July 09, 2020 Headnote
Coronavirus Tests the Commitment to Government Transparency
When it comes to reporting on health and safety news, government officials and others too often default to the federal Health Insurance Portability and Accountability Act to withhold public records and public information.
by Al-Amyn Sumar and Chuck Tobin
At the height of the COVID-19 crisis, the Courier Journal in Louisville, Kentucky, published a poignant article that began as follows:
Sarah Jordan wants you to know her father’s name.
She wants you to know his face.
She wants you to know that the father of seven—and grandfather of seven more—had a kind heart, an unrelenting sense of humor, and a passion for glam-bands like KISS.
She wants you to know he loved his wife and their home in Ashland, Kentucky.
Most importantly, Sarah Jordan wants you to know that her dad, ARon Jordan, just 49 years old and in otherwise good health, died Tuesday after testing positive for the novel coronavirus.
Mandy McLaren, Her father was a healthy, 49-year-old bricklayer on a job. Then the coronavirus caught him, Louisville Courier J., Apr. 3, 2020.
Sarah Jordan approached the newspaper with her dad’s story because she wanted people to take the virus seriously. ARon, a bricklayer, became infected while on a work trip to Detroit. He quarantined himself from his family by remaining in his hotel room there. And when he fell ill, he checked into a Detroit hospital where he quickly died from the virus.
Sarah thought that telling people about her dad’s loving sacrifice would put a face on the severity of the pandemic. Learning about her dad might make others take more precautions, she hoped. Governor Andy Beshear, when he read the newspaper’s article, made ARon an emotional centerpiece of that day’s press conference, part of his stern, televised warning each day that everyone needed to take immediate steps to protect themselves and each other.
Names, faces, individual experiences. That’s what makes daily news—important, lifesaving news—real for us. The little person brings the big picture home. This is the reason why journalists try whenever they can to report the names of people affected by events. Not to invade the privacy of the victim. To try to help other people relate to what the victim’s pain was like so that, perhaps, they won’t become the next victim.
But when it comes to reporting on health and safety news, government officials and others too often default to the federal Health Insurance Portability and Accountability Act—we all know of “HIPAA”—to withhold public records and public information. In states like California and Massachusetts, for instance, officials have said or suggested that HIPAA constrains their discretion to publicly release even basic coronavirus information to the public, such as the number of cases in a specific town or city. (See Thomas Fuller, How Much Should the Public Know About Who Has the Coronavirus?, N.Y. Times, Mar. 28, 2020; Cody Shepard, Massachusetts DPH asks cities, towns not to release coronavirus numbers, Enterprise, Mar. 28, 2020.) That position, however, is often legally untenable.
Enacted in 1996, HIPAA introduced a number of requirements affecting the healthcare industry. But its name is now most closely associated with rules governing individually identifiable health information, known as “protected health information,” held by “covered entities”—health plans, most healthcare providers, and certain others. Known collectively as the “privacy rule,” the regulations generally constrain how covered entities may use and disclose protected health information without an individual’s authorization. But the privacy rule contains important limitations: Among other things, it applies only to “covered entities,” and it expressly permits disclosure without authorization “to the extent that such use or disclosure is required by law.”
Many public agencies incant HIPAA as a sort of wholesale exemption to the federal Freedom of Information Act (FOIA) or state public records laws. A host of courts and state attorneys general have told us for well over a decade now, however, that governments get this exactly backwards. Public records laws trump HIPAA (and not the other way around), because those laws expressly mandate disclosure of government records. In HIPAA’s words, disclosure is “required by law.”
The Ohio Supreme Court said precisely that in 2006. In a case brought by journalists, the court held that a local health department could not invoke HIPAA to withhold notices issued to property owners where children were found to have elevated levels of lead in their blood. State ex rel. Cincinnati Enquirer v. Daniels, 844 N.E.2d 1181 (Ohio 2006). The court noted that, like virtually any public records law, Ohio’s law presumes that records will be “made available” to the public. Since Daniels, courts in at least four other states have found that their public records laws fall within HIPAA’s “required by law” exception. See Or. Health & Sci. Univ. v. Oregonian Publ. Co., LLC, 403 P.3d 732, 742 (Or. 2017); State ex rel. Adams Cty. Historical Soc’y v. Kinyoun, 765 N.W.2d 212 (Neb. 2009); Abbott v. Tex. Dep’t of Mental Health & Mental Retardation, 212 S.W.3d 648 (Tex. App. 2006); Flores v. Freedom of Info. Comm’n, 2014 Conn. Super. LEXIS 831 (Conn. Super. Ct. Apr. 7, 2014).
To be sure, this doesn’t give the public an unfettered right to sensitive health information held by government agencies. Governments can still withhold information, in appropriate circumstances, under personal privacy exemptions in their states’ public records statutes. But these exemptions generally are not absolute. Federal FOIA Exemption 6, on which some state laws are patterned, requires disclosure when the public interest in release outweighs the privacy interest at stake—leaving the door open for journalists and the public to argue that the balance in a given case tips in favor of disclosure. See, e.g., News-Press v. DHS, 489 F.3d 1173 (11th Cir. 2007).
Even where HIPAA arguably encompasses a government record, the privacy issue is not absolute. For instance, the government custodian of a record may not even be a “covered entity” under HIPAA. See, e.g., Abbott, 212 S.W.3d at 664 n.11 (noting that “the reporter was able to obtain the requested information from another agency, the Texas Department of Protective and Regulatory Services, which is not a covered entity under HIPAA”). And HIPAA itself contemplates that even for covered entities, extreme public health circumstances, like the COVID-19 pandemic, might warrant release of personal health information. It specifically exempts situations where disclosure is “necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.”
How can citizens make educated decisions about their health and safety if they’re left in the dark about basic matters like the number of coronavirus cases in their community? Or if they can’t learn the name of someone they have come into contact with who has been diagnosed with the virus?
In times like these, don’t we all need the inspiration and warmth of hearing about all of the ARon and Sarah Jordans out there?
Names, faces, stories. They’re the only way we’ll truly know that we are all in this together.