HIPAA Heist: Lethal Privacy In the Age of Coronavirus

Government and public health officials are telling us every day that we’re in a war against the invisible and deadly coronavirus. They tell us that every one of us is a soldier in that war, each responsible for doing one’s part. The most important part, the only part really, is to stop the spread of a virus without a cure. But they’re not treating us like soldiers. They’re treating us like blind prisoners. They’re making the virus even more invisible than it has to be when they know exactly where and whom it is affecting, at least to the shockingly insufficient extent that they have tested for it.

Two misapplications and misinterpretations of the federal medical privacy law known as HIPAA are conspiring to kill more of us than otherwise would die from the coronavirus.

The well-intentioned law is being used to deny the public legitimate information about the locations, interactions and movements of people infected or potentially infected by the virus, making it much easier for the virus to spread even though all that information could be released without personally identifying a single individual.

And well-intentioned public health and government officials are misinterpreting the law as a mask-all to err on the side of secrecy at a time when the greatest global crisis since World War II calls for erring on the side of maximum possible information. They are doing so either because they misunderstand the law, which is not immune to waivers,, or because they’re under orders to stay mum, as is the case locally with much of that sort of information.

I should specify who I mean by “they.” I don’t mean our local public health department, whose administrator–Bob Snyder–has been a model of transparency to the extent that he can be. I don’t mean his staff of nurses and epidemiologists and volunteers who, like all health care workers, have heroically been battling this calamity in trenches that can trip their lives at any moment. Nor do I mean our emergency management team, whose chief–Jonathan Lord–has been more far-sighted and clear-eyed than a few others playing leader on TV. I mean the state public health agencies in charge of this pandemic, the Centers for Disease Control, from whose politburo-like directives they’ve been taking their cues, and a federal government reinventing its catastrophic Hurricane Katrina response for the entire nation to suffer. Privacy laws have been the perfect foil, a cloak for their failures above all.

What would detectives do? When a murderer is on the loose police agencies don’t conceal identities. They plaster pictures of the murderer all over the place. It goes without saying that infected individuals aren’t criminals. They’re not victims, either, except of circumstances. They carry no blame. But the virus they carry is a potential killer, and should be treated accordingly–not revealing anything identifying about carriers, but everything short of that, erring on the side of disclosure, not privacy. If a few revelations slip through, big deal: the individual will survive, which is more than we can say for some of those infected who might have been spared had they known more. Southeast Asian countries are proof. We have no excuse. But by God we have HIPAA.

Contact tracing–the investigation of how one got infected–is a major weapon in the arsenal against pandemics. But for us it’s a TV commercial. It’s nothing we can use, it’s nothing that’s truly protecting us beyond that old assurance: “trust us.” If we want to apply Ronald Reagan’s standard–trust, but verify–we’re not allowed. Some of us are dying as a result. It’s that simple, that grim.

We should be told not just how many cases there are in a city, but where they are by neighborhoods. South Korea, which kept fatality rates at 1 percent and mastered the disease like no other country, without stay-home orders, without authoritarian measures, without cataclysmic job losses, provided citizens a means of tracking infections geographically through a phone app. The app showed nothing about the individual’s identity. But it showed the location of the infection and provided real-time updates on new infections, themselves facilitated by tracking infected individuals’ bank-card and cell phone use. That helped people avoid hot spots. It did nothing to infringe on privacy. We’ve acted like a banana republic in comparison.

We should be told the results of contact tracing to the extent that we know what businesses or public buildings or common areas infected individuals have been to within the contagious period. We should be told what Uber or any other form of public transport they may have taken. We should be told what hospitals, what nursing homes, what hotels they’re in. None of that reveals the first thing about who the individuals are–not by name, not by any other identifier. All it tells us is a statistic, a mapping function, an empowering set of information for us to act upon if we’ve had interactions in the same places and a caution to be weary of if we’ve not, as these same officials tell us day and night we should.

But we’re told none of that. We’re only told the age, sex and official town of residence of the infected individual, and we don’t even know if that individual is actually there. He or she could be in another county or a hospital here or elsewhere. We’re not told. It’s just numbers, placating us into a false sense of awareness with dashboard dazzles. It’s more grist for fear than information that empowers us to do something about it.

As our officials tell us all the time, these are not normal times. They are unprecedented. Then act like it and apply common-sense safeguards instead of letting HIPAA paralyze us. HIPAA is being waived, for example, for cops and first responders who go to a house on a medical or any other reason the 911 dispatcher sends them there. They know before going in if a resident is infected, or under surveillance. They suit up. Of course our first responders must be protected, and knowing what they’re stepping into gives them that protection and that right. But the rest of us aren’t owed any less protections when those same individuals walk among us. It’s an untenable double-standard, and it’s causing more deaths.

This noxious HIPAA doctrine is denying the public literally life-or-death information in the name of privacy, placing largely bogus concerns for single individuals above public health–a contradiction with public health’s mission–hampering the very measures officials are imposing in the name of community safety. They are denying us that information for unconscionable reasons, such as the fear of stigmatizing a business, as if preserving a business’ image or viability was more essential than saving lives, or stigmatizing individuals, although, again, no identifying information is ever released.

It’s not as if South Korea, allegedly a second-tier economy, hasn’t shown the way through means as accessible as our phones. But American companies are showing the way, too. One company is tracking temperatures across the country, providing a real-time “heat map” that shows where temperature hot spots are, where health care workers may face a surge. It’s broken down by county. It relies on individuals taking their own temperature, but nothing about them is identified other than their temperature. Another company is issuing social distancing grades, state by state, county by county. We’re at a pitiful C in Flagler, by the way. It’s based on cell phone data and distances traveled. Again, no private information can be traced to any single user, but the system relies on what’s essentially a Big Brother analysis of the movements of every individual in the system. The same principles can be applied to Covid-19 tracking and emergence. We have the means.

There is no question that keeping the identity of an infected individual secret helps spread the disease. No public health officials will argue that with a straight face. Yet that’s precisely the protocol they’re working under, condemning us to what we now have on our hands: by far the most infections, the most hospitalizations, the most deaths the pandemic will claim anywhere on the globe before it runs its course.

That’s not what HIPPA was written into law for in 1996. It was intended as a means of ensuring that patient records are kept confidential, with exemptions for public health emergencies. It’s turned into a scapegoat, making us look more like North Korea than South Korea. It’s turned into Covid-19’s most opportunistic enabler–inert, immovable and indifferent, the definition of a dogma whose means are an end in themselves. If something constructive is to come out of the next few weeks’ carnage, surely burying HIPAA is one of those things, because until this pandemic, no nation had ever profaned privacy as a right more sacrosanct than saving lives. In this war fought in medieval fogs, it’s one right that deserves a death so many thousands of human beings did not.

Pierre Tristam is FlaglerLive’s editor. Reach him by email here. A version of this piece aired on WNZF.