Vermont Healthcare-Associated Infection Reports: Privacy Laws Checklist

Vermont healthcare-associated infection reporting involves more than one system. Patient safety reports, hospital-level infection measures, and reportable disease case information follow different rules, so your team should identify the purpose and recipient before sharing data.

Which Vermont patient safety reports are confidential and privileged?

Under Vermont’s patient safety statute, information made available to the Department of Health through the Patient Safety Surveillance and Improvement System (PSSIS) is confidential and privileged, exempt from public-records access, and generally protected from subpoena, discovery, or use as evidence in qualifying civil or administrative actions against a healthcare provider. The protection applies to information submitted under the patient safety chapter, including reports and related review materials—not automatically to every record about the same event.

There are statutory exceptions. For example, information may be shared as needed to meet reporting duties or, in certain circumstances, for enforcement involving a hospital’s deliberate or repeated noncompliance. A hospital may also report in good faith using information from original sources; a document does not become immune from discovery merely because it was also provided to PSSIS. Review 18 V.S.A. § 1917 for the scope and limits of the Vermont patient safety statute privilege.

Vermont hospitals report qualifying serious reportable events and intentional unsafe acts through the patient safety system. A healthcare-associated infection is not automatically a PSSIS report simply because it occurred in a hospital; teams should assess whether the event meets the applicable patient safety reporting criteria as well as any separate infection-reporting requirements. See the Vermont Department of Health’s patient safety program overview and 18 V.S.A. § 1915.

What healthcare-associated infection data must Vermont hospitals report?

Keep patient safety reporting distinct from healthcare-associated infection (HAI) surveillance and public hospital quality reporting. Vermont’s hospital report cards publish facility-level measures that include central line-associated bloodstream infections (CLABSI), catheter-associated urinary tract infections (CAUTI), selected surgical site infections (SSI), MRSA bacteremia, and Clostridioides difficile infections. The state lists hip- and knee-surgery SSIs separately, with reporting periods that may differ from other measures.

Many HAI measures are collected through the CDC’s National Healthcare Safety Network (NHSN). Which data a particular hospital must submit, and when, depends on the applicable reporting program and measure specifications; the public report card should not be treated as a complete list of every facility’s legal reporting duties. Vermont publishes reporting periods and updates for its measures on the hospital report cards page.

The Standardized Infection Ratio (SIR) compares observed infections with the number predicted using a reference population and risk-adjustment methods. It can help you interpret trends and compare performance, but it is not a count of identifiable patients or, by itself, proof of why an infection occurred. The CDC’s NHSN HAI progress report explains the SIR and its use in NHSN reporting.

How do public hospital infection reports protect patient privacy?

Public hospital reports present infection data at the facility or summary level rather than publishing a patient’s name or medical record. Vermont’s report card provides hospital-level measures, while the state’s public patient safety annual report groups event categories with fewer than six reports to protect confidentiality. Vermont’s infectious-disease data explorer also notes that very small case counts may be withheld from display.

Aggregation and small-number protections reduce the risk that a reader could infer an individual’s identity from a rare event or a small count. They do not change the confidentiality rules for case-level information held by hospitals or public-health agencies. For examples of these public reporting practices, see the 2024 PSSIS annual report and Vermont’s reportable disease data page.

When may covered entities disclose protected health information under HIPAA?

The HIPAA Privacy Rule permits a covered entity to disclose protected health information (PHI), without an individual’s authorization, to a public-health authority legally authorized to receive it for activities such as disease reporting, surveillance, investigation, or intervention. Vermont’s Department of Health is a public-health authority for these purposes. Whether a disclosure is required or merely permitted depends on the applicable law and the request.

For a public-health disclosure that is not required by law, the covered entity generally must reasonably limit the PHI to the minimum necessary for the purpose. HIPAA does not require a minimum-necessary determination for disclosures made under an individual’s authorization or disclosures required by law. A covered entity may reasonably rely on a public-health authority’s determination of the minimum information needed for its request. Read the HHS guidance on HIPAA disclosures for public-health activities.

HIPAA also allows certain disclosures to people who may be at risk of contracting or spreading a disease when other law authorizes the notification. That is not a general permission to disclose a patient’s identity to anyone who asks. Confirm the legal authority, recipient, purpose, and applicable Vermont confidentiality protections before sending PHI.

Which communicable diseases and laboratory findings must be reported?

Vermont’s Reportable and Communicable Diseases Rule, effective June 10, 2026, lists diseases, syndromes, and laboratory findings that required reporters must report. Examples relevant to healthcare settings include Candida auris, carbapenem-resistant organisms such as CRE, CRAB, and CRPA, legionellosis, measles, and meningococcal disease. The rule also covers specific laboratory results, including susceptibility and resistance-mechanism findings for certain resistant organisms.

