������Ƶ

Privacy, or purporting to protect it, has been the state government’s go-to excuse for refusing to disclose data or information about COVID-19, but it’s an excuse they are overusing.

A powerful federal law, known as the , or HIPAA, tightly shields health records and data, says Sallie Milam, a deputy director with the Network of Public Health Law, who has worked extensively with state agencies on data-related issues. There are also state laws and departmental policies.

However, when it comes to matters of public health — such as disease control and prevention — there is some wiggle room.

“Being in a pandemic often increases the need for the public health to share more data so that people’s questions are answered and the trust is maintained with the community,” she said.

Milam’s organization has created an . It says in part that to protect the public’s health and maintain its trust, agencies “must share as much information as possible with the media and the public.”

Of course, there has to be a careful balancing test between the privacy interests of people and the need for public disclosure, Milam said. Is it necessary? Is there potential for harm? Is there significant public interest in releasing this information? Those are among the few questions to be asked.

Back in July, before there was a large spike in cases, Hawaii State Epidemiologist Dr. Sarah Park said in an interview with Civil Beat that she would not release any information that would compromise the department’s investigation of COVID-19 cases.

“I don’t care how transparent you think we need to be on that,” she said.

She also said that when case numbers are small, releasing detailed information about the cases could identify individuals. For example, if there are only five cases in a certain geographical area and the ethnicity breakdown narrows it down to the point of making it possible for someone to be identified, that would be a risk.

There are now many more cases and data could be broken down further without potentially compromising privacy, but a spokesperson for the state’s COVID-19 Joint Information Center said in an email that the health department stands by its stance on the privacy issue and declined to elaborate further.

The statement also said, “DOH does not release individual disaggregated data for the same reason” — that same reason being privacy.

Throughout the pandemic, Civil Beat has sought disaggregated — meaning broken down — data related to COVID-19 based on specific parameters, including race, location and underlying health conditions, but not data that identifies specific patients or their names or addresses.

Civil Beat — along with lawmakers and other media outlets — has sought information on clusters, too. The department has selectively shared some data about clusters through news releases, including a cluster among employees at Honolulu Hale, but never regularly.

With the Hawaii Department of Health, “we must start by seeking complete, accurate and transparent data and go from there,” said Ray Vara, president and CEO of Hawaii Pacific Health and a member of the House Select Committee on COVID-19 Economic and Financial Preparedness.

The House committee has run into challenges getting data from the DOH and has been told that some data can’t be shared for privacy reasons, according to testimony at committee meetings. It finally received , with much of the requested data coming back either incomplete or unfilled.

Four of the charts included in DOH’s response were screenshots of the public dashboard. Two slides had pie charts with high rates of missing responses. For example, one chart asking if an individual was symptomatic had a 45% response rate of “missing.”

“I think there is plenty of opportunity to share more meaningful data in an aggregated manner that does not pose a risk to HIPAA,” Vara said. “I don’t think they’ve been doing that sufficiently.”

The Hawaii Department of Health announced on Aug. 6 that it would release new data, and since then has added some new metrics to its , though some of the metrics promoted as new weren’t actually that new. The Joint Information Center said this week that the health department is expected to release additional data Friday.

A Major Breach In Public Trust

In this tug-of-war between privacy and public disclosure during the pandemic, privacy appears to be winning, a New York Times article said in March. “Armed with emergency powers in many areas, public health officers have vast discretion over what information they want, and do not want, to release to the public,” the article notes.

Hawaii has also exercised that power. Gov. David Ige limited the Uniform Information Practices Act — the state’s law governing public records and open meetings — during the pandemic.

That hasn’t worked out well for transparency. The state’s Office of Information Practices has noted that. In an Aug. 28 opinion, the OIP reminded state agencies of their obligations to be transparent, saying the media and the public have been complaining about not receiving complete data.

“Delay in disclosure may also exacerbate misinformation and the public’s mistrust of government when reliable information and government action are needed the most to allay the public’s concerns and overcome the pandemic,” the opinion said.

Specifically with regards to privacy issues, the OIP said, yes, privacy concerns are legitimate — but so is the obligation to provide public records under state law. As long as the data does not contain personally identifying information, it can be released without limitation.

Nondisclosure or selective disclosure, especially when it involves data about infectious diseases, has had a documented history of hurting public trust.

During the 2009 H1N1 pandemic, government agencies did their own thing in deciding what information to release or not, according to the on reporting information regarding deaths, epidemics or emerging diseases.

That sounds familiar, no? It’s like deja vu.

In 2020, the same situation is unfolding. Prevent Epidemics, a research team of the public health organization Resolve to Save Lives, highlighted in its July report that data tracking and reporting on COVID-19 across the United States is “inconsistent, incomplete and inaccessible in most locations.” That’s because there’s no federal guidance.

Back in 2009, the disparate approaches by different agencies — some releasing information about age and gender but others not — undermined public trust, the guidance from the Association of Health Care Journalists’ said.

“Nothing deepens anxiety and erodes trust more than the perception that government officials are hiding information from the public,” it said.

The guidance itself was born from all of that confusion. The health care journalists’ group and others, including the National Association of County and City Health Officials and the Association of State and Territorial Health Officials, came together to create a set of recommendations for both government agencies and media.

They say that when reporting information regarding deaths, epidemics or emerging diseases, agencies should strive to provide information about the age, gender, location and underlying conditions.  But they also recognize legitimate concerns about privacy — both legal and ethical — and advise caution.

“It’s a balance between the individual privacy against the need for that information by the public,” said Milam of the Network for Public Health Law. “And that’s what all privacy laws are about at any level.”