Personal privacy matters during a pandemic - but less than it might at other times

During a disease outbreak, one of the best tools at the disposal of public health officials is low-tech detective work. When a person is diagnosed with an illness like COVID-19, the disease caused by the novel coronavirus, public health experts figure out where they've recently been and track down everyone they've been in contact with.

"Sometimes it requires we know private information about a person who has been infected," says Lisa Lee, director of the division of Scholarly Integrity and Research Compliance at Virginia Tech and former executive director of the Obama administration's Presidential Bioethics Commission.

It also can mean that they have to share some of that information, including information about someone's health. Usually, people think about health privacy in terms of the relationship they have with their doctors and clinicians who have to keep the vast majority of information confidential - both legally and ethically. But the public health system is set up with different legal permissions and protections than a doctor's office, and by nature, it thinks about ethics and patient privacy differently.

"We think about it from the perspective of the mutual obligations we have towards each other and the need to protect well being," says Amy Fairchild, dean and professor in the college of public health at Ohio State University. "What you're doing is weighing the risks to the individual against the harm to the person's contacts and the rest of the population."

The public health system is set up with different legal permissions and protections than a doctor's office

Legally, there are carve-outs in health privacy laws like HIPAA that allow public health officials to get information about a person's health without their consent. Individual privacy and the risks that can come from the disclosure of personal health information - like stigma - are still critical concerns for public health officials, Lee stresses. They aim to collect the minimum amount of information possible to achieve a public health goal. "The principle is to collect and use the least amount of data possible, because it reduces harm," she says. The information collected is also used only for public health activities.

The balance between protecting individual privacy and collecting information that is critical to the public good changes over the course of a disease's spread. The amount of data public health officials need to collect and disclose changes as well. Right now, the COVID-19 pandemic is accelerating, and there is still a lot doctors and scientists don't know about the disease. Collecting detailed health information is, therefore, more useful and important. That could change as the outbreak progresses, Lee says.

For example, as the virus starts to circulate in the community, it might not be as important to know exactly where a sick person has been. If the virus is everywhere already, that information won't have as much additional benefit to the community. "It depends a lot on the maturity of an epidemic," she says.

Digital tracking information is ubiquitous today, and that can make data collection easier. In Singapore, where there's extensive surveillance, publicly available data details where people with confirmed cases of COVID-19 are and have been. The Iranian government built an app for people to check their symptoms that also included a geo-tracking feature. When deciding to use those types of tools, Lee says, the same public health principles should still apply.

"Should a public health official know where a person has gone, should that be public information - it's not different. It's a lot easier to do that now, but it doesn't make it any more right or less right," she says. "Tracking where people go and who they interact with is something public health officials have been doing for centuries. It's just easier with digital information."

In addition, just because personal information about a person and their health is important to a public health official, it doesn't mean that information is important for the general public. It's why, despite questioning from reporters, public health officials only gave out a limited amount of information on the people who had the first few cases of COVID-19 in the US.

During the polio epidemic in the US, health departments used to publish the names of people with confirmed cases of the illness in the newspapers - a practice that would be far out of bounds today. But that didn't stop people in the US from trying to find out information about the few cases of Ebola in the country during the 2014 outbreak.

People didn't need that information to protect themselves, though. "Having someone's name doesn't protect you," Fairchild says. "That's generally the principle of public health surveillance. There are emotional reasons that the public may want to know - but it doesn't protect you, and shouldn't change what you're doing."

"Having someone's name doesn't protect you."

Health officials worry about the stigmatization of individuals or communities affected by diseases, which is why they aim to disclose only necessary information to the public. Anti-Asian racism in the US and other countries around the world spiked with the outbreak because the novel coronavirus originated in China. People who were on cruise ships with positive cases reported fielding angry phone calls from strangers when they returned home, and residents of New Rochelle, New York, which is the first containment zone in the US, said that they're worried about their hometown being forever associated with the virus.

"This kind of group-level harm is concerning," Lee says. "That's why we worry about group identity privacy, as well. I'm nervous and sad to see that starting to poke its head out."

People can't expect the same level of personal health privacy during public health emergencies involving infectious diseases as they can in other elements of their health. But the actions public health officials can take, like collecting information, aren't designed to limit privacy, Fairchild says. "It's to protect the broader population. The principle we embrace is the principle of reciprocity. We recognize that our liberty is limited, but we are doing that for others."