The head of Mobile County’s 911 system is defending a state policy that allows dispatchers to flag home addresses of confirmed COVID-19 patients for police officers, firefighters and paramedics before they respond to a call, saying the practice is meant to protect first responders rather than expose private medical information. Charlie McNichol, executive director of the Mobile County Communications District (MCCD), which runs the county’s 911 dispatch operations, said his office receives a daily list of addresses tied to confirmed COVID-19 cases from the Alabama Department of Public Health. As of early April, Mobile County had 143 confirmed cases of the virus, and the number climbs by the day as testing expands statewide.
How the Flagging System Works
McNichol said the addresses are entered into MCCD’s computer-assisted dispatch system, commonly known as CAD, so that if a 911 call comes in from one of those locations, responding crews are automatically alerted that someone at that address has tested positive. “We flag those in our CAD system so if a call comes into one of the addresses for any first responders — fire, police or medical — we let them know that location is suspected of having a positive case,” McNichol said. “I think we owe that to our first responders. It doesn’t give us anyone’s name or any other personal information about the individual; it just lets us notify them that someone at that address has tested positive for COVID-19 so that they can have their guards up.”
The CAD system, used by 911 centers nationwide, integrates call-taking, dispatching, and resource tracking into a single platform. When a call comes in, the system displays the address, phone number, and any flags or premises history attached to that location. The COVID-19 flag appears as a caution indicator, prompting the dispatcher to relay the information to responding units via radio or mobile data terminal. The flag does not include the patient’s name, age, symptoms, or any other protected health information — only the address and the fact that a positive case has been reported there.
Legal Framework and Privacy Concerns
The policy, which pairs Alabama’s statewide 911 system with the state health department, has drawn scrutiny from privacy advocates who question whether flagging specific homes runs afoul of the Health Insurance Portability and Accountability Act, the federal law that shields patients’ medical information from disclosure. McNichol said MCCD’s attorneys and ADPH’s legal team reviewed the arrangement before it took effect and concluded it falls within an exception that allows health officials to warn those at risk of exposure. The disclosure is limited to address-level data, not individually identifiable health information, and is shared only with responders who have a legitimate need to know.
HIPAA’s “minimum necessary” standard requires that covered entities disclose only the information needed to accomplish the intended purpose. In this case, the purpose is responder safety, and the information disclosed — an address flag — is arguably the minimum necessary to achieve that purpose. The Alabama Department of Public Health, as a covered entity under HIPAA, determined that the public health emergency justified the disclosure under the “serious and imminent threat” exception, which permits sharing protected health information with persons able to prevent or lessen the threat.
First Responder Perspectives
For firefighters, police officers, and paramedics, the flagging system addresses a tangible gap in personal protective equipment (PPE) protocols. In the early weeks of the pandemic, PPE shortages were acute nationwide, and many departments lacked sufficient N95 respirators, gowns, and face shields for every call. Knowing in advance that a call originates from a COVID-19-positive address allows responders to don appropriate PPE before making entry, rather than discovering the risk after they are already inside a residence. Mobile Fire-Rescue Chief Jeremy Howard said the department had adjusted its response protocols to assume potential exposure on all medical calls, but that the address flag provided an additional layer of situational awareness for non-medical calls — welfare checks, disturbance complaints, fire alarms — where responders might not otherwise anticipate a biological hazard.
Mobile Police Department spokesman Christopher Levy said officers had been briefed on the flagging system and instructed to treat the information as operational intelligence, not investigative leads. The flag does not authorize entry, search, or any enforcement action related to the patient’s health status. It simply informs the officer’s approach — maintaining distance when possible, masking, and limiting the number of personnel who enter the residence. The policy explicitly prohibits using the flag data for quarantine enforcement, contact tracing, or any purpose beyond responder safety.
Statewide Implementation and Variation
Alabama’s 911 system operates through a network of local communications districts, each governed by a board appointed by the county commission and municipalities served. The COVID-19 address flagging policy was issued as guidance from the Alabama 911 Board in coordination with ADPH, but implementation details — data retention periods, flag removal criteria, access controls — were left to local districts. MCCD, one of the largest districts in the state, opted for daily list updates and automatic flag expiration after 14 days, consistent with CDC isolation guidance at the time. Smaller districts with less sophisticated CAD systems relied on manual entry and paper-based tracking.
The Alabama 911 Board, created by the Legislature in 1984 to oversee the statewide 911 system, has statutory authority to set technical and operational standards. Its executive director, Leah Missildine, said the board developed the flagging protocol in consultation with the state health officer, the Alabama Fire Chiefs Association, the Alabama Association of Chiefs of Police, and the Alabama Chapter of the American College of Emergency Physicians. The goal was a uniform baseline that could be adapted locally without creating a patchwork of incompatible practices.
