With each new positive COVID-19 case, questions follow. How sick is the person? Do they have any underlying health conditions? How did they get it?
Legally, all of that is private. But as cases increase in Alaska, public officials, journalists and health care providers must negotiate the tensions between privacy law and the public’s need for information critical to understanding the pandemic.
Federal law protects personal health information, and that hasn’t changed during the coronavirus pandemic. The Health Insurance Portability and Accountability Act, or HIPAA, outlines who can have access to protected health information, when it can be disclosed and for what purposes.
“It’s this idea of protecting the privacy and security of certain patient health information, during their most vulnerable moments,” said Joy Chavez Mapaye, a journalism professor at University of Alaska Anchorage and a health communications researcher.
HIPAA was enacted in 1996, at a time when health care records systems were moving to digital and the health care industry was booming. Congress legislated broad privacy and security rules for health entities like hospitals, pharmacies and insurance companies. That means medical records, patient history or any personal information are all private. Mapaye says “that includes social security — any information that might be tied back to the patient that’s identifiable.”
For COVID-19, HIPAA requires that hospitals and public health departments must be careful to protect the identity of each individual with a positive diagnosis. Members of small communities may want to know who has tested positive and how they’re doing, but health officials legally can’t release that.
Instead, they release aggregate data by region.
“In smaller communities, anything with a count less than six is considered identifiable data,” said Coleman Cutchins, a pharmacist with the Alaska Department of Health and Social Services recently on a press call. “If you look at some of the data hubs, that’s why certain regions are combined, there might be an asterisk. Basically it’s just to prevent people in those communities from being identified with their personal data.”
Petersburg Medical Center CEO Phil Hofstetter said they’ve had to withstand intense public pressure to release individual information when a new COVID-19 case was identified.
“I was glad there was HIPAA. I can’t imagine releasing that information,” said Hofstetter. “And with so many unknowns and fear, that that person becomes ostracized. And that’s a real thing.”
Hofstetter explained the process: when a new COVID positive case is diagnosed in the community, the doctor first notifies the patient. Then they talk through care and quarantining away from others for 14 days. If symptoms become severe, the patient may be hospitalized. The medical center then reports the new case to the state health department and the Petersburg Borough, but they do not release any details to the public.
“Certainly not the level of illness,” he said. “Maybe if they’re asymptomatic or symptomatic, that’s about the extent of it.”
Then state contact tracers get to work. They interview the patient, figure out possible exposures and talk about safe quarantining to reduce any further spread of the coronavirus. Privacy rules also apply, so when they communicate with close contacts, they can’t disclose who the positive case is — only that the contacts were potentially exposed.
But personal accounts of what it’s like to have COVID-19, shared on social media or by news outlets, have been crucial to public understanding of the pandemic. Personal stories capture complexity, feeling, and detail that data cannot. Patients in hospitals, which are governed by HIPAA, can still choose to share their stories. In those settings, journalists must get authorization from patients each time before reporting personal information.
Of course, patients are free to speak publicly with anyone at any time.
“If individuals are okay with their information being shared, then that’s fine,” Alaska Chief Medical Officer Anne Zink said recently on a press call. “And so we also see that in the media and other places, where people share their status or on Facebook or with their employer. Individuals are always welcome to share their information. We just can’t share their information without their permission.”
But access for journalists can be challenging, says Professor Joy Chavez Mapaye.
“Some people are saying that really people don’t understand the devastation that this is causing, because they don’t get to see it firsthand,” she said.
Some of these privacy rules might hinder in disseminating of important information, she says.
“That the public does need to know, and yes this does have devastating consequences,” she said.
Mapaye says privacy considerations have prevailed in the pandemic media coverage, so journalists have interviewed health care workers and used creative visuals to report on what’s happening inside hospitals.
“When you think about it, it’s quite a delicate balance,” she said. “On the one hand, you have providers and the need to protect privacy of patients during their most vulnerable moments. And then on the other hand, the public doesn’t really get to see the extent and toll of this pandemic. And that’s difficult.”
