EEIP RIDRM Regulations

Reportable Diseases Listing

Connecticut General Statutes (CGS) §19a-2A(9), and §19a-36-A2 of the Connecticut Public Health Code (CPHC) mandate the Commissioner of the DPH to annually issue a list of reportable diseases, emergency illnesses and health conditions and a list of reportable laboratory findings. The Commissioner shall also prepare printed forms that include instructions to report and return. An advisory committee of public health officials, clinicians, and laboratorians contribute to the process.

 

Mandated Reporting

CGS §19a-215b, and §19a-36-A3 of the CPHC require that health care providers, including administrators of health care facilities, report the diseases listed in the List of Reportable Diseases, Emergency Illnesses, and Health Conditions. These reports are confidential (pursuant to CGS §19a-25 and §19a-215d,e). As indicated in §19a-36-A4 of the CPHC, diseases fall into two categories:

Category 1: These diseases must be reported immediately by telephone on the day of recognition or strong suspicion, due to the need for timely public health action. On weekdays, contact the DPH Epidemiology and Emerging Infections Program (EEIP) at 860-509-7994, and the LHD of the patient’s town of residence. On evenings, weekends, and holidays, contact the DPH’s afterhours and emergency number at 860-509-8000. A Reportable Disease Confidential Case Report Form (PD-23) or a disease specific report form must be completed and mailed to both the DPH and LHD within 12 hours. Forms are found on the DPH "Forms" page.

Category 2: These diseases must be reportable by mail within 12 hours of recognition or strong suspicion to both the DPH and LHD.

Section 19a-36-A3 of the CPHC requires that directors of clinical laboratories must report to the DPH and LHD any laboratory evidence suggestive of diseases on the Reportable Laboratory Finding list. A completed Reportable Laboratory Findings Form OL-15C must be mailed to both the DPH and LHD of the patient’s town of residence. Laboratories participating in Electronic Laboratory Reporting (ELR) do not need to submit OL-15C forms.

 

Authority to Conduct Case Follow-up

CGS §19a-215d grants authority to the DPH and the LHD director or his/her authorized personnel to contact the reporting physician and the person with a reportable condition for the purposes of disease control. All information collected, as part of this follow-up investigation, is considered confidential, pursuant to §19a-25.

 

 

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Background

The privacy provisions of the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), apply to health information created or maintain by health care providers who engage in certain electronic transactions, health plans, and health care clearinghouses. The federal Department of Health and Human Services (HSS) issues the “Standards for Privacy of Individually Identifiable Health Information”, applicable to entities covered by HIPAA. The intent of HIPAA, was to establish national standards for consumer privacy protection and insurance market reform. There has been some confusion about the intent and implementation of the rules. This has resulted in health care providers refusing public health officials access to patient records, and is having unintended consequences on some of the core functions of public health.

 

Connecticut General Statutes

Hospitals and providers must be compliant with HIPAA requirements. Due to the importance of protecting the public’s health, state and LHDs are authorized by law to collect personal information as part of such activities. However, because of HIPAA, hospitals and providers may question our ability to collect this information. The following statement, developed by DPH attorneys, can be used to answer questions from hospital staff or health care providers about the ability of the DPH or LHDs to collect personal information on their patients with reportable diseases without their consent.

“Pursuant to Connecticut General Statues §19a-2a and §19a-215 and the Regulations of Connecticut State Agencies §19a-36-A3-4, the requested information is required to the Department of Public Health.”

Please note that the Connecticut General Statutes §52-146(o) (1) authorizes the release of these records to the Department without the patient’s consent. Additionally, HIPAA also authorizes you to release this information without an authorization, consent, release, opportunity to object by the patient, as information (i) required by law to be disclosed [HIPAA Privacy regulation 45 CFR §164, 512 (a)] and (ii) as part of the Department’s public health activities (HIPAA Privacy regulation §164.512(b)). The requested information is what is minimally necessary to achieve the purpose of the disclosure, and you may rely upon this representation in releasing the requested information, pursuant to 45 CFR §64.514(d)(3)(iii)(A) of the HIPAA Privacy regulations.

 

Confidentiality

The information that public health officials collect as part of disease follow-up pursuant to CSG §19a-215, may contain personally identifiable information (PII). PII is any health information that makes the individual or organization supplying it identifiable. Pursuant to CGS §19a-25, PII “shall be confidential and shall be used solely for the purposes of”:

Both state and local public health officials are required to make every effort to limit the disclosure of PII to the minimal amount necessary to accomplish the public health purpose. Administrative and support staff, interns, and local board of health members who may be aware of person information on a case should be familiar with maintaining confidentiality.

We encourage all LHDs to have a written confidentiality policy on file, and a standard confidentiality agreement form for all LDH staff involved in infectious disease follow-up and control to read and sign. This includes directors, epidemiologists, clerical staff who open mail, and information technology (IT) staff with system administrator privileges. Please review the example of the confidentiality pledge DPH uses.

DPH also encourages LHDs to utilize a confidential fax machine for infectious disease reporting, investigation, and control. This machine should be located in a secured area where disease control staff work, and should not be accessible to the general public.

 

Important Points Regarding Confidentiality   The information that public health officials collect as part of disease follow-up contains personally identifiable information (PII). Limit the disclosure of PII to the minimal amount necessary to accomplish the public health purpose. Confidential information can be released only to those who “need to know” to accomplish the public health purpose. Those to whom it is released must maintain confidentiality. Clearly mark envelopes with “CONFIDENTIAL”, when mailing reports. If reporting by fax, be certain that the receiving number is a confidential fax.

All confidential disease records should be stored in a locked file cabinet and, when possible, a room that can be locked. All computers used to enter confidential disease information into must be password to ensure confidentiality.

 

This page last updated 6/12/2023.

Back to RIDRM