I think it's safe to say the COVID-19 pandemic has hit close to home for all of us. Many of you are likely balancing video conference calls for work with your children's schooling. (I don't have kids and haven't the foggiest idea how the heck you're managing all that at the same time. Hang in there and kudos to you!)
What was once a simple trip to the grocery store is now an anxiety-filled mission replete with strategically placed protective wear: face mask, gloves, sanitizers, and the like. Do you wash your fruit and vegetables when you get home? What about all the packaging? Is it safe to touch? Remember: wash your hands and don't touch your face!
And of course, we're all worried about our families and friends, especially those who are most vulnerable. For me, it's my parents and those close to me in life who are health care and other essential workers (my wife is an ER nurse). It's truly panic inducing.
But another issue has hit close to home for me this week, and it's one I thought I'd explore today. Kittery, my place of residence, was the first town in the state of Maine to ask Gov. Janet Mills and the Maine Center for Disease Control and Prevention for the addresses of people who have tested positive for the coronavirus, so that first responders can be properly prepared responding to an emergency call.
According to Maine state law, "public health information released to the public, media or other agencies may not contain potentially identifying information about the patient. The Maine CDC identifies people who have tested positive for COVID-19 only by gender, age range and their county of residence," the Portland Press Herald reports. The practice mirrors the federal Health Insurance Portability and Accountability Act.
In her letter to the state, Kittery Town Manager Kendra Amaral contends that information by county increases the risk to emergency responders. She writes, "Our public safety teams are already required to handle vast amounts of private and protected information in the performance of their work. Kittery is staffed lean, and the availability of public safety staff including Police, Fire, and Public Safety Dispatches is limited. An undetected exposure to COVID-19 among our public safety team could have devastating effects on our ability to properly staff and support our community during this emergency."
Also, keep in mind, personal protective equipment is in short supply in the area, just like much of the rest of the nation.
The next day, just over the mighty Piscataqua River, the neighboring Portsmouth, NH, announced it was doing that very thing. Portsmouth Police Chief Robert Merner said E-911 headquarters will relay the data to first responders who are dispatched to an address of a person who has tested positive. That means the first responder knows to wear an N95 mask with other PPE gear. Otherwise, the first responder will wear a surgical mask while asking the the folks at home to also wear masks and keep six feet away.
The distinction is worth considering. Think about an emergency case where a person is, say, having a heart attack or stroke. Time is of the essence. Minutes and seconds count in saving that person's life. It takes time to put on that PPE gear, so if the household isn't a positive case, then minutes could be saved by not having to don that PPE garb. On the other hand, health care workers tend to assume everyone has COVID-19, so shouldn't the same apply here? It is a double-edged sword.
First responders are literally on the front lines, putting their lives on the line to help save lives and protect their communities. We've seen countless incidents where massive swaths of staff — police, health care, and other essential service workers — come down with the virus. We can't afford to have that happen.
Reading the comments to the Portsmouth Press Herald's Facebook post about the addresses is like going down a rabbit hole of misinformation. I didn't know the general populace were such HIPAA experts! Many are outraged at the privacy violations. How dare the town do such a thing!
Some, however, point out that people can be asymptomatic, so why wouldn't first responders just assume everyone has it and wear the gear? Well, the gear, just like the tests, is in short supply. And to be fair, many of the first responders are petrified of going into people's houses. Naturally — just like other essential workers, like cable and food delivery workers, plumbers, carpenters, and so on.
Other states also have their own data sharing directives. These include Oklahoma, Alabama and South Carolina. The Ontario government in Canada has also offered a similar data sharing service for its emergency responders.
These aren't easy issues to deal with. Do we want a Scarlett Letter society with the proverbial red X on our doors, banishing those who've been marked to the outskirts of society? No, of course not. We cannot go down that path.
The issue brings me back to a post I wrote last month about balancing personal privacy with public health. Privacy is not an absolute right, it is part of a social contract, and during this time, we're going to have to make sacrifices. But that doesn't mean we shouldn't be concerned.
We should.
We're building powerful surveillance networks to track the disease. There's even rumors that the White House is exploring a health care surveillance system akin to the PATRIOT Act after 9/11. Sens. Mark Warner, D-Virg., and Richard Blumenthal, D-Conn., and Rep. Anna Eshoo, D-Calif., have reached out to Jared Kushner expressing their concerns.
We must not make those same post-9/11 mistakes. That means oversight, accountability, appropriate data retention and data minimization.
Here's one good example: Supermarkets in Britain have been receiving National Health Service data about vulnerable patients. This is part of the government's effort to mitigate the spread of COVID-19. Retailers this week started contacting customers whose names are on a list of medically vulnerable people — those undergoing chemotherapy, suffering from severe asthma, and so on. All very sensitive information is now in the hands of these retailers.
Appropriately, the U.K. Information Commissioner's Office has warned the retailers to delete that data once this pandemic abates. An ICO spokesman said, "Where it’s necessary, public authorities are able to share relevant information to help provide essential support services, as long as they share only the minimum amount of information required and ensure that it is not retained for longer than needed. Data sharing can be done in accordance with the law, including putting the appropriate safeguards in place so people’s information is handled responsibly."
Let's hope all of our local, state and national governments follow a similar, thoughtful path for the future. Our lives now, and our society in the future may well depend on it.
Photo by Chris Barbalis on Unsplash
