Attorney General's Opinion
Attorney General, Richard Blumenthal
April 25, 2008
Department of Public Health
Your department has requested an opinion from this office regarding the following questions:
1. What is the authority of the Commissioner of the Department of Public Health to obtain customer identifying information and related product information from a retail food establishment in order to investigate or control a foodborne illness outbreak?
2. Is the consent of the customer required in order for the Department to obtain said information?
3. What is the Department’s ability to delegate this authority to local health authorities?
4. Does the Department have the ability to obtain a court order or subpoena for customer identifying information from retail food establishments.
It is the opinion of this office that the Department has the authority to obtain, without customer consent, customer identifying information from retail food establishments in connection with a foodborne illness outbreak. Although the Department does not have subpoena power, it may seek a court order compelling production of such information. The Department need not delegate this power to local health authorities because Department regulations already provide local health authorities this power.
When a local director of health or his authorized agent or the Department of Public Health receives a report of a disease or laboratory finding on the commissioner’s list of reportable disease and laboratory findings, either may contact first the reporting health care provider and then the person with the reportable finding to obtain such information as may be necessary to lead to the effective control of further spread of such disease.
Foodborne outbreaks are included in the list of reportable diseases and are defined by RCSA § 19a-36-A1 as follows:
“Foodborne outbreaks” means illness in two or more individuals acquired through the ingestion of common-source food or water contaminated with chemicals, infectious agents or their toxic products. Foodborne outbreaks include, but are not limited to, illness due to heavy metal intoxications, staphylococcal food poisoning, botulism, salmonellosis, shigellosis, Clostridium perfringens intoxication and hepatitis A.
The statutes and regulations give the Department broad power to gather data necessary to protect the public health. Our Supreme Court has noted that “the legislature has vested the commissioner of public health with expansive powers with respect to enacting and enforcing public health law…” Stepney, LLC v. Town of
The Department's regulations delineate the authority of the Department to investigate and control reportable diseases and outbreaks. RCSA §19a-36-A6 provides, in pertinent part, that:
The department, in cooperation with the local director of health, in the investigation and control of reportable disease shall make or cause to be made such investigation as it deems necessary and shall secure all such data as may assist it in establishing adequate control measures.
According to this regulation, the Department shall secure “all such data” as may assist it in controlling a foodborne illness outbreak. “Where the legislature uses a broad term…in an administrative context, without attempting to define that term, it evinces a legislative judgment that the agency should define the parameters of that term on a case-by-case basis. The foregoing applies to regulations which have the force and effect of law. Validly enacted regulations of an administrative agency carry the force of statutory law.” (Citations omitted; quotation marks omitted.) Kiniry v. State Dep’t of Public Health, Superior Court, judicial district of Middlesex at Middletown, Docket No. 980085189 (Hartmere, J.) (
Further, Conn. Gen. Stat. § 19a-2a(8) provides that the Commissioner of the Department of Public Health shall have the power and duty to “…secure information and data concerning the prevention and control of epidemics and conditions affecting or endangering the public health and compile such information and statistics and shall disseminate among health authorities and the people of the state such information as may be of value to them.” This broad grant of authority supports the Department's legal right to access customer identifying information from a commercial food establishment in the event of a foodborne illness outbreak if the information would assist the Department in controlling the outbreak and preventing further illness.
We conclude, therefore, that the Department has the authority to secure all data that may assist it in establishing adequate control measures in connection with a foodborne illness outbreak. Therefore, the Department would be entitled to customer identifying records from a retail food establishment in connection with an investigation into such an outbreak.
Responding to the second question presented, the Department has a broad grant of authority to access information relating to an investigation of reportable diseases and outbreaks without receiving the consent of individuals who may be affected by a reportable disease or outbreak. RCSA § 19a-36-A6 specifically allows access to “individual medical information pertaining to cases of reportable disease, persons affected by outbreaks of disease or significant increases in the rate of nonsocomial infection…” The regulation further mandates that this information “shall be provided when requested to an investigator who presents official identification of the department or the local health department.” The regulation does not require the Department to first receive consent from those individuals about whom the Department is obtaining information. Because the customers of a commercial food establishment may be "persons affected by" the outbreak of a foodborne illness, customer identifying data from a commercial food establishment is available to the Department without customer consent in controlling a foodborne illness outbreak.
Given the broad scope of the Department's authority to access private information in connection with the outbreak of a disease or illness, in the event of a foodborne illness outbreak the Department need not obtain customer consent to gain access to customer identifying information from a retail food establishment. However, the Department is under an obligation to keep such information confidential pursuant to
In responding to the third question presented, the Department need not separately delegate its authority to access customer identifying information from a retail food establishment to the local health director because Department regulations already provide the local health director such authority. The relevant regulations refer to both the Department and the local health authority. Specifically, RCSA §19a-36-A6 states that “[t]he department, in cooperation with the local director of health,…shall secure all such data as may assist it in establishing adequate control measures.” Similarly, under RCSA § 19a-36-A8, the local director of health is specifically entitled to “secure all such data as may assist the local director of health in establishing adequate control measures” in connection with an investigation.
Therefore, there is no need for the Department to separately delegate any authority to the local health authority to gain access to customer identifying information from a retail food establishment because the local health director is granted this authority under RCSA § 19a-36-A8. The local health director is similarly obligated to keep such information confidential.
In response to your fourth question, the Department does not have the statutory authority to subpoena customer identifying information, but may seek a court order to obtain that information.1 Pursuant to
We trust the foregoing answers your concerns.
Very truly yours,
1 The Uniform Food Drug and Cosmetic Act,