Reporting deadlines vary. Some conditions and findings require immediate telephone reporting; many others must be reported within 24 hours. As of June 10, 2026, individual COVID-19 cases and test results are no longer reportable under the general requirement, but specified outbreaks remain reportable; certain COVID-related pediatric deaths are also listed. Check the current Vermont Department of Health reporting page and the Reportable and Communicable Diseases Rule rather than relying on an older disease list.

Vermont’s rule identifies required reporters, including infection preventionists, laboratory directors, nurses, physicians, and other specified health professionals. The statute generally requires reports to identify the patient and the patient’s physician, while the rule specifies report elements and reporting procedures. The Department’s table and rule provide the controlling condition-specific requirements.

How should public-health agencies limit identifying information?

Public-health case reports can include identifying details needed for disease control, investigation, or follow-up. Vermont law treats information collected under the reporting statute and information supporting outbreak investigations as privileged and confidential. That protection allows authorized surveillance and epidemiological follow-up while restricting unrelated uses and disclosures.

For HIV and AIDS public-health records containing direct or indirect identifiers, Vermont law sets additional disclosure limits. Certain interagency exchanges for surveillance, comparison of potentially duplicate reports, or epidemiological follow-up may occur without the usual notice and written authorization; the agencies must use the least identifying information first and use a person’s name only as a last resort. See 18 V.S.A. § 1001.

The 2026 reporting rule also requires reporting entities to maintain written confidentiality policies. These must identify who may access confidential reporting information, train affected staff, address electronic records and authorized releases, monitor compliance, and provide for annual policy review. Public releases should use aggregation and small-number protections where needed to avoid exposing identifiable case information.

What privacy and disclosure checks should reporting teams complete?

Before you submit or release information, confirm which reporting pathway applies. A PSSIS event report, an NHSN HAI measure, a Vermont reportable disease case, and a public hospital report may have different recipients, data elements, deadlines, and confidentiality rules.

• Verify the requirement: Identify the law, rule, or reporting program that authorizes or requires the submission, then confirm the current form, deadline, and recipient.
• Separate source records from submitted reports: Track which materials were created or maintained independently and which were submitted to PSSIS; do not assume every original record receives the same privilege.
• Check the data fields: Include required identifiers and clinical details for authorized case reporting, but do not add unrelated PHI to a disclosure.
• Confirm the recipient and purpose: Verify that the recipient is authorized and the disclosure supports the stated public-health, patient-safety, or reporting purpose.
• Apply confidentiality controls: Limit access to authorized staff, use approved secure transmission, and follow written policies for electronic records and release approval.
• Review public outputs: Use facility-level or aggregate data where appropriate, assess small counts for re-identification risk, and follow applicable suppression or aggregation practices.
• Document the decision: Record the authority, recipient, purpose, data disclosed, and any minimum-necessary or confidentiality review.

This checklist helps your team distinguish a lawful public-health surveillance disclosure from a public release of patient-level information. For complex or disputed requests, consult your privacy officer or legal counsel and check the current Vermont statute and agency guidance.

FAQs

Are Vermont patient safety reports available through public-records requests?

Information made available to the Department through Vermont’s Patient Safety Surveillance and Improvement System is exempt from the public access to records law under 18 V.S.A. § 1917. Public summaries may still be issued, with safeguards such as combining categories with fewer than six reports. The exemption is specific to information covered by the statute; separate records held from original sources are not automatically protected just because related information was also submitted to PSSIS.

Can patient safety reports be used as evidence in civil proceedings?

Information submitted to PSSIS is generally not subject to discovery or introduction into evidence in qualifying civil or administrative actions against a healthcare provider arising from the matters reviewed by the Department. However, underlying records available from original sources do not become immune merely because they were shared with PSSIS. See 18 V.S.A. § 1917.

Which healthcare-associated infections do Vermont hospitals report?

Vermont’s public hospital report cards track CLABSI, CAUTI, selected surgical site infections, MRSA bacteremia, and C. difficile infections, including hip- and knee-surgery SSI measures. Specific submission obligations and reporting periods depend on the applicable NHSN, state, and federal measure requirements; check the current Vermont hospital report cards.

When can infectious-disease information be shared without patient consent?

A covered entity may disclose PHI without authorization to a public-health authority legally authorized to receive it for disease prevention, control, surveillance, investigation, or intervention. Vermont law may require reports to include identifying information, while confidential public-health records remain subject to limits on use and disclosure. For voluntary disclosures, apply HIPAA’s minimum-necessary standard; for disclosures required by law, provide the information the law requires and follow applicable Vermont confidentiality safeguards.

In short, Vermont distinguishes confidential case-level reporting from facility-level infection measures: send required information through authorized channels, protect patient identifiers, and use appropriate aggregation for public reporting.