Since announcing the first cases of COVID-19 in Maryland, Gov. Larry Hogan’s administration has touted its transparency, going as far as to write the word in all caps on Twitter.
When the governor announced Maryland’s first cases on March 5, he revealed the first three cases were all Montgomery County residents, even giving details about their travel history.
From then on, cases would be announced by county, with details such as gender, race and age range. If there needed to be more details, like a place of public exposure, local health departments would announce it.
“COVID-19 is a new disease and this is a rapidly changing situation; Maryland is reporting certain information regarding confirmed cases — including age range, county, gender and potential for close public contact — as part of a containment strategy to prevent COVID-19 from becoming more widespread in our state,” Maureen Regan, deputy director of integrated media with the Maryland Health Department, said in an email on March 12.
While the governor’s strategy for COVID-19 is releasing large amounts of data, the state does not allow the same level of transparency for diseases that sicken thousands of Maryland residents every year.
For example, anyone can know how many COVID-19 cases there are in Frederick County. They can also learn how many cases of gonorrhea or chlamydia are in the county. But if someone tries to determine the number of cases in each county of influenza this flu season — a disease that has sickened nearly 44,000 Marylanders and killed 63 as of May 2 — it is nearly impossible to find out.
When asked for flu data by county, spokespeople for the department say the information cannot be released due to privacy concerns.
When it comes to transparency from the Maryland Department of Health, releasing information about an infectious disease by county, gender, age range, even ZIP code is the exception, not the norm.
Why the health department can release totals by county for one disease but not another makes little sense to Rebecca Snyder, executive director of the Maryland, Delaware, D.C. Press Association.
“That just doesn't pass the smell test,” she said.
What disease warrants privacy concerns
The Maryland Department of Health denied a Frederick News Post public information act request for flu data by county, citing the federal Health Insurance Portability and Accountability Act of 1996, more commonly referred to by its acronym HIPAA.
HIPAA prevents the sharing of personally identifiable health information, Regan said. Flu surveillance reporting could increase the potential for identifying patients because of the method the health department uses to collect and provide information.
“In a single flu season, there may be thousands of cases, and at certain points in the season activity may be reported as ‘high’ or ‘widespread’ statewide — but in counties where there is less population density, for example, there may be greater potential to identify a patient based on surveillance sources or information collected/provided,” Regan said in an email.
Yet, the smallest Maryland county is Kent County, which has roughly 22,000 residents, according to census population predictions.
It is not clear if the Maryland Department of Health is bound by HIPAA, although the agency said it does due to patient confidentiality. Further questions were referred to the Office of the Attorney General, which declined to comment.
Some organizations that work with personal information fall under HIPAA, others do not, depending on what services it provides. For example, Frederick Health Hospital is considered a HIPAA covered entity and cannot distribute patient data. The Frederick County Sheriff’s Office, for instance, which can release information on opioid overdoses, is not.
Even if the Maryland Department of Health must follow HIPAA, it is still able to provide personal health information if identifiers, such as age, gender, race, or in the case of flu data, geographic information, are removed.
According to the U.S. Department of Health and Human Services, a geographic subdivision smaller than a state, including county, can be a piece of identifying information. The state will only release information on influenza by state. This includes a summary of the season that the state health department publishes once the flu season ends around May.
However, the data can be released using the first three digits of a ZIP code, if there are more than 20,000 people in the area formed by all the ZIP codes that use the first three digits, according to the Department of Health and Human Services.
For Frederick County, the first three digits would be 217, which would include some areas in other counties. The Maryland Department of Health denied a request for flu data grouped together by the first three numerals of ZIP codes.
“We don't report flu cases by ZIP code; like weekly reports, summaries reflect statewide surveillance data,” Gischlar said in an April 17 email.
Data could also be released through the expert determination method, which allows data to be released if someone using statistical and scientific principles and methods determines the risk is “very small” that the information could be used alone or with other available information to identify the person in the information, according to HHS.
Other states release information on the flu by county.
Ohio, for instance, releases information about pediatric flu deaths, including the county, sex and age. A 16-year-old girl died in Cuyahoga County, which is where Cleveland is located. The second pediatric death was an 11-year-old girl in Lake County, according to The News Democrat. Lake County is smaller in population than Frederick County.
While Ohio does not list counts by county, it does list flu hospitalizations.
Pennsylvania releases the number of cases per county, by type A and type B strains of the flu.
Pennsylvania releases flu counts by county but not flu deaths, Pennsylvania Department of Health Press Secretary Nate Wardle said in an email. Flu data is updated weekly.
“We release this information to help the public make informed decisions during flu season. For many people, the flu may be a nuisance but for others, it can be a more serious illness, and potentially life-threatening,” Wardle said in his email. “We want the public to know where flu is circulating and to be able to protect themselves.”
Releasing county-level information, at least to county health departments, could be helpful because a person's health is affected by where a person lives, said Dr. Randall Culpepper, deputy health officer for the Frederick County Health Department.
