Narrow restriction of local information about confirmed cases of COVID-19 begs the question: What is the appropriate balance between protecting an individual’s identity and the public’s right to information during a public health crisis?

The Georgia Department of Public Health — like many state health departments — provides daily updates on confirmed COVID cases, broken down by county. While these numbers and how they change over time are informative, Georgians are eager to know more, specifically how the coronavirus is manifesting in their communities.

Yet the department, citing privacy concerns, has declined to release details, such as cities within a particular county where cases have been confirmed or locations where people who tested positive have been. News outlets around the state have documented the department’s restrictions on release of this information.

Local health care providers in some areas, such as Augusta and Albany, have filled the gap by providing more localized COVID numbers. But this level of data is not available for most of the state, making it difficult for municipal officials and the public to ascribe meaning to the state-reported county numbers.

This tension between preservation of privacy interests on the one hand, and a call for greater transparency on the other, is playing out around the country. In Massachusetts, some municipalities are releasing specific numbers about COVID cases and deaths within their boundaries, citing the need to keep the public informed. Other municipalities, however, are providing only the county-based statistics from the state.

In Oklahoma, local government officials and citizens have been frustrated by the state’s refusal to provide more specific, yet still non-identifying, information about COVID cases. Such information, they say, would help them to make more informed personal and public health decisions.

Meanwhile, South Carolina’s Department of Public Health and Environmental Control has taken an additional step toward transparency by releasing COVID cases by ZIP code. 

Georgia public health officials are encouraging people to assume they could come into contact with someone infected with COVID at any time, and to take precautions accordingly. It would be far more impactful if people truly understood the virus’ proximity and escalation.

For instance, knowing that a certain number of people in your town have tested positive for COVID or that someone from your workplace, your child’s school or the elder care facility where your parent lives has far greater meaning than simply knowing that X number of people somewhere in your county tested positive. Localized information is also more persuasive. When people understand how the disease is spreading in their town, they are more likely to take precautions.  

And here’s the nub of it: Disclosure of the location or affiliation of people who have tested positive for COVID is — in most situations — not sufficient to make them reasonably identifiable. Certainly, disclosing the number of confirmed COVID cases in a city does not identify anyone. Even information that narrows possible candidates to 1,000, 500 or even 50 people does not identify any single individual. State health officials are taking greater precautions than are actually necessary to achieve reasonable medical privacy. 

Moreover, the federal law restricting release of medical information — the Health Insurance Portability and Accountability Act, or HIPAA — recognizes that privacy interests are not absolute in a public health crisis. A March bulletin from the U.S. Department of Health and Human Services states individual health information can be disclosed “to anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of … the public.”

This is echoed by the Georgia Department of Public Health’s Notice of Privacy Policies: “We may disclose your health information for public health activities which include: preventing or controlling disease … .”  

A recalibration of privacy vs. access is therefore in order. Yes, it is important not to publicly out individuals who have tested positive for COVID without their consent. But the Georgia Health Department and municipalities can avoid that while still providing localized data that empowers the public to make informed and rational choices.

Withholding this kind of potentially life-saving information goes beyond reasonably protecting privacy and, instead, fosters anxiety and public mistrust of health institutions.

Clare Norins is a First Amendment attorney and a member of the board of directors of the Georgia First Amendment Foundation, which has been actively pushing for open government and transparency amid the COVID-19 coronavirus crisis.