations of the New York State justice system.

However, as of this date, there has been no modification of section 4509 of the state Civil Procedure Law and Rules (“CPLR”), which, with only very limited exceptions, bars third-party access to a user’s library records.

Therefore, at this time, any library receiving a request from a third party for confidential library records, even if in relation to contract tracing efforts, should follow the same procedure they do for all other third-party requests: require a subpoena or judicial order.

 

The same answer, but with more information and analysis

I am grateful to the member for posing this question, because not only is it important to have clarity on this precise issue, it is important for information management professionals across the state of New York, including some of New York's most trusted information professionals — librarians — to be thinking about the impact and finer points of contact tracing.

So what is “contact tracing”?

The Centers for Disease Control describes contract tracing this way on their current COVID-19 response page[1]:

In contact tracing, public health staff work with a patient to help them recall everyone with whom they have had close contact during the timeframe while they may have been infectious.  Public health staff then warn these exposed individuals (contacts) of their potential exposure as rapidly and sensitively as possible.

After declaring COVID-19 a “communicable disease” as defined by the state’s Public Health Law, New York began using contact tracing to combat COVID-19.[2]  Local health departments led the way, organizing information and coordinating warnings within their jurisdiction, an initiative that inspired the previous question referenced by the member.

With the adoption of “New York Forward,” 30 contact tracers for every 100,000 residents is one of the express metrics[3] being used to establish when one of the state’s ten regions is ready to begin a phased reopening.  So, every region will be recruiting and deploying “tracers” to gather information and issue warnings to individuals who testing has confirmed have been exposed to COVID-19.

While emphasizing that such warnings must be issued “rapidly,” the CDC’s guidelines for contact tracing also emphasize privacy:

To protect patient privacy, contacts are only informed that they may have been exposed to a patient with the infection. They are not told the identity of the patient who may have exposed them.”

The State of New York, however, does not require this level of confidentiality in its laws regarding quarantine, notification of infection, and contact tracing related to most communicable diseases.  While the precise regulations governing the use of contact tracing to fight the spread of HIV require the consent of the patient, the regulations applying to COVID-19 do not have similar requirements.[4] Nor is such information regarded as protected health information (“PHI”) under HIPAA.

I am highlighting these considerations not to denigrate contact tracing, which has been documented as effective in combating pandemics. However, as of this writing, as reported by The New York Times, many in authority, or with credibility in the arenas of privacy and data security, have expressed serious concerns regarding the procurement and arrangement of the software and personnel that will be used in this massive public health initiative.

Caution about privacy, even during times of emergency, is a good thing.

With all that, the collaborative, community health-focused approach I outlined on March 19, 2020, in https://www.wnylrc.org/ask-the-lawyer/raqs/122 is one I continue to endorse.

In addition to that approach, here is a suggested reply in the event your library is contacted by a state-employed contact tracer, designed to work with your standard protocol for complying with 4509:

[After verifying credentials]

We know your work is critical to public health.  Please send us a written list of what you need, and we will work to obtain consent from our users, as required by CPLR 4509.  In the alternative, please ensure what you need is very thoroughly set forth in a duly issued subpoena or judicial order.  Our library will work to expedite your request as soon as we know we are authorized to do so.

 

One final point

After conducting the research set forth in this answer, it is my opinion that CPLR 4509’s assurance of the confidentiality of library records is not at odds with the current emergency measures our state is taking to protect lives and get our world back on track. 

First, it is critical to remember that under 4509, a person may give their written consent to disclosure.  Many people, upon learning they might pose a danger, will give their express and voluntary consent, if they have the capacity at the time.  That is their right, and there is no concern with your library contacting them to ask the question.

Second, if the need for confidential library records is truly critical, local board of health officials—and the tracers who will be helping their localities—can invoke the authority created by the public health law[5] to obtain duly authorized subpoenas. 

Unlike many other laws and regulations, CPLR 4509 can remain as written, while New York undertakes an unprecedented, massive effort to conduct contact tracing, and protect public health.  

Thank you for an important question.

 



[2] Since reporting new or unusual communicable diseases is also required, cases were probably also reported before March 7.

[3] These metrics are laid out in a graph found at https://www.governor.ny.gov/programs/new-york-forward.

[4] That section is 10 NYCRR 2.10, which states: “It shall be the duty of every physician to report to the city, county or district health officer, within whose jurisdiction such patient resides, the full name, age and address of every person with a suspected or confirmed case of a communicable disease, any outbreak of communicable disease, any unusual disease or unusual disease outbreak and as otherwise authorized in section 2.1 of this Part, together with the name of the disease if known, and any additional information requested by the health officer in the course of an investigation pursuant to this Part, within 24 hours from the time the case is first seen by him, and such report shall be by telephone, facsimile transmission or other electronic communication if indicated, and shall also be made in writing, except that the written notice may be omitted with the approval of the State Commissioner of Health.

[5] New York Public Health Law, Section 309.

Tags: COVID-19, CPLR 4509, Emergency Response, Privacy, Contact tracing

Year

0

2016 4

2017 24

2018 29

2019 42

2020 51

Topics

501c3 2

Academic Libraries 2

Accessibility 4

ADA 7

Association Libraries 1

Branding and Trademarks 1

Broadcasting 1

Budget 1

Circular 21 1

Contact tracing 1

CONTU 2

Copyright 69

COVID-19 35

CPLR 4509 3

Crafting 1

Criminal Activity 1

Data 2

Defamation 1

Derivative Works 3

Digital Access 9

Digital Exhibits 1

Digitization and Copyright 10

Disclaimers 3

Discrimination 1

Dissertations and Theses 1

DMCA 2

Donations 3

E-Books and Audiobooks 2

Ed Law 2-d 1

Education Law Section 225 1

Elections 2

Emergency Response 33

Employee Rights 7

Ethics 3

Executive Order 3

Fair Use 29

Fan Fiction 1

Fees and Fines 3

FERPA 5

First Amendment 1

First Sale Doctrine 3

Forgery and Fraud 1

Friends of the Library 1

Fundraising 1

Hiring Practices 1

Historic Markers 1

HRL 1

Identity Theft 1

IRS 1

Labor 3

Laws 18

LibGuides 1

Library Buildings 1

Library Programming and Events 7

Licensing 3

Local Organizations 1

Management 16

Meeting Room Policy 3

Microfilm 1

Movies 5

Municipal Libraries 4

Music 11

Newspapers 3

Omeka 1

Online Programming 11

Open Meetings Law 1

Oral Histories 1

Overdrive 1

Ownership 1

Parodies 1

Personnel Records 1

Photocopies 15

Policy 28

Preservation 2

Privacy 10

Property 3

PTO, Vacation, and Leave 1

Public Access 1

Public Domain 7

Public Health 1

Public Libraries 4

Public Officers Law 1

Public Records 2

Quarantine Leave 1

Reopening policies 3

Retention 3

Retirement 1

Ripping/burning 1

Safety 2

Salary 2

School Ballots 1

School Libraries 5

Section 108 2

Section 110 2

Section 1201 1

Security Breach 2

Sexual Harassment 2

SHIELD Act 2

Smoking or Vaping 2

Social Media 4

SORA 1

Story time 3

Streaming 12

SUNY 1

Swank Movie Licensing 3

Taxes 4

Teachers Pay Teachers 1

Telehealth 1

Textbooks 3

Trustees 3

Umbrella Licensing 2

VHS 4

Voting 1

W3W 1

WAI 1

Yearbooks 2

Zoom 1

The WNYLRC's "Ask the Lawyer" service is available to members of the Western New York Library Resources Council. It is not legal representation of individual members.