By Clare Norins
Narrow restriction of local information about confirmed cases of COVID-19 begs the question: What, exactly, is the appropriate balance between protecting an individual’s identity and the public’s right to information during a public health crisis?
The Georgia Department of Public Health — like many state health departments around the country — provides daily updates on the number of confirmed COVID-19 cases, broken down by county. While these numbers and how they change over time (so far they are only rising) are informative, Georgians are eager to know more, specifically how the coronavirus is manifesting in their local communities.
Yet the department, citing privacy concerns, has declined to release details such as cities within a particular county where cases have been confirmed or locations where people who tested positive have been. News outlets around the state have documented the restrictions on information, in reports like these:
- The News Observer, Georgia Department of Health reports fourth COVID-19 case in Fannin
- The Northeast Georgian, DPH reports two COVID-19 cases in Habersham County
Health care providers in some areas, such as Augusta and Albany, have filled the gap by providing more localized COVID numbers. But this level of data is not available for most of the state, making it difficult for municipal officials and the public to ascribe meaning to the state-reported county numbers.
Lack of transparency frustrates local officials and citizens nationwide
This tension between preservation of privacy interests on the one hand, and a call for greater transparency on the other, is playing out not just in Georgia but around the country. For example, in Massachusetts, some municipalities are releasing specific numbers about COVID cases, and even COVID deaths, within their boundaries, citing the need to keep the public informed. Other municipalities, however, are declining to release numbers, instead referring the public only to the county-based statistics provided by the state health department.
Clare Norins
Oklahoma is another example. There, local government officials and citizens have been frustrated by the state’s refusal to provide more specific, yet still non-identifying, information about confirmed COVID cases. Such information, they say, would help them to make more informed personal and public health decisions.
Meanwhile, South Carolina’s Department of Public Health and Environmental Control has taken an additional step toward transparency by making data on positive COVID cases available by ZIP code. So, too, has Illinois.
Localized information on COVID-19 would prompt precautions
In response to calls for greater transparency, state public health officials here and elsewhere are encouraging people to assume that they could come into contact with someone infected with COVID-19 at any time, and to take precautions accordingly. It would be far more impactful if people truly understood the virus’ proximity and escalation. For instance, knowing that a certain number of people in your town have tested positive for COVID-19 or that someone from your workplace, your child’s school or the elder care facility where your parent lives has far greater meaning than simply knowing that X number of random people somewhere in your county tested positive for COVID-19. Localized information is also more persuasive. When people understand how the disease is spreading in their town, they are more likely to take precautionary measures.
And here’s the nub of it: Enhanced disclosure of the location or affiliation of people who have tested positive for COVID is — in most situations — not going to be sufficient to make them reasonably identifiable. Certainly, disclosing the number of confirmed COVID cases in a town or city does not identify anyone. Even information that narrows the pool of possible candidates to 1,000, 500 or even 50 people does not identify any single individual. In other words, state health departments, including in Georgia, are taking greater precautions than are actually necessary to achieve reasonable medical privacy.
Moreover, the federal law restricting release of medical information — the Health Insurance Portability and Accountability Act, or HIPAA — recognizes that privacy interests are not absolute in the face of a public health crisis. A March bulletin from the U.S. Department of Health & Human Services states that individual health information can be disclosed “to anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of … the public.”
This is echoed by the Georgia Department of Public Health’s Notice of Privacy Policies, which states, “We may disclose your health information for public health activities which include: preventing or controlling disease … .”
It’s time to prioritize Georgians’ right to vital health information
A recalibration of privacy vs. access is therefore in order. Yes, it is important not to publicly out individuals who have tested positive for COVID-19 without their consent. But the Georgia Department of Public Health and local municipalities can avoid that while still providing citizens access to localized, non-identifying information about COVID-19’s presence in their communities, empowering them to make informed and rational choices.
Withholding this kind of potentially life-saving information goes beyond what is necessary to reasonably protect privacy and, instead, fosters anxiety and public mistrust of health institutions.
Clare Norins, a First Amendment attorney, is a member of GFAF’s board of directors and is director of the First Amendment Clinic at the University of Georgia School of Law.
Learn more about open government and transparency issues amid the COVID-19 coronavirus crisis, including tips for conducting virtual public meetings that follow Georgia’s Sunshine Laws.
