State and local officials decide what details to publicly release about COVID-19 cases, and their response varies from state to state.
Idaho’s government, for instance, has repeatedly declined to release geographic information about COVID-19 cases beyond the patient’s county of residence, while officials in other states have released the zip codes in which patients live.
Although private health information is protected at the federal level by the Health Insurance Portability and Accountability Act, that legislation is only the ground floor for medical privacy laws. States can enact more stringent laws and protect more information than HIPAA does, according to Stephanie Winer Schreiber, a corporate and health care attorney of the firm Buchanan, Ingersoll and Rooney, in Pittsburgh.
“HIPAA is the floor so to speak, so if a state has a more restrictive confidentiality law, HIPAA does not preempt them,” Winer Schreiber said.
HIPAA requires the weighing of 18 factors to determine if information is private health information, such as names, telephone numbers, medical record numbers, and health plan beneficiary numbers.
Only specific entities — called “covered entities” — are bound by HIPAA regulations, Winer Schreiber said. The Idaho Department of Health and Welfare has determined itself to be a covered entity, and is thus bound by those regulations.
Across the country, Winer Schreiber said, few states leave their medical privacy laws close to the bare minimum HIPAA requirements. State privacy law even tends to be hypersensitive to certain topics; she listed HIV, drug and alcohol abuse, and mental health as topics that often receive additional protections.
Idaho code 74-106-12 lists as exempt from public disclosure, “records of the department of health and welfare or a public health district that identify a person with a reportable disease.”
Idaho officials, for instance, have chosen not to name long-term care facilities where COVID-19 cases have been confirmed, although they have released information about the number of cases and facilities affected. Gov. Brad Little fielded a question about the topic during a press conference Thursday, when asked why the state has not identified a nursing home in Nez Perce County where multiple people have died from the disease. The county has the state’s highest rate of COVID-19 deaths.
“We are looking at what we’re going to do forward about what our policy is,” Little said.
On Friday, Health and Welfare spokeswoman Niki Forbing-Orr confirmed 32 COVID-19-related deaths had been associated with long-term care facilities. Another 19 deaths that were probably COVID-19-related were also associated with long-term care facilities.
The state was reporting 63 COVID-19 related deaths as of Friday afternoon.
Idaho Department of Health and Welfare Director Dave Jeppesen at Thursday’s press conference said, “Our policy is to not release addresses of where people live that have the virus, and that includes specific facilities, so I’m not able to share a specific facility.”
He added that any time one resident of a nursing home tests positive for COVID-19, family members of all residents are notified.
The Idaho Department of Health and Welfare has stood by that approach — last month it would only confirm the number of long-term care facilities where cases were present, but would not identify them.
Yet on April 14, Central District Health sent a press release notifying the public of a fatal case of COVID-19 at Avamere Transitional Care and Rehab in Boise. There were 14 other cases connected to the facility, including both residents and staff members. City of Boise officials were not notified of the outbreak at the facility prior to the media reports about the death.
The final call on what information to share with the public rests with “individual response teams,” according to Brandon Atkins, program manager for Central District Health’s family and clinic services.
He said that while officials consider both HIPAA and Idaho’s law, “they are not the only determining factors in an epidemiological response.”
“While the statute and HIPAA regulations serve to protect individual identity, it is left to independent response teams at both a state and local level, to share certain pieces of information critical to response in an investigation scenario, based on independent agency protocols and procedures,” Atkins wrote in an email to the Idaho Press. “We take individual identity and the rights of those individuals very seriously. Sometimes, pieces of information, such as locations that may be impacted by an outbreak, for example, may be shared in an effort to clarify misinformation or supply vital information in protecting others that may be impacted by the information and its accuracy.”
He added officials have “independent protocols that guide decisions” about releasing information.
At Thursday’s press conference, Little concluded, “My belief is that most people of Idaho don’t like their personal information being shared.”
Last month, Florida released a list of names of elder-care facilities where staff or residents had tested positive for COVID-19. That reversal in policy came after increased pressure from the AARP, families of residents, and media organizations. Earlier in the month, the Miami Herald drafted a lawsuit against the state’s government over the issue.
Information available in other states
The only geographic information released about a case of COVID-19 in Idaho is the county, but that’s not the case elsewhere in the United States.
The Illinois Department of Public Health has the number of confirmed cases in each zip code statewide on its website, including both densely populated Chicago and rural areas of the state. Although it does not have cases broken down by zip code, the city of El Paso, Texas has a map of the city and the number of cases in each approximate area available on its website along with the number of cases and tests conducted. Dallas County, Texas is also reporting COVID-19 cases by zip code.
Other states have released information related to the number of cases associated with long-term care facilities and their locations. In Washington, 198 long-term care facilities had at least one case as of April 16. The data released from the Washington State Department of Social and Health Services includes a list of specific facilities impacted, whether there was a death or not, but it does not specify the number of cases for every facility.
New Hampshire’s Department of Health and Human Services is also identifying long-term care facilities with cases as outbreaks are discovered, and reporting the number of residents and staff members who test positive at the facility regardless of fatalities. In Massachusetts, at least 530 COVID-19 related deaths have stemmed from the 222 long-term care facilities where the disease has been detected. As of April 15, 4,163 residents and employees of the facilities tested positive for COVID-19.