Your thoughts on inherent conflicts between Hipaa privacy and public health
I am obsessively reading about Covid-19, as I assume many of you are doing. My go to news sources are the NY Times and the Chicago Tribune, although there have been some good links I've found here, as well as from others.
There is one thing I have seen hinted at, but really not covered: the inherent conflicts between Hipaa privacy laws and regulations, and public health needs brought on by a pandemic. If you read coverage of how they have dealt with Covid-19 in Asia, community needs and rights almost always are placed above individual rights. What this means in practice is that as people are tested for Covid-19, if they test positive, they are often identified publicly, quarantined, fined heavily for travel, etc., etc. The idea is that by identifying and tracing all of their travel, those they were in contact with, groups they were part of, what they did, and so on, this prevents others from contracting the virus. And this has worked extremely effectively in Singapore, Taiwan, and South Korea.
In contrast, here in the US, personal privacy is valued much above the needs of the community. We are depending on the good will and voluntary cooperation of the populace with recommendations made by the government. If someone tests positive, they can still choose to travel freely, go shopping at any open establishment, be in social groups, go to dances, parties, soirees, etc., not to wear a mask, not to self-identify. We are depending on their choosing for the good of society to do the right thing. And this often fails.
A classic example was written about in the New York Times yesterday, March 23. The article was entitled
Party Zero: How a Soirée in Connecticut Became a ‘Super Spreader’
Here's the lead:
About 50 guests gathered on March 5 at a home in the stately suburb of Westport, Conn., to toast the hostess on her 40th birthday and greet old friends, including one visiting from South Africa. They shared reminiscences, a lavish buffet and, unknown to anyone, the coronavirus.
Then they scattered.
The Westport soirée — Party Zero in southwestern Connecticut and beyond — is a story of how, in the Gilded Age of money, social connectedness and air travel, a pandemic has spread at lightning speed. The partygoers — more than half of whom are now infected — left that evening for Johannesburg, New York City and other parts of Connecticut and the United States, all seeding infections on the way.
The article is fascinating, demoralizing, challenging. A very good read. The unspoken problem is that we value privacy so highly, we value the Hipaa laws, such that we are not doing what would be best for the population at large. Here's another quote from later in the article:
Officials refused to disclose the names of the hosts or any guests, citing federal and state privacy rules. Mr. Marpe posted a videotaped statement to the town website on March 20. “The fact of the matter is that this could have been any one of us, and rumor-mongering and vilification of individuals is not who we are as a civil community,” he said.
As the disease spread, many residents kept mum, worried about being ostracized by their neighbors and that their children would be kicked off coveted sports teams or miss school events.
One local woman compared going public with a Covid-19 diagnosis to “having an S.T.D.”
“I don’t think that’s a crazy comparison,” said Will Haskell, the state senator who represents Westport. He has been fielding frantic phone calls from constituents.
Most residents were exercising recommended vigilance, Mr. Haskell said, but one call that stuck out to him was from a woman awaiting test results whose entire family had been exposed to the virus. “She wanted to know whether or not to tell her friends and social network,” he said, because she was worried about “social stigma.”
I take issue with the idea that identifying those who are carriers necessarily means said individuals are vilified. Identifying them, and where they've been, merely helps individuals to know who to avoid for now, and to know if they happened to be in the same place at the same time as others who were carriers.
I'm curious where you fall on the spectrum of personal rights (privacy) and community rights (transparency and public knowledge about those infected.) You can make strong arguments for both, and our society is built on individual rights. However, we don't have a life-threatening pandemic every day. It seems to me that when we are trying to stop Covid-19, we need to realize this is a war, happening at lightning speed. That being the case, war demands setting aside "federal and state privacy rules" if this helps in stopping the virus from killing thousands and millions more. What do you think?
March 24th, 2020 at 10:39 PM ^
If it helps the community then do it. I don't really care what rules or laws it violates at this point.
March 24th, 2020 at 11:28 PM ^
Quite a slippery slope there. If they want to do that they need to formally declare martial law. If it's necessary it's necessary, but we should take care not to normalize it.