"It would allow us to identify areas of our community that are experiencing disparities and give us the opportunity to address some of the barriers to care," Culpepper said in an email. "We also want to continue to gather data for our county residents that includes demographics like race and ethnicity so that we can identify and eliminate racial disparities so that all of our residents have the opportunity to experience their best possible health."
But there are times HIPAA-protected information can be released, especially during a pandemic. HIPAA allows a covered entity to alert someone to potential exposure. That is what is currently done with COVID-19 and contact tracing. If a person may have been exposed to someone with COVID-19, the health department can alert the person.
The state is even releasing COVID-19 cases by nursing homes, which Hogan said could infringe on patient privacy.
“If you say there's an outbreak here, people will find out who is there and there are concerns of legal issues and privacy concerns of the patients,” Hogan said during a press conference April 29. “I overrode all of that and said because of the patients and the family members who have a right to know. There is some argument internally of whether that is right or not.”
What information does HIPPA protect?
While HIPAA does not require the disclosure of much information, it does permit “a lot of things,” said Kirk Nahra, partner at WilmerHale and adjunct professor at American University’s Washington College of Law.
“And I don't know why they wouldn't be permitted to make that disclosure,” he said, referencing flu data.
If a hospital, which is covered by HIPPA, said it treated 1,000 patients for the flu, it would be hard to identify who those patients were, Nahra said. But if the hospital said seven of those 1,000 patients live on this street in Frederick, then it would be different.
“If the hospital said we treated 700 patients yesterday for COVID symptoms or flu symptoms, I don't know how that's HIPAA protected information,” Nahra said.
Even saying a woman in her 50s has the flu would likely not be enough information to reveal the identity, he said, because there are likely thousands of people in the county who meet that description.
“Is the standard I'm the best computer detective in the history of the world? And I am the only person that could figure it out? Is it that standard? No,” Nahra said. “But again, if a thoughtful, dedicated reporter could figure it out, then it's too identifiable.”
There is the math side of determining what is identifiable information, Nahra said. Then there is the reality check side of it.
"But you also see all kinds of other situations where it is used as essentially an excuse," Nahra said. "And sometimes the excuse is because somebody is cautious. Sometimes it's because they don't understand. And sometimes it's because they don't want to tell you."
The health department cited two other reasons for denying flu data — a Maryland law protecting patient privacy and one that allows the secretary of health to determine what statistics the health department will release.
It is unclear how Secretary of Health Robert Neall makes the decision on what statistics should be released. He did not answer questions about statistics, the flu or the department’s transparency.
Michael Ricci, spokesman for Gov. Hogan, referred a question about the Maryland Department of Health and flu information to the health department.
COVID-19 vs. influenza
While COVID-19 and influenza are both reported to the Maryland Department of Health, they are very different diseases.
The flu and COVID-19 are caused by two different viruses. The flu is caused by multiple strains of the influenza virus, categorized by type A and type B.
During the 2019-2020 flu season, the main strains of the flu were Type B Victoria, which was predominant during the first part of the flu season and the H1 strain, which accounted for 56 percent of cases tested by the Maryland public health laboratory, as of April 11. The flu sickened more than 40,000 people in the state, but it is not considered an outbreak, Gischlar said, pointing to the CDC.
COVID-19 is caused by SARS-CoV-2, a new coronavirus first discovered in December 2019 in China. The mortality rate of COVID-19 is not yet known, but early estimates put it at least 10-times more deadly than the flu. It is also more contagious than the flu. The virus is considered widespread in Maryland. All counties are reporting cases, and confirmed cases have now topped 30,000 with deaths exceeding 1,400.
When COVID-19 first appeared in the United States, even during the first reports of the disease in the state, health department officials stressed flu was a bigger concern for residents. That has since changed.
Adam Marshall, communications attorney at the Reporter’s Committee for Freedom of the Press, said the inconsistency is confusing.
“I would think you would have to ask [the Maryland Department of Health] why it's different,” Marshall said. “But I can tell you that doesn't make much sense to me.”
The health department did not respond to a question of how the release of flu information by county violates privacy but releasing COVID-19 does not.
COVID-19 is not the only condition that the health department does publicly report by county. The health department’s website offers a list of diseases with the number of cases broken down by county
According to the list, 131 people in Frederick County have gonorrhea and 844 have chlamydia. There were 111 people who had Lyme disease.
The list also includes conditions where only a couple residents have it, such as Shigellosis, which is caused by bacteria and can cause a fever and gastrointestinal upset. Only two people in the county have it.
There is one type of influenza on the list, Influenza Novel A Virus Infection. That would cover cases caused by avian or swine flus, such as the previous H1N1 pandemic. There were no cases in 2018.
The conditions on the list are all notifiable conditions, as defined by the CDC. That is different from reportable conditions. The difference is what must be reported to the CDC versus what can be publicly released.
