Amid outbreak, Virginia’s health department keeping some COVID-19 information under wraps

At first, information on COVID-19 in Virginia came out in a trickle.

For several weeks after the first infection was identified, health officials often reported cases, and especially deaths, by health district — 35 regions encompassing multiple counties and dozens of miles. They often declined to identify cases with more geographic specificity, saying it could violate patient confidentiality.

By late March, the Virginia Department of Health began reporting cases by locality on its daily surveillance dashboard. But weeks later, some information remains opaque. Each locality includes a wide range of territory (case numbers are available in Fairfax County, for instance, but not specific locales such as Herndon and Falls Church). And despite repeated questions, officials have declined to provide the names of individual long-term care facilities with outbreaks of the disease.

It’s led to situations like a nursing home employee in Harrisonburg coming forward this week to identify her facility as the one that was announced by the Central Shenandoah Health District as under investigation for a COVID-19 outbreak.

“There’s a lot of sick people,” the 25-year-old nursing assistant told the Daily News-Record. “All of our aides are pretty much sick right now.”

Reporters and the public have been relying on the department’s daily dashboard, which sometimes includes information that’s inconsistent with other reports. On Thursday, for instance, VDH reported 63 outbreaks of COVID-19 within long-term care facilities, with 654 cases and 36 deaths. But Canterbury Rehabilitation & Healthcare Center in Henrico — the site of what’s become the deadliest known outbreak of COVID-19 at any nursing home in the country — had confirmed 45 deaths at its facility alone.

Virginia’s policy on disclosing coronavirus cases, hospitalizations and deaths highlights the variability of patient confidentiality laws and how they’re applied across the country. Maryland, for example, recently released a list of COVID-19 cases by zip code — a decision that Charlie Gischlar, a spokesman for the state’s department of health, attributed to a desire for “greater transparency.”

“The [department’s] dashboard is evolving to include additional information as it receives and evaluates more data,” he added in an email on Thursday. 

And while Virginia has refused to release the names of facilities with COVID-19 outbreaks, Ohio has compiled a list on its public health dashboard.

Virginia officials favor a conservative interpretation of the state’s privacy laws. To explain why VDH hasn’t released the names of nursing homes and other facilities with COVID-19 outbreaks, Health Commissioner Dr. Norman Oliver cited a section of Virginia code that requires him to preserve the anonymity of “each patient and practitioner” unless it’s pertinent to “an investigation, research or study.”

“Doing a blanket release to all nursing homes in the commonwealth wouldn’t, per se, advance the investigation,” he said in an interview last week. Laurie Forlano — the department’s deputy commissioner of population health and leader of Virginia’s newly formed nursing home task force — dove into the law even further Monday, explaining that VDH interprets “patients” to include individual long-term care communities.

“A person is defined pretty broadly in the law, which includes facilities,” she said. “And in most cases, releasing the name of a facility in these situations doesn’t change the action we take as a public health agency.”

Attorney Sara Blose, director of health advocacy for the Central Virginia Legal Aid Society, pointed out that Virginia is “far from alone” in limiting the release of information. An article from Poynter, a nonprofit training institute for journalism and media ethics, found that multiple states and hospitals across the country were citing the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in withholding information on COVID-19 cases.

Interpreting state and federal privacy rules can become a challenge for health officials. “HIPAA sets the floor, not the ceiling,” Blose wrote in an email on Tuesday, meaning that Virginia can set regulations that are more — but not less — stringent than federal law.

Another section of the state code included detailed privacy requirements governing the release of an individual’s health records. Blose said it’s more commonly referenced than the section cited by Oliver, which “[isn’t] very helpful in explaining their rationale.”

Both sections of the code include exceptions for the release of information related to public health activities. And Poynter reports that HIPAA was drafted to protect an individual’s identifiable health information, not statistics on death and disease. The U.S. Department of Health and Human Services even wrote a bulletin on disclosing protected health information during the COVID-19 pandemic, writing that covered entities — including state health departments — can widely share information under certain circumstances.

One specific guideline allows them to share information “to persons at risk of contracting or spreading a disease or condition if other law, such as state law, authorizes the covered entity to notify such persons as necessary to prevent or control the spread of the disease or otherwise to carry out public health interventions or investigations.” 

How states interpret those laws often becomes a matter of choice. Virginia officials “may be concerned that that releasing facility-specific information to the general public may incidentally release [protected health information],” Blose wrote. HIPAA law allows health entities to release de-identified information, but there’s still variance in how to meet those standards.

Even VDH has shifted in how it interprets patient privacy regulations and issues guidance. Oliver recently allowed local health departments in Northern Virginia to distribute lists of longterm care centers with COVID-19 outbreaks to other facilities. The same disclosures aren’t happening in other areas of the state, but Oliver said it was necessary given the number of outbreaks within nursing homes in the region.

In most other cases, Virginia officials have acted with an abundance of caution, citing the limited populations in some of the state’s smaller localities. Oliver said that disclosing details of a case of disease in Fairfax County — even just by identifying a patient’s sex and age range — is much different than releasing similar information in Bath County, for example, with a population of less than 5,000 people.

“I used to do research in prostate cancer, and I would do all these fancy maps of cancer incidents and suppress data all the time” he added. “When you had the one black, male prostate cancer case in Bath County, I wouldn’t report that, because everybody would know who that was.”

Officials have also referenced concerns that revealing more information could risk stigmatizing patients with the disease. 

“Many of us can remember the time that telling someone, ‘Joe over there has HIV’ meant that he would lose his job, be ostracized in his community, maybe even become a victim of violence,” Oliver said. “Even cancer used to be a thing nobody wanted anyone else to know about. For all of those reasons, the state decided that we should not be responsible for exposing citizens to such discrimination.”

Some states have settled on workarounds. Maryland health officials made the choice to suppress zip codes with seven or fewer cases, Gischlar wrote — a common public health tactic in cases where patients could be more easily identified. Oliver said it was an option for Virginia to try the same thing, though he disagreed that using zip codes would provide more illustrative information.

“Could we give data on a lower level?” Oliver said. “Sure. That could be a consideration. But I personally think zip codes don’t make a lot of sense because they don’t map across jurisdictions. And that’s how people, I think, better grasp the data.”