Arizona officials in multiple agencies are unlawfully withholding data, statistics, and information regarding COVID-19 outbreaks and abusing health privacy laws, according to top experts in public information and health privacy.
FULL COVERAGE: Coronavirus in Arizona
The experts said one of the most notable violations involves Governor Doug Ducey, Arizona Department of Health Services Director Dr. Cara Christ, and Maricopa County Health Department Director Dr. Rebecca Sunenshine. All three are refusing to release the names and locations of long-term care facilities with positive coronavirus cases.
Another egregious example: The Arizona Department of Corrections denying requests for the total number and prison locations of correctional officers who have tested positive.
Both are statistics and information being released by other states.
“It’s incredibly disappointing. It’s using HIPAA as a big giant fig leaf without any justification at all,” said Pamela Marsh, president of the Florida First Amendment Foundation and former U.S. Attorney of the District of North Florida. “In times when our governors have declared states of emergencies because of a health pandemic, when else is the information necessary for public health? This has to be the moment."
ABC15 interviewed Marsh and three other experts for this report. They include: David Bodney, a prominent First Amendment attorney based in Phoenix; Dan Barr, another Phoenix attorney with a long history of fighting for public access and records; and I. Glenn Cohen, a Harvard Law professor who studies health law and privacy.
The experts believe local and state government officials are twisting and abusing the Health Insurance Portability and Accountability Act during the COVID-19 pandemic by failing to release broad numbers and locations of outbreaks.
HIPAA specifically prohibits the release of an individual's personal private health information.
“Sometimes it’s known as the game of empty bottles,” Bodney said. “You take an empty bottle, slap a label on it, and you call it in this case ‘HIPAA.’ You pour all this information into it and say it’s HIPAA. It’s personal information, I can’t release it, irrespective of what the information really is. It’s kind of a convenient way, a very convenient excuse, for withholding information when the law doesn’t support it.”
For weeks, reporters have requested statistics and locations regarding long-term health facilities.
The AARP has also pressed the Governor’s Office to release the information, saying it’s vital information for the public.
But Ducey and Christ have balked. The two have maintained that the information is protected health information that can’t be released according to state and federal law.
“The address where someone would live would be protected health information,” said Christ on April 14, when answering a question about why she won’t name facilities.
On April 22, she gave a similar response.
“We want to make sure we’re protecting public health and not releasing protected health information,” Christ said during a press conference.
A reporter then pressed the health director further by citing concerns from advocates who believe that HIPAA does not apply.
Governor Ducey interjected after the question and shifted to another reporter’s question on a different topic.
“Truthfully, I think it erodes the public trust,” Cohen said. “Anybody who has a loved one in these nursing facilities has a lot of questions and probably deserves some answers.”
Cohen cited the example of a New Jersey nursing home where more than 70 people have died. Some of the residents found deceased in their rooms.
In Arizona, long-term care facilities have had a staggering number of COVID-19 cases and deaths.
In one Chandler facility, ABC15 has learned there are at least 16 dead residents and others who are hospitalized. In Tucson, one nursing home has more than 80 residents and staff who have contracted the virus.
The larger public health implications are huge. Especially since not all residents and families are immediately notified if a person tests positive in a facility.
“In a crisis like this, information is vital. It is truly vital,” Marsh said.
She later added, “The real fear, if I were the government, is that I don’t give the information to you, you find out later that I withheld the information, and it could have saved a life.”
Marsh said lobbyists for long-term care facilities have a lot of influence and power. She wondered if Arizona’s reluctance to name locations was based on similar pressure.
“Here in Florida, the assisted living, elder care lobby is very strong. They’ve even asked the governor to give them immunity after this is all over,” Marsh said. “You may be dealing with a very powerful, very profitable, corporate business. And that may be what they are trying to protect.”
On April 9, Governor Ducey signed a “Good Samaritan” executive order that limits the liability of healthcare workers during the COVID-19 pandemic.
It also extends those protections to long-term care facilities.
An Arizona Health Care Association lobbyist confirmed to the Arizona Republic that their group urged the Governor to grant more immunity from lawsuits during the crisis.
It’s not just state leaders -- Maricopa County’s health director won’t release the names and locations either.
Sunenshine said it’s because they don’t want to lose the trust of the facilities.
“It's important however, to focus on making sure these facilities are comfortable reaching out and working with public health, so they continue to share when they have suspect cases,” she said on April 15.
That’s a promise to facilities she’s not legally allowed to keep, experts said.
“There is no law in Arizona that grants that kind of blank check to public bodies to enter into those bargains with the regulated industries,” Bodney said. “It doesn’t make legal sense and it doesn’t make policy sense.”
The experts said there is also no legal basis for the Department of Corrections to withhold the number and prison locations of positive officers.
“It’s ridiculous,” said attorney Dan Barr. “That information is not only available, it's obviously necessary. The coronavirus doesn’t discriminate whether you are in custody or a detention officer. If your officers are infected, they are leaving the prisons and endangering their families members and other people. It’s a danger to society in general.”
Other states, including Ohio and California, are releasing detailed statistics about staff and prisons.
ABC15 has learned there are at least 30 corrections officers who have tested positive in seven prisons, according to union officials, sources, and documents.
In the Perryville complex, a kitchen officer was the first to test positive at the prison and now inmates are beginning to get sick.
The Governor’s Office also backs the department’s refusal to provide numbers.
“Our agencies are prohibited from disclosing information that would reveal an employee's identity or confidential medical information,” a spokesperson wrote in an email response. “We appreciate the concern and request for disclosure. ADCRR has assured us they will consider releasing that information if (or in a worst-case scenario, when) cases reach a level that would allow for aggregate data to be released in a manner that is statistically assured to prevent from identifying a specific employee.”
“It’s not infringing anybody’s privacy,” Barr said. “And it’s unquestionably in everybody’s best interest.”
Dr. Christ has also stated that they won’t release any facility names or locations until the numbers in a specific place get high enough to ensure enough anonymity.
The experts interviewed by ABC15 said the state’s position would very likely lose under a legal challenge.
“We have public record laws for a very good reason,” Bodney said. “If people in a democracy know what their government is up to, we will make better judgements.”
All four of the experts raised questions about deeper reasons why officials would want to hold onto this information.
Marsh put it the most simply.
“Why are they hiding it?”
Contact ABC15 Investigator Dave Biscobing at
