Recalibrating the balance: Increasing transparency around COVID-19 while still respecting privacy

By Clare Norins

Narrow restriction of local information about confirmed cases of COVID-19 begs the question: What, exactly, is the appropriate balance between protecting an individual’s identity and the public’s right to information during a public health crisis?

The Georgia Department of Public Health — like many state health departments around the country — provides daily updates on the number of confirmed COVID-19 cases, broken down by county. While these numbers and how they change over time (so far they are only rising) are informative, Georgians are eager to know more, specifically how the coronavirus is manifesting in their local communities.

Yet the department, citing privacy concerns, has declined to release details such as cities within a particular county where cases have been confirmed or locations where people who tested positive have been. News outlets around the state have documented the restrictions on information, in reports like these:

Health care providers in some areas, such as Augusta and Albany, have filled the gap by providing more localized COVID numbers. But this level of data is not available for most of the state, making it difficult for municipal officials and the public to ascribe meaning to the state-reported county numbers.

Lack of transparency frustrates local officials and citizens nationwide

This tension between preservation of privacy interests on the one hand, and a call for greater transparency on the other, is playing out not just in Georgia but around the country. For example, in Massachusetts, some municipalities are releasing specific numbers about COVID cases, and even COVID deaths, within their boundaries, citing the need to keep the public informed. Other municipalities, however, are declining to release numbers, instead referring the public only to the county-based statistics provided by the state health department.

Clare Norins

Oklahoma is another example. There, local government officials and citizens have been frustrated by the state’s refusal to provide more specific, yet still non-identifying, information about confirmed COVID cases. Such information, they say, would help them to make more informed personal and public health decisions.

Meanwhile, South Carolina’s Department of Public Health and Environmental Control has taken an additional step toward transparency by making data on positive COVID cases available by ZIP code.  So, too, has Illinois.

Localized information on COVID-19 would prompt precautions

In response to calls for greater transparency, state public health officials here and elsewhere are encouraging people to assume that they could come into contact with someone infected with COVID-19 at any time, and to take precautions accordingly. It would be far more impactful if people truly understood the virus’ proximity and escalation. For instance, knowing that a certain number of people in your town have tested positive for COVID-19 or that someone from your workplace, your child’s school or the elder care facility where your parent lives has far greater meaning than simply knowing that X number of random people somewhere in your county tested positive for COVID-19. Localized information is also more persuasive. When people understand how the disease is spreading in their town, they are more likely to take precautionary measures.

And here’s the nub of it: Enhanced disclosure of the location or affiliation of people who have tested positive for COVID is — in most situations — not going to be sufficient to make them reasonably identifiable. Certainly, disclosing the number of confirmed COVID cases in a town or city does not identify anyone. Even information that narrows the pool of possible candidates to 1,000, 500 or even 50 people does not identify any single individual. In other words, state health departments, including in Georgia, are taking greater precautions than are actually necessary to achieve reasonable medical privacy.

Moreover, the federal law restricting release of medical information — the Health Insurance Portability and Accountability Act, or HIPAA — recognizes that privacy interests are not absolute in the face of a public health crisis. A March bulletin from the U.S. Department of Health & Human Services states that individual health information can be disclosed “to anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of … the public.”

This is echoed by the Georgia Department of Public Health’s Notice of Privacy Policies, which states, “We may disclose your health information for public health activities which include: preventing or controlling disease … .”

It’s time to prioritize Georgians’ right to vital health information

A recalibration of privacy vs. access is therefore in order. Yes, it is important not to publicly out individuals who have tested positive for COVID-19 without their consent. But the Georgia Department of Public Health and local municipalities can avoid that while still providing citizens access to localized, non-identifying information about COVID-19’s presence in their communities, empowering them to make informed and rational choices.

Withholding this kind of potentially life-saving information goes beyond what is necessary to reasonably protect privacy and, instead, fosters anxiety and public mistrust of health institutions.

Clare Norins, a First Amendment attorney, is a member of GFAF’s board of directors and is director of the First Amendment Clinic at the University of Georgia School of Law.

Learn more about open government and transparency issues amid the COVID-19 coronavirus crisis, including tips for conducting virtual public meetings that follow Georgia’s Sunshine Laws.

What Georgia’s shelter-in-place order means for the media

By Sarah Brewerton-Palmer

Georgia Gov. Brian Kemp’s shelter-in-place order to address the growing COVID-19 coronavirus crisis took effect at 6 p.m. on April 3 and will last through April 30, unless extended. Members of the media are exempt from the shelter-in-place order while they’re working, but they may need to adjust some of the ways they gather news.

Requirements of the shelter-in-in place order

The order generally requires Georgians to remain in their homes unless they are:

  • Conducting essential services (i.e. buying food, getting medicine, going to the doctor, or engaging in outdoor activities)
  • Performing necessary travel (i.e. traveling to and from the grocery store or a critical infrastructure workplace)
  • Performing minimum basic operations for a noncritical business (i.e., picking up mail at an office or obtaining equipment necessary to work from home
  • Engaging in critical infrastructure work

Courtesy of Georgia Recorder

Members of the media are considered employees of critical infrastructure organizations, as defined by the U.S. Department of Homeland Security. That designation is detailed in the handout that the governor’s office issued with the shelter-in-place order, but it takes some digging. Go to Page 15 of the handout to see that DHS’ definition of critical infrastructure includes “[w]orkers who support radio, television, and media service, including, but not limited to front-line news reporters, studio, and technicians for newsgathering, and reporting, and publishing news.”

That means news organizations of all types qualify as critical infrastructure, and their employees—not only journalists but anyone necessary to the operation of a news organization—may continue to work in the office or out in the community without violating the shelter-in-place order.

Tips for journalists

Journalists may need to show that they are exempt from the shelter-in-place order if they are stopped or questioned while working. While the governor’s order does not require you to carry proof of your critical infrastructure status, it is still a good idea to always carry with you:

  • Press identification or credentials from your employer
  • A government-issued ID, such as a driver’s license
  • A copy of Gov. Kemp’s executive order
  • A copy the handout that accompanied the order, which includes DHS’ definition of the media as critical infrastructure

If your media organization doesn’t issue identification to employees, ask your employer to create a provisional ID or provide a letter on company letterhead that verifies your position as a member of the media.

Follow the same practices advised by health care professionals to protect yourself and those with whom you come into contact:

  • Work from home as much as possible
  • Conduct interviews virtually or over the phone
  • During in-person interviews, maintain six feet of space

Tips for media organizations

If a news organization continues in-person operations—for example by continuing to use the newsroom or news studio—then the organization must follow the requirements laid out on pages 4 and 5 of the governor’s shelter-in-place order.

Sarah Brewerton-Palmer

These measures include screening workers for illness, requiring sick workers to stay home, encouraging teleworking where possible, minimizing contact among staff and enhancing sanitizing procedures.

If journalists or members of the media encounter obstacles to their work, let the Georgia First Amendment Foundation know. Reach us at info@gfaf.org.

Sarah Brewerton-Palmer, a foundation board member, is an attorney at Caplan Cobb in Atlanta.

Check out a Q&A on what government entities must do to follow open meetings and open records laws amid the coronavirus crisis and get tips for how to conduct virtual government meetings.

This article was updated on April 9, 2020, to reflect the shelter-in-place order extension through April 30.