Submission Date:
Question:
Given libraries are preparing plans to reopen, I am looking for a follow up to the 3/19/2020 question posted to Ask The Lawyer pertaining to being informed that an individual who has been confirmed to have COVID visited one of our libraries. (participated in a program).
With the new tracing protocols (COVID-19) required by Re-Open New York, what, if any, impact will there be on CPLR 4509? Will libraries be required to provide information and if so, to what extent? Currently we require a judicial subpoena in order to provide any information regarding a patron - including identifying if a patron has been in the library.
Your guidance is much appreciated.
Answer:
The short answer
This answer is being written on May 28th, 2020.
At this time, in addition to Executive Order 202 issued on March 7, 2020 and declaring a state of emergency in New York through September 7th, 2020, there are 30 Executive Orders.
These Executive Orders create temporary modifications to a wide and ever-increasing array of state law and regulations. They have impacted elections, public health practices, landlord tenant relations, and countless operations of the New York State justice system.
However, as of this date, there has been no modification of section 4509 of the state Civil Procedure Law and Rules (“CPLR”), which, with only very limited exceptions, bars third-party access to a user’s library records.
Therefore, at this time, any library receiving a request from a third party for confidential library records, even if in relation to contract tracing efforts, should follow the same procedure they do for all other third-party requests: require a subpoena or judicial order.
The same answer, but with more information and analysis
I am grateful to the member for posing this question, because not only is it important to have clarity on this precise issue, it is important for information management professionals across the state of New York, including some of New York's most trusted information professionals — librarians — to be thinking about the impact and finer points of contact tracing.
So what is “contact tracing”?
The Centers for Disease Control describes contract tracing this way on their current COVID-19 response page[1]:
“In contact tracing, public health staff work with a patient to help them recall everyone with whom they have had close contact during the timeframe while they may have been infectious. Public health staff then warn these exposed individuals (contacts) of their potential exposure as rapidly and sensitively as possible.”
After declaring COVID-19 a “communicable disease” as defined by the state’s Public Health Law, New York began using contact tracing to combat COVID-19.[2] Local health departments led the way, organizing information and coordinating warnings within their jurisdiction, an initiative that inspired the previous question referenced by the member.
With the adoption of “New York Forward,” 30 contact tracers for every 100,000 residents is one of the express metrics[3] being used to establish when one of the state’s ten regions is ready to begin a phased reopening. So, every region will be recruiting and deploying “tracers” to gather information and issue warnings to individuals who testing has confirmed have been exposed to COVID-19.
While emphasizing that such warnings must be issued “rapidly,” the CDC’s guidelines for contact tracing also emphasize privacy:
“To protect patient privacy, contacts are only informed that they may have been exposed to a patient with the infection. They are not told the identity of the patient who may have exposed them.”
The State of New York, however, does not require this level of confidentiality in its laws regarding quarantine, notification of infection, and contact tracing related to most communicable diseases. While the precise regulations governing the use of contact tracing to fight the spread of HIV require the consent of the patient, the regulations applying to COVID-19 do not have similar requirements.[4] Nor is such information regarded as protected health information (“PHI”) under HIPAA.
I am highlighting these considerations not to denigrate contact tracing, which has been documented as effective in combating pandemics. However, as of this writing, as reported by The New York Times, many in authority, or with credibility in the arenas of privacy and data security, have expressed serious concerns regarding the procurement and arrangement of the software and personnel that will be used in this massive public health initiative.
Caution about privacy, even during times of emergency, is a good thing.
With all that, the collaborative, community health-focused approach I outlined on March 19, 2020, in [2020 Pandemic Date Specific] Contact tracing and privacy in libraries is one I continue to endorse.
In addition to that approach, here is a suggested reply in the event your library is contacted by a state-employed contact tracer, designed to work with your standard protocol for complying with 4509:
[After verifying credentials]
We know your work is critical to public health. Please send us a written list of what you need, and we will work to obtain consent from our users, as required by CPLR 4509. In the alternative, please ensure what you need is very thoroughly set forth in a duly issued subpoena or judicial order. Our library will work to expedite your request as soon as we know we are authorized to do so.
One final point
After conducting the research set forth in this answer, it is my opinion that CPLR 4509’s assurance of the confidentiality of library records is not at odds with the current emergency measures our state is taking to protect lives and get our world back on track.
First, it is critical to remember that under 4509, a person may give their written consent to disclosure. Many people, upon learning they might pose a danger, will give their express and voluntary consent, if they have the capacity at the time. That is their right, and there is no concern with your library contacting them to ask the question.
Second, if the need for confidential library records is truly critical, local board of health officials—and the tracers who will be helping their localities—can invoke the authority created by the public health law[5] to obtain duly authorized subpoenas.
Unlike many other laws and regulations, CPLR 4509 can remain as written, while New York undertakes an unprecedented, massive effort to conduct contact tracing, and protect public health.
Thank you for an important question.
[1] Found on May 28, 2020 at https://www.cdc.gov/coronavirus/2019-ncov/php/principles-contact-tracing.html.
[2] Since reporting new or unusual communicable diseases is also required, cases were probably also reported before March 7.
[3] These metrics are laid out in a graph found at https://www.governor.ny.gov/programs/new-york-forward.
[4] That section is 10 NYCRR 2.10, which states: “It shall be the duty of every physician to report to the city, county or district health officer, within whose jurisdiction such patient resides, the full name, age and address of every person with a suspected or confirmed case of a communicable disease, any outbreak of communicable disease, any unusual disease or unusual disease outbreak and as otherwise authorized in section 2.1 of this Part, together with the name of the disease if known, and any additional information requested by the health officer in the course of an investigation pursuant to this Part, within 24 hours from the time the case is first seen by him, and such report shall be by telephone, facsimile transmission or other electronic communication if indicated, and shall also be made in writing, except that the written notice may be omitted with the approval of the State Commissioner of Health.”
[5] New York Public Health Law, Section 309.
Tag:
Contact tracing, COVID-19, CPLR 4509, Emergency Response, Privacy
