In Oklahoma, local government officials and citizens have been frustrated by the state’s refusal to provide more specific, yet still non-identifying, information about COVID cases. Such information, they say, would help them to make more informed personal and public health decisions.
Meanwhile, South Carolina’s Department of Public Health and Environmental Control has taken an additional step toward transparency by releasing COVID cases by ZIP code.
Georgia public health officials are encouraging people to assume they could come into contact with someone infected with COVID at any time, and to take precautions accordingly. It would be far more impactful if people truly understood the virus’ proximity and escalation.
For instance, knowing that a certain number of people in your town have tested positive for COVID or that someone from your workplace, your child’s school or the eldercare facility where your parent lives has far greater meaning than simply knowing that X number of people somewhere in your county tested positive. Localized information is also more persuasive. When people understand how the disease is spreading in their town, they are more likely to take precautions.
And here’s the nub of it: Disclosure of the location or affiliation of people who have tested positive for COVID is — in most situations — not sufficient to make them reasonably identifiable. Certainly, disclosing the number of confirmed COVID cases in a city does not identify anyone. Even information that narrows possible candidates to 1,000, 500 or even 50 people does not identify any single individual. State health officials are taking greater precautions than are actually necessary to achieve reasonable medical privacy.
Moreover, the federal law restricting release of medical information — the Health Insurance Portability and Accountability Act, or HIPAA — recognizes that privacy interests are not absolute in a public health crisis. A March bulletin from the U.S. Department of Health and Human Services states individual health information can be disclosed “to anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of … the public.”
This is echoed by the Georgia Department of Public Health’s Notice of Privacy Policies: “We may disclose your health information for public health activities which include: preventing or controlling disease … .”
A recalibration of privacy vs. access is therefore in order. Yes, it is important not to publicly out individuals who have tested positive for COVID without their consent. But the Georgia health department and municipalities can avoid that while still providing localized data that empowers the public to make informed and rational choices.
Withholding this kind of potentially life-saving information goes beyond reasonably protecting privacy and, instead, fosters anxiety and public mistrust of health institutions.
Clare Norins is a First Amendment attorney and a member of the board of directors of the Georgia First Amendment Foundation, which has been actively pushing for open government and transparency amid the COVID-19 coronavirus crisis.