Personally, I think you can accomplish a lot of the same thing even while maintaining a level of anonymity. My work is actually asking people to sign waivers to disclose names to help track the spread, so that's another option, one most people would accept, I imagine.
TL:DR of below, people are assuming Asians don't have rights and Americans do in regards to tracing without really citing credibly info on that.
I'm suspicious that Koreans have any less rights to privacy at this point than Americans. People keep talking about HIPAA without detailing what is and what is not allowed. I haven't seen anyone mention that some HIPAA privacy rights have already been waived:
https://healthitsecurity.com/news/hhs-issues-limited-waiver-of-hipaa-sanctions-due-to-coronavirus
I haven't seen anyone actually make the case that governments aren't allowed to do anything like the contact tracing that's been done in Korea and elsewhere.
People just seem to assume there aren't any privacy rights in some of the mentioned Asian countries. I posted the link below before but Koreans are NOT being identified publicly, and frankly I'd guess they're not in Taiwan or Singapore either. Not sure what that helps with. It's worth nothing that even "Patient 31" who was the super-spreader in Korea has never named publicly. I'm not aware of her or anyone in the cult that started the spread being charged with anything illegal despite the cult being uncooperative. I did a quick google search and you'll see charges or accusations in some headlines but nothing that looks like anyone was actually charged.
It mentions gender, age range (30's, 40's), nationality, district there live in, and where they've been and when. It doesn't say your name or who you've met. I don't see how an anonymous announcement about someone's gender and rough age violates HIPAA. Maybe where people have been (again anonymously) infringes on some laws, but probably not HIPAA, and again, I haven't actually seen anyone who knows what they're talking about elaborate on this. I have read (though I can't remember where so it's possibly wrong) that in Korea the government can check your credit card records to see where you've been lately and when if you test positive. But who knows really. With the broad powers of surveillance government has been given after 9/11 regarding phone records and what not, are we sure they couldn't do that here? People may be giving this info to the government freely.
Thank you.
March 25th, 2020 at 10:46 AM ^
You raise some great points, and some good questions. I don't really disagree with you. In fact, I'm pretty sure folks in Asia are not ID'd by name. Right near the top, I say this:
There is one thing I have seen hinted at, but really not covered: the inherent conflicts between Hipaa privacy laws and regulations, and public health needs brought on by a pandemic.
What I'm saying is that I'd like to see more exploration of what can and can't be done, what should and should not be done, in terms of Hipaa and public health needs. I also am very sure that many public officials are depending on voluntary participation by the populace in terms of social distancing and quarantine. Here in Illinois, Governor Pritzger and Chicago Mayor Lori Lightfoot (UofM grad, BTW) have been quoted repeatedly and extensively on the voluntary and non-compulsory nature of the changes.
What is clear is that at least so far, many of the social distancing measures are not working. Look at the growth numbers . . . in New York, the reports in the NY Times indicate a doubling of cases every 3 days. Governor Cuomo has drastically increased the number of needed beds, and needed ventilators.
It also is clear that measures are working much better in Asia than in western Europe and the US. I would like someone with knowledge of Asia, and knowledge of Hipaa, to comment intelligently about what's going on, and what needs to change. I'd like to hear solid recommendations on ways public officials can put practices into place that really flatten the curve significantly.
March 25th, 2020 at 10:47 AM ^
Breath. Don't be scared. I heard people are downing fish tank cleanser when they get a little fever and dying. Don't panic. Our rights still matter and this isn't the plague.
March 24th, 2020 at 10:41 PM ^
It's a worldwide pandemic. When lives of others matter, eff HIPAA.
March 24th, 2020 at 11:33 PM ^
Agreed. My aunt can't work from home due to security? Idk if that's legit, I would think vpn good enough? Maybe her company just doesn't have the ability and is blaming it on that.
Right on. Down here in the South - Red State territory - it is simple, and these rules were in place before the pandemic:
The safety and health of a an employee and their coworkers outweigh the need for that employee's privacy rights under HIPAA.
Period.
