This explainer was originally published in Covering COVID-19, our daily Poynter briefing about journalism and coronavirus, written by senior faculty Al Tompkins. Sign up here to have it delivered to your inbox every weekday morning.

Nothing would help us understand the gravity of the COVID-19 situation more than if we could see the effects unfolding in our hospitals.

Hospitals are blocking journalists from documenting what it’s like inside their walls and the shortages of ventilators and other supplies, so we rely on social media and interviews with doctors. But seeing is believing, the old saying goes. It is true in war, it is true in disasters, and this is both a war and a disaster.

“There is unequivocal news value in bringing people imagery from inside hospitals, from the front lines of this virus,” NBC News president Noah Oppenheim told The Washington Post. He added, “It’s critical that we get as many of those pictures out in the world as possible.”

Let’s tap the brakes long enough to say that no reasonable person would suggest that journalists should sneak into hospitals to grab photos. And no reasonable person would suggest journalists work around affected patients without maximum precautions and protection. We have already lost colleagues to this illness and others have already been sickened.

But there is plenty to know about who and what HIPAA does, and does not, cover.

HIPAA’s intent and misuse

Since the Health Insurance Portability and Accountability Act of 1996 and the Privacy Rule that goes with it passed in 2003, it has become a foil to journalists seeking even basic information from hospitals, nursing homes, health departments, medical examiners and police.

Now, at a moment when the public demands reliable data about the spread and effects of COVID-19, journalists cannot get the data and images that would help the public understand the urgency of this pandemic. There would be no denying shortages of protective gear if we could see it.

In Florida, Gov. Ron DeSantis refused to name nursing homes where patients tested positive. The (Poynter-owned) Tampa Bay Times reported:

The DeSantis administration has based its refusal, so far, to name homes with positive results on its desire to protect the confidentiality of residents. While he has not named the law, DeSantis appears to be invoking the federal Health Insurance Portability and Accountability Act, or HIPAA, which protects patient medical records and privacy.

Pamela Marsh, a former top federal prosecutor who now heads the Tallahassee-based First Amendment Foundation, suggested that the HIPAA law is a fig leaf being used to hide vital information.

“That information should be made available,” Marsh, the former United States attorney for Northern Florida, told the (Miami) Herald. “It can’t be business as usual for the families of loved ones in care.”

When the state government would not name the nursing homes, the businesses themselves told the public that some of their residents had tested positive for the virus.

The nonprofit group Families for Better Care launched a social media campaign attacking the governor for not reporting what even the nursing homes themselves have released.

A Twitter post from Families for Better Care (@FFBC)

[the_ad id=”667872″]

HIPAA does not prevent health providers from responding to journalists

Even while some nursing homes and hospitals hold up HIPAA as a reason not to release general information about the patients they have treated, there are many examples of when they routinely report such things. Brian Lee, the executive director of Families for Better Care, told WJXT-TV (Jacksonville):

“Look, they publish information about facilities all over their website. They have inspection results whenever there are scabies outbreaks, there are norovirus outbreaks, information is released. They can’t use that excuse any longer. It’s laughable. They are not releasing anyone’s individual health care information. That’s what HIPAA is all about — individual health information.”

In Iowa, health officials in several counties would not release how many people had taken COVID-19 tests and cited HIPAA as one reason they would not release the information. Iowa Freedom of Information Council executive director Randy Evans pointed out the same hospitals have no problem reporting how many babies are born at their facilities each year.

The first thing to understand is that HIPAA pertains ONLY to “covered entities,” which include health care providers (such as EMTs, doctors, nurses and social workers) and insurance companies. HIPAA does not cover journalists, police and fire departments (except EMTs.) HIPAA does not cover religious organizations that are not health care providers.

The U.S. Department of Health and Human Services issued a specific briefing page for how HIPAA relates to the COVID-19 outbreak. The advisory reminds health care providers, including doctors, that they cannot release specific information about a patient — such a person’s name who tested positive (or negative) for COVID-19 — without written authorization from the patient.

But let’s be clear: HIPAA was intended to protect individual medical and health information. Those individual protections still apply even in a pandemic. HIPAA does not allow a care provider to release individual demographic information, but the key word there is “individual.” That is why hospitals can, for example in the case of a mass shooting, say how many people were admitted, went to surgery and were treated and released.

HIPAA covers “Protected Health Information,” which is information that would make a person identifiable. So while it would not be a HIPAA violation for a health care provider to say 70% of its ICU beds are full or that it has tested 300 people or that all of the people in the ICU are over age 65, it would be a violation to say “Al Tompkins is in the ICU.” Again, that is only for a “covered entity.” It is not a HIPAA violation for a journalist to report a name, it is only a problem for the health care provider.

And HIPAA DOES allow a health care provider to release even personally identifiable information to a public health authority — for example, the Centers for Disease Control and Prevention — for the purpose of controlling a disease, like COVID-19. (See 45 CFR § 164.501 and 164.512(b)(1)(i).)

My friend, National Press Photographers Association legal counsel Mickey Osterreicher, offered some advice for journalists if cops or hospitals try to stop your COVID-19 reporting. He said he is hearing from some photojournalists that hospitals have tried to use HIPAA as a reason to forbid photographers from photographing hospital buildings or workers.

[the_ad id=”667878″]

ProPublica also published help for journalists trying to navigate HIPAA rules:

Even with HIPAA, you can still get ‘de-identified’ data

If a data set has been “de-identified,” HIPAA’s privacy rules do not apply. There are two methods for de-identification: “safe harbor,” which suppresses fields that reveal personally identifiable information, and “expert determination,” which relies on experts to verify that there is a limited risk of identifying patients.

• Check if de-identified data is available for download online. Local and state health agencies sometimes put de-identified data sets online. These data sets have minimal, if any, restrictions on their use.
• Ask a records officer to remove personally identifiable fields. If the health data you want includes any personal identifiers, consider requesting the data with these variables removed or redacted. If there are account or Social Security numbers to identify each patient, ask for dummy IDs (but make sure to find out which variables have been replaced by dummy numbers).
• Request aggregate data. Some records officers may deny your request on the grounds that aggregating data is the same as “creating” data, which they may not be legally obligated to do. So ask nicely, and negotiate! If you are able to get aggregated data (or data you can only publish in an aggregate form), you may be prohibited from publishing data on small groups of people in order to protect the privacy of patients.

Al Tompkins is senior faculty at Poynter. He can be reached at atompkins@poynter.org or on Twitter, @atompkins.