Health confidentiality in a pandemic: Does the public deserve to know?

Fear about the ongoing COVID-19 pandemic has pushed some people concerned for their health and safety to contact the Utah County Health Department, asking for a list of those who have tested positive in their cities and neighborhoods. 

“People are under stress and they’re scared,” said Aislynn Tolman-Hill, a public information officer for the Utah County Health Department. “But we’re still under the same restrictions and guidelines to protect personal health information. We’re doing our best to provide the information we can.”

Personal health information (PHI) and personally identifiable information (PII) are protected by privacy laws like the Health Insurance Portability and Accountability Act (HIPAA), the Utah Communicable Disease Control Act and the Family Educational Rights and Privacy Acts (FERPA).

Public health professionals and privacy law specialists agree there is a fine balance between sharing people’s private health information and protecting the health of the public. 

Concern in the BYU community

BYU students have also expressed concern about the lack of access to identifying information of individuals who have tested positive for COVID-19 in the campus community.

BYU spokesperson Carri Jenkins said the university is working hard to provide accurate and updated information to its students while protecting their rights under FERPA. BYU is currently following guidelines instituted by the U.S Department of Education.

This guidance states that “FERPA only permits non-consensual disclosures of PII from students’ education records under the health or safety emergency exception to ‘appropriate parties’ whose knowledge of the information is necessary to protect the health or safety of students or other individuals.”

“Appropriate parties” in this context are normally those who provide specific medical or safety attention, such as public health and law enforcement officials.

The guidelines also state that school officials should make the determination of disclosing PII on a “case-by-case basis,” only disclosing PII when it’s absolutely necessary. Schools are also advised to consider the “totality of the circumstances,” including the needs of members in the campus community to have that information in order to take protective actions.

While PHI and PII are released only when deemed necessary, there are certain exceptions built into privacy laws that can be used to deal with circumstances like COVID-19.

“This just means that certain exceptions built into HIPAA can be accessed to effectively deal with exceptional circumstances, and temporary waivers of certain provisions in the law can be made to appropriately carry out an effective public health response in times of crisis,” said Jo O’Reilly, deputy editor of ProPrivacy, an online software company that protects digital privacy.

Access to these exceptions, however, are highly limited.

Finding the balance between confidentiality and protecting public health

Maintaining confidentiality with personal health information will always be of the utmost importance, according to Tolman-Hill. Instances where PHI should be disclosed are extremely limited, even within the health department. Disclosed information is generally limited to the epidemiologist and medical providers who treat infected individuals. 

“We’re working with all of our partners, law enforcement included, because we want to make sure they and first responders remain healthy and stay safe,” Tolman-Hill said.

The country has also faced incidents of people intentionally trying to expose others to the virus. In these cases, the public may need information so they can increase their awareness, said Tolman-Hill. 

Nicholas Rupp, communications and public relations manager of the Salt Lake County Health Department, said the health department will release information they deem necessary to protect public health.

“We’re allowed to disclose the location of an infected individual if having that information will help the public better protect themselves,” Rupp said. “But if the information doesn’t do anything more to improve the ability of public health, there’s no reason to release that information and potentially compromise someone’s privacy.”

Rupp said he often gets calls from reporters asking him to confirm the name of an infected individual. 

“They would say the public needs to know who died from this disease,” Rupp said. “But honestly they don’t need to know if there’s no risk to them. We’re going to weigh that public health piece with the privacy piece and make the decision when people need to know and when they don’t.”

Protecting the public without releasing PHI

Releasing PHI is not necessary or beneficial in most cases, according to Tolman-Hill. The health department has other safety precautions in place to protect the public

“If you have been exposed, you will be contacted by one of our epidemiologists for an interview,” Tolman-Hill said. “They would say, ‘based on an interview by someone who had tested positive for XYZ disease, you have been exposed. We would like to ask you some questions.’ People are usually cooperative because they want to take care of themselves.”

If an individual tests positive for COVID-19, the health department gives them specific instructions on how to protect those around them. Their family also receives special instructions on how they can protect themselves and prevent the spread of disease.  

According to Rupp, when there’s a disease outbreak in public places like grocery stores or movie theaters, the health department will often release information like dates, times and locations where an infected individual was present. Names and other identifying details aren’t released. The information is generally published online and through various media outlets to reach as many people as possible.

The bottom line

In the end, knowing the names and identifying details of people who have tested positive for COVID-19 or any contagious disease doesn’t really matter, according to Rupp.

“How is knowing that information going to change your behavior?” Rupp said. “Because, regardless, you should be taking these precautions.”

The COVID-19 outbreak is compromising the health of communities across the nation. Rupp said people need to assume they’re at risk for infection anywhere they go. 

“You should assume that the person walking past you on the sidewalk, the person recreating at the park, the person at the grocery store are positive in carrying the virus,” Rupp said. “You need to protect yourself at all times.”