March 24th, 2020 at 10:43 PM ^
It's a helluva conundrum. I lean towards your point at the end as we humans obviously can't be trusted as a whole. Too much self interest. Too much superficial judgement towards others (comparing to an STD, ffs) which leads to poor decision making.
If this thing/virus were worse, I almost wonder if we/the governemnt would go that route.
March 24th, 2020 at 10:44 PM ^
Your comments reflect the views of at least 80% of the public and a majority of either party. Moreover, we have a society that spends half the time checking in on foursquare or taking selfies in every public space, they don't see how tracing overlaps between their movements and an infected person undermines their personal rights.
That said, there will always be activists / organization such as the ACLU (or for that matter NRA) that will defend individual right over any community good. Just because those views get considerable coverage in The NY Times, Washington Post or Foxnews does not change the simple reality...the average human understands that we must occasionally accept movement on the rights/security continuum depending on how great the imminent threat.
March 24th, 2020 at 11:50 PM ^
Is your comment “Your comments reflect the views of at least 80% of the public and a majority of either party.” based on a survey/poll? It very well may be true, but it would be nice to see a source.
I’m not even sure you could find a poll showing that 80% of Americans think coronavirus is a serious problem, much less that we should give up freedoms for it.
March 24th, 2020 at 10:49 PM ^
Medical privacy is an important right. If people feel they don’t have that privacy they may avoid seeking medical care. In cases where others have been exposed there is an ability to research and notify those people in a generalized way. In cases where people are endangering the lives of others they should be prosecuted.
March 24th, 2020 at 10:59 PM ^
I completely agree with you. All of us want medical privacy. My question has to do only with what to do with Covid-19 RIGHT NOW, and trying to stop the spread of the pandemic. My suggestion would be:
- The ONLY thing that could be shared is whether you tested positive or negative for Covid-19. All other medical information should remain private.
- The only time when such information should be shared would be the time when you tested positive as a carrier. Once you healed up, and had two consecutive negative tests, you would not longer be listed as a carrier.
- The release of information would only continue until such time as the spread of the virus was finished. There is some point, perhaps once 50 or 60 or 70 percent of the population has contracted the disease, perhaps when an effective vaccine is available, when the scourge of Covid-19 would be past. At such time, there would be no need to mark anyone publicly as a carrier of the virus.
March 24th, 2020 at 11:14 PM ^
I could live with that in theory but I am sure you see the devil in the details. Proper education, proper record keeping, and proper use of the data can be a challenge. We don’t need Mgohillbilly and Darker Blue in fisticuffs because some exhausted nurse didn’t properly log one of their records stating they could be at the pub.
March 24th, 2020 at 11:22 PM ^
That would never happen. I make my own hooch.
March 24th, 2020 at 10:52 PM ^
Very thought-provoking, SRK.
But in times like these, dealing potentially with life-and-death choices because of a virus that doesn't give a damn about HIPAA laws, wealth, social status or anything else, I'm completely in favor of what's best for the community over personal privacy considerations.
Every weapon, every ounce of prevention, whatever it takes to slow down and eventually stop the spread, must be in the playbook and fully deployed.
March 24th, 2020 at 10:56 PM ^
Hey Mr. Kass, I just wanted to let you know that I appreciate you being here and trying to help your community.
You are going to be essential personal over the coming days
Please stay safe
March 24th, 2020 at 11:08 PM ^
Thanks for your kind words. I want to stay safe, but also want to help. If I got sick because I was helping others in need, it would be ok. Even if I die. I don't know whether I'm "high risk" or not . . . at age 60, no diabetes, no heart disease, no asthma, no respiratory disease, so I'm not terribly worried. For the good of society, I will do social distancing as much as possible. But if I am needed, I am willing to serve.
March 24th, 2020 at 11:17 PM ^
I love you
Hopefully your higher power is in your corner in the coming days
March 24th, 2020 at 11:43 PM ^
He is. every day.
March 24th, 2020 at 10:57 PM ^
I'm curious where you fall on the spectrum of personal rights (privacy) and community rights (transparency and public knowledge about those infected.)
