Minnesota Department of Health (MDH) Bug Bytes

November 19, 2002
Vol. 3: No. 14

Topics in this Issue:
1. Varicella Outbreak
2. Meningococcal Disease in Siblings
3. Calicivirus and Contact Sports
4. Plague Happens
5. HIPAA and Disease Reporting

1. Varicella Outbreak
Two weeks ago, a Crow Wing County physician reported an increase of varicella in students at a local elementary school. Of 16 students whose parents had contacted the reporting physician, all but two children had been vaccinated with the varicella vaccine; however, parents of vaccinated children may be more inclined to contact their provider if their child develops varicella. To date, 43 cases have been reported in students in all grades at the school, which enrolls 314 students.

Parents of all students in the school have been notified of the outbreak. We recommended varicella vaccination for students who have not had varicella vaccine or disease. Students and staff who are immune compromised or pregnant were notified directly by the school nurse of their potential exposure and recommended to contact their health care provider to consider VZIG if they may be susceptible to varicella and had significant, face-to-face exposure. We plan to conduct a follow-up study at the conclusion of the outbreak to evaluate vaccine efficacy and the severity of disease in vaccinated and non-vaccinated children.

2. Meningococcal Disease in Siblings
On October 29, a 2-month-old child was brought into a clinic with a history of fever, vomiting, and irritability. She rapidly developed an extensive petechial rash, respiratory distress, and had a cardiac arrest in the clinic. Resuscitation efforts were unsuccessful. Since the clinical picture was consistent with meningococcemia and no laboratory results were expected for at least two days, household and other close contacts were treated with antibiotic chemoprophylaxis (rifampin; 10 mg/kg [maximum 600 mg] orally BID for 2 days). Waterhouse-Friderichsen syndrome was noted on autopsy and Neisseria meningitidis grew out of autopsy tissue cultures several days later.

On November 1, the child's 6-year-old sibling became febrile and lethargic and was admitted to the hospital; N. meningitidis was isolated from blood culture. Her close contacts were given prophylaxis including the household contacts that had received prophylaxis for contact with the 2-month-old sibling. We recommended to use ciprofloxacin or ceftriaxone rather than rifampin since the 6-year-old had received rifampin prior to becoming ill and we were concerned that the bacteria could be rifampin resistant.

The isolates from both cases were serogroup C with identical PFGE patterns. The first case's isolate was sensitive to rifampin and the second had a high level of resistance. While rare, there are a few reports in the literature of a close contact of a case with rifampin-sensitive meningococci becoming ill with rifampin-resistant meningococcal disease following prophylaxis with rifampin. Since antimicrobial susceptibilities have routinely been done on meningococcal isolates at MDH since 1993, only one rifampin-resistant meningococcal isolate was noted prior to this in a 5-month-old child with serogroup B disease and with no evidence of contact with another case.

3. Calicivirus and Contact Sports
As noted in the local sports pages, last week we along with the Hennepin County Community Health Department investigated an outbreak of vomiting and diarrhea among at least 7 players and staff of a local professional football team. Two players/staff were hospitalized briefly for rehydration. Based on clinical and epidemiologic evidence, the causative agent would appear to be a Norwalk-like virus (i.e. calicivirus) being spread person-to person. Stool samples were collected for analysis and our investigation is ongoing. The outbreak did not seem to affect their on-field performance on Sunday (Go Purple Pride).

4. Plague Happens
Naturally occurring cases of plague can pop up anywhere. Two cases of travel-associated bubonic plague in New York City were recently reported. The NYC Department of Health and Mental Hygiene presumptively diagnosed bubonic plague in a 53-year-old male resident of New Mexico who was visiting New York City. In addition, the patient's 47-year-old wife had symptoms consistent with bubonic plague.

Both patients reside in Santa Fe County, New Mexico, an area known to be an enzootic focus for plague. The source of these patients' infections is suspected to be rodents and rodent fleas near their home, as a woodrat that was found in the patients' back yard this past July tested positive for plague. Fleas taken from this woodrat also tested positive for plague.

This couple traveled to New York City on November 1 and both developed a flu-like illness on November 3. As symptoms continued to worsen, they were admitted to a hospital on November 5 and on examination both had fever and swollen, tender inguinal lymph nodes ("buboes"). A blood culture on the male patient tested positive at the NYC Public Health Laboratory for Yersinia pestis by both PCR and direct fluorescent antibody testing. Both patients were treated with aminoglycosides and doxycycline (the recommended drug class/ drug for treatment). The 53-year-old male, who is also diabetic, was in critical condition with a secondary septicemia and multi-system failure; the 47-year-old female was stable at the time of the report from NYC.

As neither patient had symptoms or radiographic evidence of pneumonia, antibiotic prophylaxis has not been recommended for any hospital or social contacts. Laboratory staff handling specimens from these patients have been instructed to follow Biosafety Level 2 precautions.

