The state Legislature is considering enacting a law that would give the public a more complete glimpse of the toll of disease outbreaks, like the current COVID-19 pandemic.
Senate Bill 719 would make aggregate data derived from disease investigations public, forcing the Oregon Health Authority and other health agencies to release these data unless they believe it will identify an individual. Under current law, the health authority has the unilateral power to keep information gleaned from investigations secret.
The health authority has consistently cited that law, enshrined in ORS 433.008, to justify its refusal to release information about outbreaks, regardless of whether the public would gain a deeper understanding about the spread of infectious diseases. The law was originally approved by the Legislature after the health authority insisted that the release of data would endanger its infectious disease investigations. Officials said that releasing certain information would discourage people involved in the outbreaks, such as restaurant owners in the case of an E. coli outbreak, from talking to health officials.
But over the past year, as the novel coronavirus raged around the world and spread across the United States, scientists and lawmakers in Oregon, along with reporters who normally don’t focus on outbreaks, have bumped up against the law in their bids to obtain more information.
SB 719, which cleared the Oregon Senate's Health committee on Monday, takes a first step toward forcing the health authority to be more transparent. It would require the health authority to presume that aggregate data in an outbreak is public, unless there's a legitimate risk that the release could be used to identify an individual. Under federal privacy laws, personal health information is protected, even after a person dies.
"It calls for a small change, but it's a significant one," said the bill's co-sponsor, Sen. Mike Dembrow, P-Portland, at a hearing last month. The legislation was "provoked by lessons learned from the COVID crisis that we're in the middle of."
If the bill passes, he said, aggregate data related to an outbreak would be presumed public unless health officials could substantiate a reason to withhold that information. Epidemiologists declare an outbreak when two or more people are sickened by the same bug.
The bill stems from a push by the Oregon chapter of the Society of Professional Journalists, which has heard continual complaints from members who’ve been frustrated by the health authorities refusal to release information or explain their rationale.
Here’s a case in point: For months, OHA has posted weekly data on its website about COVID-19 cases by ZIP code. That data excluded ZIP codes with 1,000 or fewer residents to protect “privacy,” according to OHA.
In spite of fine print saying the data is private, journalists at The Oregonian figured out a way to download it. It has appeared on The Oregonian/OregonLive’s map of ZIP codes since February. OHA wouldn’t respond to questions about whether it now considered the data public.
The Lund Report asked the OHA late last year why it used the term "privacy" when redacting case counts in smaller ZIP codes. How would knowing that there were 11 cases of COVID in a ZIP code of 800 identify who had it in any way? How did the agency arrive at 1,000 as the threshold population to redact, instead of 500 or 10,000? The health authority declined to answer.
While SB719 is intended to make data on the small ZIP codes public, there’s no requirement the agency release it in a timely fashion. A public records request for vaccination data by ZIP code filed Jan. 25 -- which falls outside the current statute protecting outbreak data -- has gone unanswered for more than two months.
Health professionals have warned there may be unexpected consequences to making aggregate data derived from an investigation public before they are complete.
It's common for health agencies to limit records on small groups of people for fear that might identify individuals. The U.S. Department of Health and Human Services won't say how many people are hospitalized with COVID at a particular facility if that number is less than four. When there's a legitimate risk that someone could be identified, under SB719, OHA could still withhold the records.
At Monday’s meeting, senators adopted an amendment that specifically said that health officials would not have to release quarterly reports on completed investigations. That's a concession made to limit the cost of compliance, said Rachel Alexander, a board member of the Oregon Society of Professional Journalists.
The bill now heads to the Senate’s Ways and Means committee.
You can reach Jacob Fenton at [email protected].