I don't know. What I do know is Westport, CT is super uppity. Lots of folks commute to Manhatten and it is ranked #19 of "America's Richest Places". So, you may have to take into account who these people were and how that might have contributed to how much leeway they were given. Your run of the mill American may not have been granted the same privacy.
March 24th, 2020 at 11:03 PM ^
"They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
March 24th, 2020 at 11:08 PM ^
I get your overall point but one could argue:
liberty =/= health insurance privacy
This is a good point. Just because HIPAA is good, and whether or not things should be waived because of the virus, let's not equate it with the right to vote, right to a fair trial, etc.
March 24th, 2020 at 11:48 PM ^
I’m with you. This is a slippery slope. Can we just throw out any and all rights whenever someone claims it is for the greater good? We need to confiscate everyone’s guns because the masses would be safer. Redistribute personal wealth because the poor could use the money. Waive fair trials and just hang the accused because the rest of us would be better off if we didn’t have to deal with this long costly trial.
Can’t we use the info collected in an anonymous manner that will inform and protect the public without outing the infected person?
March 24th, 2020 at 11:23 PM ^
I think there should be a public health exception, but this actually advocates going too far, in my opinion. The individuals in the party should not be identified by name without their consent.
The information that is needed is minimum necessary to care for public health. In many cases, that information isn't being given--cases are still few where I live, but in the rare situation they are announced, we often aren't told where the people lived. At least a couple of cases across the river in Douglas county are said to have visited grocery stores, but we aren't told which ones.
We should be told which ones. People who are known to be exposed to the carriers should be informed, and people who may have been should have a chance to know. If the guests of that party were at the gym with a cough a week later, that gym should be identified by name so that people who went there can know about it.
But you don't need to tell me the name of the person.
March 24th, 2020 at 11:41 PM ^
This is partially personal for me. My wife, 68, works with low functioning special needs students from the ages of about 13 through 21 and 364 days (after which they age out.) She and all the other staff were told on March 16 that there was a fellow staff person who had been exposed to a Covid-19 carrier. With a staff of about 200, that fellow staff person really could be anyone. And I thought to myself, why is that staff person's privacy more important than the potential exposure to Covid-19 for the other 199 staff? Including my wife?
March 24th, 2020 at 11:58 PM ^
So, if I understand this correctly, your wife and others were informed of potential exposure to this person so they can now take protective measures. Why does she/you need to know who the person is? Wasn’t the infected person required to quarantine? If the infected person refuses to isolate or disclose information about whom they may have exposed, then yeah, officials should go ahead and inform those affected. If the person gets outed by default (because others can figure it out), then so be it.
March 25th, 2020 at 12:00 AM ^
They need to be told whether they were exposed, as much as that information can be produced.
If a school bus driver contracted Covid-19, the parents of the kids that rode his/her bus need to know. Anyone at the bus company who operated the same bus needs to know (might be no one, but some buses are shared). The people who sat next to the person in the break room need to know. That's simple truth.
Yes - but they don't need to know WHO.
In certain circumstances it is impossible to tell someone they’ve been exposed without it being clear “who” is the vector.
March 24th, 2020 at 11:30 PM ^
Eff the privacy rules, in my opinion. As many of our leaders have said, we’re at war. The enemy is a non-discriminate, invisible target. Let’s couple that with a delusional president that hasn’t taken this serious, older folks who don’t give a shit, and Gen-Z whom are selfish and not adherent to the rules in place. All this, is very bad. I get this quarantine is helping out exponentially. But, nothing pisses me off more when you see the younger demographics giving US the finger and not giving a damn whether they can infect others or not (see spring breakers). All the while, older people play out the “if it’s my time, it’s my time” and continue to live as if there is no pandemic. If we were to find out the people who have COVID-19 and potentially restrict/ban/fine them it would help out the defiant idiots of the US and help things move along quicker.
March 24th, 2020 at 11:40 PM ^
HIPPA? More Like LAMMA, AMMMMIIIRIIIITE!?!?!