Most human plague cases are due to bites from plague-infected fleas around the home. The usual incubation period for plague is between 2 to 7 days. Naturally occurring plague primarily affects rodents, and transmission between rodents is via infected fleas. In the U.S., bubonic plague is transmitted to humans through the bites of infected fleas; bubonic plague is not transmitted person-to-person. Pneumonic plague is transmitted after plague bacilli are inhaled following direct contact with infected animals, including rodents, wildlife and pets (cats and dogs) or via droplet transmission from a patient with pneumonic plague. Bubonic plague symptoms in humans include fever; painful swollen lymph nodes in the groin, armpit or neck areas; chills; and headache, vomiting, and diarrhea. Patients may develop secondary septicemic plague or pneumonic plague; pneumonic plague can be spread person-to-person. With prompt diagnosis and appropriate antibiotic treatment and supportive care, most patients with bubonic plague survive; delaying treatment >24 hors after symptom onset leads to a high fatality rate.

Human plague has been reported most often from Arizona, California, Colorado and New Mexico. Wild rodents, especially ground squirrels and prairie dogs, are the natural reservoir for Y. pestis. Since January 1980, there have been 272 cases of plague reported in the U.S.; the overwhelming majority of cases were bubonic plague. Of these, 143 (53%) were acquired in New Mexico.

5. HIPAA and Disease Reporting
The U.S. Congress enacted the Health Insurance Portability and Accountability Act (HIPAA) in 1996. In addition to health insurance portability, the act covered electronic billing and payment transactions and the privacy and security of health information. Congress also gave the U.S. Department of Health and Human Services (DHHS) authority to adopt rules to implement HIPAA. We have been receiving questions regarding whether HIPAA rules allow for infectious disease reporting.

HIPAA not intended to affect public health reporting. Section 1178(b) of HIPAA explicitly carves out protection for state public health laws. This provision states: "…nothing in this part shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth or death, public health surveillance, or public health investigation or intervention."

DHHS adopted HIPAA privacy rules in December 2000 and amended them in August 2002. HIPAA covered entities (health care providers, health plans, health care clearinghouses) must comply with the HIPAA privacy rules as of April 14, 2003. The HIPAA privacy rules are found at 45 Code of Federal Regulations (CFR), sections 160 and 164. Although the HIPAA privacy rules generally preempt state law, they make certain exceptions. One such exception is when state law or rules provide "for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention." (45 CFR 160.203). This is consistent with the Congressional directive that HIPAA not affect public health reporting.

In general, HIPAA privacy rules require covered entities to get patient authorization before disclosing health information (45 CFR164.508; under Minnesota law, we use the term 'consent.') The HIPAA privacy rules provide that for certain disclosures, no authorization is required. Among them:

  • Required by law- Under 45 CFR 164.512 (a)(1), "a covered entity may use … protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law." Note that per the definition section of 45 CFR 164.501, "required by law means a mandate contained in law that compels an entity to make a … disclosure of protected health information and that … includes … statutes or regulations that require the production of information ..."
  • For public health activities- Under 45 CFR 164.512 (b)(1)(i), "Permitted disclosures. A covered entity may disclose protected health information … to … a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions."

The HIPAA privacy rules have a minimum necessary standard in 45 CFR 164.502 (b) that states: "When … disclosing protected health information …, a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request." Note, however, under 45 CFR 164.502 (b)(2)(v), that "this requirement does not apply to … uses or disclosures that are required by law, as described by section 164.512(a)…." Further, for public health reporting authorized by law, a covered entity may rely on MDH's request to be the minimum necessary, per 45 CFR 164.514(d)(3)(iii)(A), which says that "a covered entity may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose when … making disclosures to public officials that are permitted under § 164.512, if the public official represents that the information requested is the minimum necessary for the stated purpose(s) …."

There are a number of Minnesota Statutes and Minnesota Rules provisions that require or authorize public health reporting by covered entities. These public health reporting provisions should not be affected by the HIPAA privacy rules. Some of these include Minnesota Rules, chapter 4605, which set out requirements for covered entities to report on communicable diseases to MDH; and, Minnesota Statutes, section 144.05, which authorize the Commissioner of Health to "conduct studies and investigations, collect and analyze health and vital data, and identify and describe health problems." So, in summary, HIPAA privacy rules allow doctors, hospitals, HMOs, health insurers, and other covered entities to report public health information to MDH as in the past, without patient authorization. 45 CFR 164.512 (a)&(b) allows covered entities to continue to report communicable disease information without patient authorization as required by Minnesota Rules. These provisions of the HIPAA privacy rules provisions allow other public health reporting as well.

For a link to an unofficial compiled version of the HIPAA privacy rules that incorporates the rules as adopted, along with the amendments, go to: http://www.hhs.gov/ocr/hipaa/finalreg.html.

(Thanks to Dave Orren, MDH Data Practices Coordinator and HIPAA Privacy Official, for writing this article).


Bug Bytes is a combined effort of the Infectious Disease Epidemiology, Prevention and Control Division and the Public Health Laboratory Division of MDH. We provide Bug Bytes as a way to say THANK YOU to the infection control professionals, laboratorians, local public health professionals, and health care providers who assist us.

For concerns or questions regarding content, please use our Bug Bytes Feedback Form.

You can also subscribe to the MDH Bug Bytes newsletter.



Updated Friday, November 19, 2010 at 02:16PM