Privacy Advocates’ Concerns
Civil liberties organizations, including the ACLU of Alabama and the Electronic Frontier Foundation, have raised concerns about mission creep — the risk that data collected for one emergency purpose becomes normalized and repurposed. They point to the post-9/11 expansion of surveillance authorities as a cautionary tale: powers granted for a specific crisis often persist long after the crisis abates. The COVID-19 address flags, if retained indefinitely or shared beyond 911 centers, could become a de facto registry of households affected by a stigmatized disease, with implications for housing, employment, and social services.
McNichol said MCCD has no intention of retaining the data beyond the public health emergency. The daily lists from ADPH are used to update the CAD flags and then discarded. Flags automatically expire after 14 days unless refreshed by a new positive test at the same address. The system does not create a historical database of COVID-19 addresses, and MCCD has no mechanism to query past flags. ADPH similarly treats the daily list as a transient operational tool, not a permanent record.
Comparisons to Other Jurisdictions
Alabama was not alone in implementing address-level flagging for first responders. Similar policies were adopted in Michigan, Ohio, Tennessee, and parts of Florida and Texas, with variations in data-sharing protocols and retention rules. In Michigan, the state police initially shared patient names and addresses with dispatch centers, prompting a lawsuit from the ACLU that resulted in a court order limiting disclosure to addresses only. In Tennessee, the health department declined to share any patient data with 911 centers, citing HIPAA concerns, leaving responders without advance notice. The patchwork of approaches reflects the absence of federal guidance on the issue — the CDC and HHS issued general recommendations on responder PPE but did not address 911 data sharing specifically.
Public Health Emergency and Legal Authority
The legal basis for the data sharing rests on Alabama’s public health emergency statutes, which grant the state health officer broad authority to control the spread of communicable diseases. Under Ala. Code § 22-2-2, the health officer may “take such measures as may be necessary” to prevent disease transmission, including disclosure of case information to persons with a need to know. The statute predates HIPAA but has been interpreted consistently with federal law in previous outbreaks, including tuberculosis and hepatitis investigations where employers, schools, and healthcare facilities received limited exposure notifications.
The Alabama Attorney General’s office issued an informal opinion in March 2020 supporting the 911 flagging policy, concluding that the address-level disclosure was permissible under both state law and HIPAA’s public health exception. The opinion emphasized the narrow scope — addresses only, no names, shared only with 911 centers and responders — and the time-limited nature of the emergency declaration. Should the emergency declaration lapse or be rescinded, the legal authority for the data sharing would expire with it.
Looking Forward
As testing capacity expands and case counts rise, the volume of flagged addresses will increase, potentially diluting the system’s utility. If a significant percentage of addresses in a jurisdiction are flagged, the caution indicator loses its discriminatory value — responders must assume exposure on every call regardless. McNichol acknowledged this dynamic and said MCCD is monitoring the ratio of flagged to total addresses. The department is also preparing for the transition to a post-emergency framework, where the flagging system is deactivated and any residual data is purged in accordance with records retention schedules.
The debate over the COVID-19 address flags encapsulates a broader tension in digital-age governance: the speed at which data systems can be repurposed for crisis response versus the deliberative process required to build in privacy safeguards. Alabama’s 911 system, built for voice calls and location routing, was never designed to handle protected health information. The flagging policy grafted a public health function onto a public safety infrastructure in a matter of weeks. Whether the safeguards — automatic expiration, no historical database, purpose-limited sharing — prove sufficient will depend on compliance monitoring, audit trails, and the political will to dismantle the system when the emergency ends.
National Implications for 911 Data Policy
The Alabama experience has informed national conversations about 911 data standards. The National 911 Program, housed within the National Highway Traffic Safety Administration, convened a working group in 2020 to develop model policies for public health data integration with 911 systems. The group’s draft recommendations, released for public comment in early 2021, emphasized purpose limitation, data minimization, automatic expiration, and audit requirements — principles reflected in Alabama’s ad hoc policy but not universally adopted. The Next Generation 911 (NG911) initiative, which aims to modernize 911 infrastructure to handle text, video, and data streams, will inevitably confront similar questions as health data, telematics, and IoT sensor feeds become part of the emergency communications ecosystem.
For Mobile County, the immediate focus remains on the pandemic response. The 143 cases reported in early April represented a fraction of the eventual caseload, and the flagging system would be tested at scales its designers had not fully anticipated. But the policy’s architecture — built on legal review, stakeholder consultation, and technical safeguards — provided a framework that could adapt as conditions changed. Whether it becomes a model for future emergencies or a cautionary tale about mission creep will depend on how rigorously the sunset provisions are enforced when the crisis passes.