For example, pediatric flu deaths are reportable conditions, but they are not notifiable, meaning the health department does not need to publicly say how many pediatric flu deaths are in Frederick County.
Instead, pediatric flu deaths are only reported statewide.
Reportable conditions and diseases are those that a health care provider, laboratory or hospital must report to state and local jurisdictions, according to the CDC.
So if a patient had Lyme disease or if a pediatric patient died from the flu, the health care provider must report it to the CDC.
Reporting notifiable conditions to the CDC are voluntary. Notifiable conditions are those where frequent information about individual cases can help with prevention and control, according to the health organization.
Not every national notifiable disease must be reported, according to the CDC. And not every reportable condition is notifiable, like pediatric flu deaths.
But while they do not have to, all 50 states inform the CDC about national notifiable diseases that are reportable in their jurisdictions, according to the health organization.
The list of notifiable conditions is updated periodically. Some conditions are removed if surveillance is not helpful, according to the CDC.
“Conditions are added to the list as emerging pathogens, environmental hazards, or conditions emerge as public health concerns,” according to the health organization’s site.
COVID-19 was added as a national notifiable disease.
“COVID-19 is an unprecedented health event,” Gischlar said in an email. “State law requires the reporting of outbreaks of infectious diseases like COVID-19 and protects the confidentiality of those reports as well as all information collected in connection with a report from a health care provider, the subject of the report, or other individuals who might be affected by the condition or disease in the report.”
And the flu is not the only disease the state department denies the release of information. The state also previously would not release the number of adenovirus cases in Frederick County, following an outbreak in 2019 at University of Maryland.
Gischlar did not respond to a question about why notifiable conditions, even those with few cases, did not violate privacy laws but releasing flu counts did.
But Maryland is not alone in not releasing flu data by county. Virginia does not either, although the state releases some information by regions.
One of the reasons Virginia’s health department does not release flu counts by state is that it does not count individual flu cases, said Em Stephens, a respiratory disease coordinator with the Virginia Department of Health.
The department does not collect flu cases for two reasons, Stephens said in an email. First, not everyone gets tested, even when they feel sick. Second, the rapid flu tests are not accurate enough for public health and are not considered to be confirmatory tests in Virginia.
Instead, Stephens said, the department looks at medical visits related to flu, deaths and laboratory-conducted tests to determine a flu season’s severity, intensity, timing and effectiveness of the vaccine.
“We provide some of these data at the regional level, but not below, as we do not believe there's additional benefit in a more granular approach,” she said in an email.
The effects of non-disclosure
The lack of flu information just does not make sense, especially since the state released COVID-19 information when there were many fewer cases of COVID-19 than the flu, Snyder, with the MDDC Press Association, said.
The lack of data can have real effects, Snyder said. Without information suggesting that the flu exists in the county, a person might underestimate the risks of the flu. While the flu is much less contagious and deadly than COVID-19, it is an annual disease that affected at least 40,000 people this year and killed more than 60 people in Maryland.
In 2019 and 2020, before the first cases of COVID-19, it was impossible to determine how many cases of the flu were in Frederick County.
The flu season in Maryland reportedly started earlier than usual, in November. But that might not have been the case in Frederick County. Without county-specific data, a person cannot tell if the flu is trending up or down, Snyder said, adding that she did not understand why information that could have a health impact was considered “top secret.”
“You can't accurately report,” Snyder said. “I mean, what the media is doing and also the health department should be doing is putting out real credible information so that people can feel like they have a trusted source to turn to. And in the absence of anyone providing reliable, factually accurate information, people make up their own stuff. And you get into catastrophic thinking and panic situations.”
COVID-19 transparency concerns
While the health department has been more transparent with COVID-19 than other diseases, in some cases after directions from Hogan, there are still lapses in transparency.
In March, the department stopped reporting the number of pending tests, due to private laboratories conducting the test. The department has mandated that private labs report the number of pending tests once a week, although that number is not publicly released.
But without more information on tests, it is hard to determine the rate of positive cases, Snyder said. The state now has 30,485 positive cases of COVID-19 and 121,702 negative tests, as of 10 a.m. Friday. But it is not clear if the number of negative test results include tests given to the same person.
Without the total number of people tested, it is impossible to say what percentage of people tested received a positive result.
“So when you're leaving out the number of people being tested with all the discussion around how many test kits are available and what's happening with testing and it is really, I think, in some ways under reporting or minimizing what's happening with the response to the outbreak,” Snyder said.
The health department’s COVID-19 response wavers in transparency. Hogan demanded the state release information like race and the number of cases, by nursing home, in staff and residents, following repeated media requests. But the state has also ignored questions about the disease.
Gischlar did not answer a question asking how COVID-19 data will be collected once the pandemic ends.
Whether the transparency surrounding the disease, with the daily updates from the state, continues once the pandemic ends is unknown.
Similar to at least 15 other questions related to transparency, Maryland Department of Health did not answer.