March 24th, 2020 at 11:41 PM ^
You make a good point about the inherent tension, but I can see why people are concerned about widespread publication of one's identity if he/she is infected. This case doesn't have a ton of sympathetic individuals at first blush, but you could see a situation where a bunch of people who went to, say, an AA meeting or some other social gathering that may be somewhat embarrassing/private were the Party Zero, and now you're putting those details into the public sphere and perhaps leading to unnecessary vilification. And while the internet has a fickle memory, someone who was name-checked in an article about Covid could have that follow him/her around for years, hurting job prospects, dating options, etc.
I hate "slippery slope" as an argument because most people would agree when we've gone over the edge, but HIPAA exists to protect the rights of everyone relating to his/her medical history, and I see the resistance to giving up that protection even for "the greater good".
March 24th, 2020 at 11:44 PM ^
They started eliminating individual rights in Germany once too.
March 24th, 2020 at 11:56 PM ^
Why'd they do that?
First they came for HIPAA and I said nothing.
March 25th, 2020 at 10:35 AM ^
People shouldn’t be so quick to demand that ANY individual right is voided. For example the Patriot Acts were put in place by the bush administration based on the fear of a real terroist attack after 9/11 they still exist, anything done on an emergency basis will endure in my opinion.
March 25th, 2020 at 12:00 AM ^
31 years ago, I spent 6 months as a visiting graduate student in South Korea. Among other things, I studied Asian thought forms at Yonsei University in Seoul. I learned just enough about Confucianism, Daoism, Buddhism, Shamanism, Animism, and Pantheism to understand how little I knew. To this day, it would be beyond me to try to comment intelligently on any of these ways of thinking, on these different ways of viewing and understanding the world.
However, the one thing that stuck with me from my time in South Korea was the high value of "community." This wasn't just something I learned about: it was something I lived. At least back in 1990, there was a sense that South Korea was one very large extended family. When you think of society, even a country, as a large family, it is a radically different world view. If you are related to everyone else, you have a different sense and feeling of your responsibility towards everyone else.
As a Christian, then studying to become a pastor, this really changed my view and understanding of Christianity. I realized that Palestine and Israel and the Middle East, both 4,000 and 2,000 years ago and today, are all much more of an Eastern "Community" based culture than is the west. I realized that I had read the Bible through Western eyes. I had interpreted theology often in terms of the individual, and not the community. (For those of you who read the Bible, pay attention to how often it talks in the language of "community" and "family" and "relationship" and "people" and "nation" rather than in terms of the individual.) While I certainly am not Korean, I greatly admired and appreciated their view of the importance of community, and it changed me for life.
In an odd way, mgoblog is a community, a sub-community of the "community" of the University of Michigan. And you see glimpses of this when you hear administrators and others who are referring to U of M talk about the "Michigan family." I'm proud and happy and thankful to be part of the mgoblog and U of M family, even with their quirks and annoyances.
As regards Covid-19, I definitely fall in the position of thinking we need to act for the good of the community at large, for the world community, for our local communities. This means that individual sacrifices have to be made, for the good of the whole. (And without going full theological on you, isn't that the whole point of what Jesus Christ did? Sacrifice himself for the good of everyone else?) I just thought it was only fair for me to explain my own position further, and to practice personal transparency.
Technically, not everyone else (unless you’re a Universalist). Eph 1 and Romans 9, etc. But overall, your theological point is well made, and generally missing in much of our dialogue.
I don't mean this to criticize because what you wrote is true and well-said, but I think that's a bit of an outdated view of Korea. For example, Koreans almost NEVER cross the street when the light is red. It's midnight, no cars in sight. No crossing. And you might see that and think, "Oh, they follow the rules." But my Korean-American friend's Korean mom came to visit after having been gone for I think 20 years he said. She was surprised to see that no one would jaywalk! She said people used to jaywalk all the time. Curious what you saw 30 years ago. Anytime someone asks me about what it's like in Korea or how Koreans are I feel like I need to differentiate between older and younger generations.
