Why doesn't the state provide more details about the location and hospital of patients who test positive or are being treated?

The HIPAA Privacy Rule protects the privacy of patients’ health information but, also allows for some disclosures of information when necessary to protect the state’s public health from immediate threats.

In an emergency, reasonable safeguards must remain in place to protect certain patient information against intentional or unintentional prohibited use. In most cases, reasonable efforts must be made to limit the information disclosed to that which is the minimum necessary to prevent the spread of a disease like COVID-19.

That often includes providing general information on patient’s county or age, while not disclosing their exact location. Providing the minimum necessary information is also important for the overall safety and security of the patient, while protecting others’ health.

Last updated: April 2, 2020