Why don't we know more about that COVID-19 case? The balance of health privacy laws and public interest

Since March, many people have been glued to Kitsap Public Health District's website to stay in the know about the coronavirus — whether it’s to follow the daily uptick in cases or the percentage of tests coming back positive. 

Even as the health district has expanded its public reporting since the pandemic’s early days, there’s still information we don’t know about every new COVID-19 case. How old is the person? Where is that person from? How did the person most likely contract the virus? 

A common question from many Kitsap residents: Why don’t we know more?

The answer comes back to federal health privacy laws, namely the Health Insurance Portability and Accountability Act, known as HIPAA, which protects sensitive patient health information. 

For local health officials, the law makes for a balancing act between informing people about the virus’ spread and upholding people’s privacy.

Keith Grellner, Kitsap Public Health District administrator, said health officials understand the desire to have more information about each case, but that doesn’t override protections for people’s privacy.

“We release what we believe is a reasonable and logical amount of information where we can help inform the public yet comply with HIPAA and protect people's private health information,” he said. 

How does HIPAA protect patient privacy?

Under HIPAA, local health officials cannot report any personal medical data that identifies a unique individual, said Bradley Malin, director of Vanderbilt University’s Health Information Privacy Laboratory. 

That means while the health district can report how many confirmed COVID-19 cases happen on a given day, it can’t include any direct identifiers, such as disclosing the name of someone who has COVID-19. If a person with the virus wants to identify themselves publicly, or their family does, that’s their own choice. 

The law also prohibits the health district from sharing information with the general public that indirectly identifies a person, Malin said, by providing several factors that can be traced back to someone like a trail of breadcrumbs. 

So what information is the health district allowed to share? It depends on the situation and the health district’s own discretion, said two experts on federal health privacy laws.

“HIPAA is a little fuzzy on its guidance because it says the risk must be small that someone can be uniquely identified. But you have to ask what does small mean?” Malin said.

A larger county may be able to report more factors about a case than a smaller community, where it could be easier to identify a person. “There’s probably not a one-size-fits-all disclosure model,” he said. 

Margaret Foster Riley, a professor of law and public health sciences at the University of Virginia, says there is a gray line when it comes to public disclosure. “We give a lot of description in this area to the health district, or whatever the covered entity is,” she said.

How Kitsap health officials are reporting cases

Throughout the pandemic, Kitsap health officials have consistently reported several data points about COVID-19 cases. 

There's a breakdown of positive COVID-19 cases among different age groups, though health officials report the information as the rate of positive cases per 100,000 residents.

When it comes to geography, the health district provides the general city or region where cases are reported, not the exact street address or neighborhood. Likewise, ethnicity and race are presented as a percentage of total cases.

In other words, the information is shared in the aggregate form, not on the individual level. 

Details about those who have died of COVID-19 in Kitsap County, which number four as of Friday, omit the person’s age, location, gender and ethnicity and race. In reporting the most recent fatality, for example, health officials only indicated the person was older and had underlying health conditions — both factors believed to make people more vulnerable to the disease. 

For outbreaks at long-term care facilities, Kitsap health officials have declined to name specific facilities, only providing the general region, the type of facility and the number of confirmed cases when requested. Grellner said that practice will continue.

In recent weeks, the health district has further expanded its public data reporting. There’s now a weekly COVID-19 risk assessment dashboard, which shows metrics like hospital bed capacity, contact tracing and testing. Last week, the health district added more recent metrics to its surveillance report, including the latest number of active cases and contacts, and positive tests in the past 30 days. 

Compared with other health districts, Kitsap’s reporting methods largely resemble its neighbors and other counties with similar population size, albeit there are still some minor differences. Thurston County, unlike Kitsap, provides gender and the age range tied to each case. Mason County reported both the age range and gender of its only fatality.  

More: Belfair man, a Navy vet and nuclear engineer, succumbs to coronavirus

The Kitsap health district is hesitant to release any more information because Kitsap is “an extremely small and tight community,” Grellner said. “The more you release about a personal case, the easier it is for people to connect the dots.” 

According to Malin, the Vanderbilt professor, federal health guidance indicates health districts can report on outbreaks of more than 10 people, including an outbreak’s location, though there’s no “hard and fast rule” about how big a cluster should be. He said it’s possible for health officials to report even one case at a long-term care facility without violating HIPAA. 

Grellner says there’s yet to be a large cluster of COVID-19 cases that would necessitate a broad announcement to warn people who may be at risk. Thus far, most outbreaks at long-term care centers have included a handful of cases; the most cases associated with a single facility have been seven, according to a health district spokesman. 

Although many people may be frustrated by the lack of information about COVID-19 cases, federal health privacy law experts say there’s good reason to have protections for personal health privacy. 

Riley, at the University of Virginia, says there’s the risk that people who have COVID-19 could be stigmatized by others if they were identified to the general public. “It would be pretty hard to predict how people would be treated,” she said. 

She says it’s helpful to imagine if you or a family member were in that situation. “Some (people) might not feel anything, but some might feel terrible that they’ve been identified,” she said. 

Austen Macalus is the Kitsap Sun's social services reporter — covering health care, homelessness and how programs are serving those in need. He can be reached at austen.macalus@kitsapsun.com or 360-536-6423. 

This coverage is only possible with support from our readers. Sign up for a digital subscription.