Also important to note Korea has changed so much in 30 years, as I'm sure you have at least seen photos of Korea today. It was literally like the 1st or 2nd poorest country in the world after the Korean War, which wasn't that long ago. Apgujeong is a super-rich neighborhood and the mecca of plastic surgery in Korea (and therefore the world really). I went to a Seoul city museum and there's a picture from literally only 30 or 40 years ago that shows a farmer using an ox to till his land. It's mind-blowing. People can find before and after photos of Seoul online.
South Korea now actually has the highest rate of poverty among the elderly in the OECD. It used to be really bad in America actually, until Social Security got passed. There's really not much of a social safety net in Korea though yet and there needs to be because a lot of those familial/community ties just aren't there anymore in a giant, super modern metropolis.
Although a democracy and free society, Korea's good response is in part due to the fact that local governments really don't have much power. This was an interesting tidbit I learned
March 25th, 2020 at 10:29 AM ^
IMO, you have a point but it remains a weak one. There is a significant difference between us and them when it comes to this matter. I have not been to Korea but my experience from other cultures from the area informs me that their value of community rights/needs over individual rights/needs is very likely similar to what I know...and it is very different from "ours".
There’s a difference in acting for the greater good and giving out private information...if people want to share what there medical diagnosis is then so be it. People that don’t shouldn’t be shamed which is a process increasingly weaponized by our current society.
March 25th, 2020 at 12:02 AM ^
Sounds like Brave New World soon with a toucn of Big "Data" Brother added in.
March 25th, 2020 at 12:04 AM ^
anyone who is test positive or under high risk should voluntarily tell the public, as many already did. And anyone who violates the mandated quarantine should be charged if breaks the quarantine. There is no excuse to knowingly put other people in danger. Anyone who chooses to go public should also receive priority for ventilators or drugs over those who chose not to,
March 25th, 2020 at 12:05 AM ^
I may be missing the point, but in any state with extreme social distancing rules in place, what would this information change?
March 25th, 2020 at 12:12 AM ^
I live in Illinois, which has had "shelter-in-place" since Saturday. However, everything is voluntary. Several hours ago, while walking in the park with my wife, I saw a bunch of people playing hoops. I saw a half dozen girls walking together. Some of the local grocery stores have had block long lines, with very questionable social distancing. It is patently obvious that many people are not following government directives for the good of society. We have extreme social distancing rules in place, and it doesn't matter.
I would absolutely love if there was an app that beeped whenever you were within 50 feet of a Covid-19 carrier. I wouldn't need to know the name, or the address, or anything else. Just knowing there was a carrier nearby would change my behavior.
March 25th, 2020 at 12:37 AM ^
I guess my point is, in the example you provided about your wife, if your wife, how would knowing the name if the person change anything for her? At this point, I’m already pretty much assuming anyone I might come in to contact with in my very limited excursions outside has the virus. Would your wife be self quarantining because she’d been exposed to someone who was exposed to the virus?
in the example you gave in response to my post, you should assume everyone is a carrier. Most people who have it at this point haven’t been tested and don’t know they are carriers themselves.
Right now, it appears a moot point, as regards my wife. It has been 8 days since the potential contact. My understanding of the incubation period is such that if she had it, we would be seeing symptoms by now.
However, in a special needs school setting, you can come into contact with many different staff people throughout the day. This is even more true for my wife, who is a floater aide. She generally is assigned to one classroom for a day, but on occasion, she has been in 3 different classrooms, each with 3 - 5 staff persons, in one day. And even when assigned to one room, you usually aren't just in one classroom . . . you are in the gym, and on the playground. You are in the washroom, changing the diaper of a 20 year old student. You are helping students get on and off the bus, and buckled into a harness. You are maneuvering students in their wheelchairs. And if a special needs student decides to pull all their clothes off, or have a tantrum, or refuse to come out of the toilet stall, well, more than one staff person has to get involved. And you aren't maintaining a 6 feet social distance buffer.
We all are afraid, and rightly so. I officiated at a small funeral on March 12, right before everything blew up. The funeral luncheon happened to be at a trough restaurant named the "Golden Corral." After I had gotten my food, using endless ladles and spoons and tongs, it struck me: whose hands had shared these utensils? And I shuddered, and washed my hands, and didn't use them to handle any food.