Part A and Part B grantees are funded in significant part by formula-based grants that use disease data from the CDC to determine how funds will be allocated. Those data were based on reported AIDS cases because nationwide HIV data were not available, although the Ryan White Program served people living with HIV from the beginning. The funding formulas have evolved with each reauthorization of the Ryan White HIV/AIDS Program in an effort to more accurately reflect the disease burden and now include HIV cases, a result of more and more States adopting name-based HIV reporting. As of 2008, all States had confidential name-based HIV reporting, although most States still offer the option of anonymous testing. By Fiscal Year (FY) 2013, all Ryan White HIV/AIDS Program formula funding will be based on living cases of HIV/AIDS.13
As early as 1991, HRSA wanted to collect client-level data to determine exactly how many people were being served and what services each person was receiving, but confidentiality concerns also affected how it was able to collect those data. A client-level data collection system does not require reporting names, only a unique identifier assigned to each client by the service provider. According to McCarthy, there was too much opposition from grantees to implement the system: “Nobody trusted us in terms of being the Federal Government and concerns about what we would do with the data. People were absolutely convinced that if there was client-level data that we would be able to identify people because they did not think a unique identifier would protect people.”
As a result of these limitations, for most of the duration of the Ryan White HIV/AIDS Program, HRSA has been able to collect only duplicated data, meaning that one person might be counted several times in service data if he or she was seen at more than one agency. The duplicated data limited the agency’s ability to determine and report on the Program’s full impact because it could not determine exactly how many people were served or how they used the full range of Ryan White services within a community.
A finger-prick HIV test being administered.
Confidentiality concerns also had a profound impact on how services were delivered at the community level. Clinics avoided using the word “AIDS” in their name, because many people feared being seen walking into a clinic that obviously served PLWHA. Denver General Hospital, for instance, had an AIDS clinic that was called an “oncology clinic.”14 It was not (and still is not) unusual for PLWHA to travel long distances to go to clinics outside their neighborhoods.
At other times, agencies with clients’ best interests at heart created opportunities for unintended disclosures of HIV status. McCarthy recalls one local health department that took appropriate pride in its home visits program, which brought services directly to clients; the department initially failed to recognize the impact of using health department vehicles with the word “AIDS” on the side. In a similar anecdote, McCarthy remembers going to a low-incidence State and seeing the list of clients on the AIDS Drug Assistance Program written on a piece of paper and hanging on the side of the case manager’s file cabinet. She also recalls AIDS directors who knew every person in the State getting care.
Such anecdotes point to the critical role that individual providers and information holders have in preserving HIV confidentiality. The HIV/AIDS Bureau (HAB) has provided its funded agencies with guidance and assistance in this area. The personal health information held by many Ryan White grantees has long been covered by a diversity of State confidentiality laws and, in many cases, is now covered by the privacy protections of the Health Insurance Portability and Accountability Act of 1996 (HIPAA; Public Law 104–191). In 2004, HAB produced a resource guide on HIPAA, Protecting Health Information Privacy and Complying With Federal Regulations (PDF – 457 KB), for HIV service providers and HAB staff.15
Implementing and Evolving Confidentiality Protections
In the 2006 reauthorization of the Ryan White HIV/AIDS Program, Congress included several provisions to encourage and require grantee submission of client-level data, including funding for the development of a new data system to support the submission of client-level data across the Program. At the same time, Congress included language requiring that “any information submitted to, or collected by, the Secretary [of the U.S. Department of Health and Human Services] under this title excludes any personally identifiable information.”