DHS-CDC deal to share travelers' data draws fire

Apr 27, 2006 (CIDRAP News) – An agreement between US security and health agencies to share more data about travelers in order to keep infectious diseases out of the country has drawn criticism.

The memorandum of understanding, signed in October 2005, provides for increased cooperation between the Department of Health and Human Services (HHS) and the Department of Homeland Security (DHS). The document was posted Apr 25 on the Web site of the American Civil Liberties Union (ACLU), which has spoken out against the agreement, as has at least one noted infectious disease expert.

Under the agreement, more DHS data would be shared with the Centers for Disease Control and Prevention (CDC), an HHS agency.

The CDC already had access to paper customs declarations forms, said Ram Koppaka, MD, PhD, chief of the Quarantine and Border Health Services branch in the CDC Division of Global Migration and Quarantine. The agreement formalizes an existing practice of sharing DHS' customs declarations, and it expands the information sharing to include two other kinds of information: Advance Passenger Information System (APIS) data and Passenger Name Record (PNR) data. DHS would provide the data to CDC only in response to a request and in compliance with existing agreements with other entities, such as the European Union, the agreement states.

The DHS agencies involved in the information-sharing agreement are Customs and Border Patrol (CBP), the Coast Guard, and Immigration and Customs Enforcement (ICE), according to the memorandum. Diseases currently classified as "quarantinable" are cholera, diphtheria, infectious tuberculosis, plague, smallpox, yellow fever, viral hemorrhagic fevers, severe acute respiratory syndrome (SARS), and novel or re-emerging influenza strains with pandemic potential.

The CDC may in turn disclose necessary information to state and local health departments, the agreement says. The memorandum also calls for DHS to assist with passive and active surveillance of travelers if there are outbreaks of quarantinable diseases or other serious communicable diseases. In particular, the document says the CDC will give DHS a list of signs of H5N1 avian influenza so personnel can watch for them in passengers.

The pact also calls for CBP and other DHS agencies to detain travelers at the behest of the CDC because of possible infection with a quarantinable disease. The pact notes that the CDC has legal authority to detain, isolate, or quarantine travelers in such situations, and that CBP, ICE, and the Coast Guard have legal authority to assist such steps.

The agreement allows the CDC to carry out what Koppaka called "very fundamental public health activities" of contact investigation, quarantine, and isolation. Contact investigation is used more frequently, although quarantine and isolation issues have generated media attention.

"The current mumps outbreak is a great illustration of how inability to efficiently identify and notify those who have been exposed is hampering our ability to mount an effective response," Koppaka told CIDRAP News. He was referring to an ongoing outbreak involving more than 1,100 people, most of them in Iowa. Two potentially infectious people traveled on nine different commercial airline flights in the course of the outbreak.

Koppaka also said the SARS outbreak of 2003 showed the need for better data on travelers. In regard to tracking down potentially exposed passengers on multiple planes, he said, "We were not able, not even in a single case, to ensure a person was notified within the 10- to 14-day incubation period for SARS. We feel that is a critical gap in our ability to respond."

The agreement follows a parallel track to another CDC initiative, which would require airlines and ship operators to report passengers who have certain signs of illness and to keep lists of passengers for at least 60 days after arrival. The 3-month comment period on those proposed rules ended Mar 1, and CDC is reviewing comments, Koppaka said.

The ACLU has charged that the agreement between DHS and HHS threatens Americans' privacy rights and violates a US agreement with the European Union.

The pact "is continuing evidence that the American government, and especially its security establishment, does not take privacy and data protection seriously," said Barry Steinhardt, ACLU Technology and Liberty Project director, in an Apr 25 news release."

Steinhardt said the European Union agreed in 2003 to share PNR data with the United States in return for a DHS pledge not to use the data for anything other than to prevent terrorism or other serious crimes. "It is now clear that DHS did not abide by that agreement," he charged.

But Koppaka, referring to the ACLU, said, "I'm not sure they're aware that DHS closely reviewed this agreement to make sure it complies with their agreement with the EU. HHS's understanding is that DHS did the analysis and signed off after determining it was compliant."

The ACLU learned of the DHS-HHS agreement in comments by the Air Transport Association on the CDC's proposed requirement that airlines report sick passengers, according to an Apr 21 ACLU release. On Apr 20 the organization filed a Freedom of Information Act (FOIA) request with the federal government for a copy of the agreement and related information, according to the release. By Apr 25 the group had obtained and posted a copy of the agreement on its Web site.

The ACLU labeled the pact a "secret agreement" and said it embodies policies that should have been debated in public.

But HHS spokeswoman Christina Pearson denied that the agreement was secret, according to an Apr 21 Reuters report. "We have had this agreement in place and it's to help CDC when there is a report of communicable diseases on an airplane," she said. The agreement will help the agency locate passengers who may have been exposed and give them information, she added.

Another critic of the agreement, according to an Apr 21 Reuters report, was Donald A. Henderson, MD, MPH, an infectious disease physician and distinguished scholar at the Baltimore-based Center for Biosecurity of the University of Pittsburgh Medical Center.

Referring to the provision calling for CBP to detain travelers on behalf of the CDC, Henderson told Reuters, "I was absolutely astonished when I saw that proposed federal regulation. It's so silly."

Henderson questioned whether there is any evidence that such a system would effectively prevent diseases from spreading, and told Reuters that people can spread influenza and other diseases before they have symptoms.

Koppaka emphasized that influenza is not the only disease for which this information sharing might be useful and that the information wouldn't just be used for quarantine and isolation but also for contact tracing and outbreak investigations.

See also

Copy of the agreement as posted on the ACLU web site
http://www.aclu.org/pdfs/privacy/hhs_dhs_mou.pdf

Apr 25 ACLU news release
http://www.aclu.org/privacy/spying/25335prs20060425.html

Apr 21 ACLU news release
http://www.aclu.org/privacy/spying/25246prs20060421.html

Nov 22, 2005, CIDRAP News story on CDC updating rules affecting travelers
http://www.cidrap.umn.edu/cidrap/content/influenza/panflu/news/nov2205travelers.html

Apr 19 CIDRAP News story on mumps outbreak
http://www.cidrap.umn.edu/cidrap/content/other/news/april1906mumps.html

This week's top reads