With Maryland’s nursing homes at the epicenter of the Covid-19 outbreak, it is understandable that the public is clamoring for information about the pandemic’s impact on loved ones who live or work at these facilities.

But even the most basic information that state and county officials collect from nursing homes is now under quarantine by the Maryland Department of Health.

An MDH spokesman told The Brew last week that the agency “cannot release a detailed list of nursing homes and other long-term care facilities affected by Covid-19 due to HIPAA [the Health Insurance Portability and Accountability Act] and state laws surrounding confidentiality.”

The same rationale of privacy is echoed by Governor Larry Hogan’s office.

In my opinion, their position is wrong. Even assuming that there is ambiguity in the law, there is every reason for state and local authorities to come down on the side of keeping citizens informed.

People, especially those with relatives at these facilities, are frightened. Keeping them in the dark fans the flames of fear and creates mistrust of public health officials – the very last thing that we need in these difficult times.

Last night, the Centers for Medicare and Medicaid Services announced upcoming requirements for nursing homes to inform residents, their families and representatives when residents or staff contract the illness. But, critically, CMS did not indicate when those requirements will take place.

Many individual states already mandate that much transparency or more; Maryland must, too.

Ground Zero

Housing about 100,000 people, Maryland’s nursing homes and assisted living facilities have become ground zero for the pandemic.

They are where the main battle with Covid-19 will be won or lost. The mortality rate from the virus among elderly and other medically vulnerable residents is much higher at these facilities than for the general population, as demonstrated by the tragedy at the Pleasant View nursing home in Carroll County.

The first case of a resident with Covid-19 at Pleasant View was confirmed on March 26. Less than a week later, 70 of the 95 residents had tested positive for the virus and five were dead.

By last week, the number of deaths had risen to 18. In other words, one in five residents were dead within three weeks.

Given these rates of infection, no wonder there are rising concerns about how well private nursing homes are protecting residents and staff.

Last week FutureCare’s Lochearn home confirmed that 129 of the 200 residents – as well as 41 staff – had tested positive, representing an even bigger outbreak than at Pleasant View.

So far, we have no information from health authorities about how many residents may have died as a result of the virus.

We Need to do Better

Given these rates of infection, no wonder there are rising concerns about how well private nursing homes are managing their facilities and protecting residents and staff.

I know Robert Neall, secretary of MDH, and Frances Phillips, the deputy secretary for public health services, personally. There are not two more conscientious or competent public servants in Maryland, and we are fortunate to have them at the helm during this emergency.

I know from working with them in the past that both respect the importance of transparency in government. So I am going to blame their agency’s reticence to release nursing home information on overly cautious lawyers.

What HIPAA Says

Neither federal nor state law precludes MDH from reporting the number of residents tested and the number of confirmed coronavirus cases and deaths at each nursing facility in Maryland.

The privacy rule of HIPAA generally prohibits health care providers and related entities from disclosing “individually identifiable health information,” known as “PHI” (protected health information).

No one is proposing that health departments release information that includes the names of individuals who have come down with Covid-19, but the law also prohibits the release of information “for which there is a reasonable basis to believe [the information] can be used to identify the individual.”

HIPAA is intended to protect the privacy of individuals, not to protect health care providers from having to disclose such things as infection and mortality rates

Even if a person somehow could obtain a list of the names of the residents of a nursing home, he or she would be unable to identify the individuals with the virus based on the knowledge that a certain percentage of residents had tested positive.

Genesis, the country’s largest nursing home operator, has been releasing the number of coronavirus cases found at some of its Maryland locations.

Trust me, the company’s lawyers understand HIPAA well, and I highly doubt it would be revealing the information if the lawyers believed that doing so would result in fines and lawsuits.

For these reasons, I believe that the state can identify and provide details about a Covid-19 outbreak without violating HIPAA.

But even if I am wrong, that still would not mean that a public health authority also would be precluded from doing so.

A Broad Mandate

HIPAA recognizes the special role and broad mandate of public health authorities, especially during public health emergencies. Consequently, health care providers and other “covered entities” may disclose PHI to public health authorities to assist them in carrying out their role and fulfilling their mandate.

As the public health authority for the state, the Maryland Department of Health collects PHI from nursing homes and other long-term care facilities on residents tested for and diagnosed with Covid-19.

Once PHI is disclosed to a public health authority, the maintenance, use, and disclosure of the information is governed by state law and policies adopted by the public health authority.

There is nothing in Maryland law prohibiting the health department from making the type of disclosure being proposed. As it happens, there also is nothing that expressly permits it, and that is part of the problem.

In fairness to MDH, public health agencies across the country are struggling with this issue.

As of last Tuesday, The Brew found that 19 states were reporting facility-specific information, including Connecticut, Louisiana, Oregon, Texas and Washington. That left over 30 states not reporting.

In recent days, that situation has changed.

By Friday, three new states with significant coronavirus outbreaks – Ohio, Michigan and New York – were posting the identity of nursing homes with Covid cases. On Sunday, Illinois started doing the same.

Getting in Step

The Hogan administration should follow their footsteps.

At minimum, MDH needs to publicly report the number of tests performed, the number of positive tests, and the number of deaths from Covid-19 at each nursing home in the state. This data should be updated daily.

Such a policy would not be based on idle curiosity. It would be based on a balance between the privacy interests of individuals and the right of current and prospective residents, family members and staff to judge for themselves the safety of these facilities and the effectiveness of the government agencies that regulate them.

The policy would strengthen the trust and confidence that Governor Hogan has so far earned for his proactive response to the pandemic. Such trust and confidence will be indispensable in the weeks and months ahead.
____________________

– David A. Plymyer retired as Anne Arundel County Attorney in 2014 after 31 years in the law office. He also served as a prosecutor in the Anne Arundel County State’s Attorney Office.