Privacy and Public Disclosure during a Pandemic
May 14, 2020
Overview
As the number of COVID-19 cases continues to grow across the United States, so do feelings of uncertainty and concern. The public and the media are in search of answers. How many people in their community have positive diagnoses? Has someone at a family member’s long-term care facility tested positive? What about their neighbors in a multi-family apartment complex? For public health officers, the answers about how much information to disclose are not always clear. Sources of support for public health officers facing questions about public disclosure include the Network for Public Health Law’s COVID-19 resources and real-time assistance. For example, Network attorneys can provide guidance on questions such as, “Can a HIPAA covered health department release COVID-19 county level case information to the press to avert a serious threat to public health or safety?” While decision-making around public disclosure is not new to the field of public health, the presence of the widespread novel coronavirus adds to the public demand for expeditious transparency.
The Network for Public Health Law often uses a series of three questions to guide public health decision-making: Can I? Must I? Should I? The first two are legal questions while the third addresses ethics and discretion. Federal and state privacy laws regulate disclosure of certain types of protected information. For example, compliance with HIPAA falls under the “Can I?” prong while state open information laws may be relevant to “Must I?” The specific legal and regulatory landscapes vary by jurisdiction, but some amount of discretion is typically left to public health officers. If applicable law provides the authority to release data, but not mandate it, then a health officer utilizes discretion to determine the information to provide to the public while protecting privacy interests and preventing the spread of disease.
A number of considerations reside within the “Should I?” prong. Prompted by the 2009 H1N1 pandemic, the Association of State and Territorial Health Officials, the National Association of County and City Health Officials and the Association of Health Care Journalists developed guidance for public health officials and journalists regarding deaths, epidemics, and emerging diseases. This guidance recommends sharing as much information as possible on age, gender, residence, underlying conditions, and time and place of death, but only to the level of granularity that maintains protection for individuals from re-identification.
A community’s particular social context and the spread of the disease influence disclosure decisions. Where an outbreak is fairly contained and sufficient contact tracing is feasible, decisions may be made differently than in a location with widespread community transmission where officials can no longer identify the source of new infections. In less populated communities, or if a smaller geographic unit is used, it may be easier to identify individuals based on fewer characteristics, while in larger cities with denser populations, confidentiality may be protected. The guidance offers public health officers a decision-making framework that is consistent with the law, aligned with ethical guidelines, and in pursuit of public health. Health departments and government agencies may report information in distinct ways and public health officers should be prepared to explain to the public and the media why their data disclosures differ.
This post was developed by Susan Fleurant, Senior Legal Researcher, Network for Public Health Law – Mid-States Region Office and reviewed by Sallie Milam, Deputy Director of the Mid-States Region Office.
Support for the Network is provided by the Robert Wood Johnson Foundation (RWJF). The views expressed in this post do not represent the views of (and should not be attributed to) RWJF.