Can the Virginia Department of Health publicly disclose COVID-19 outbreak data tied to specific long-term care facilities, businesses, restaurants, churches, schools, and gyms?

Subject

Dissemination of data related to the COVID-19 pandemic by the Virginia Department of Health is permitted, and in some cases required, by recently-enacted legislation, provided the release of such information preserves patient and practitioner anonymity pursuant to § 32.1-41.

Plain-English summary

In early 2021, Senator Emmett Hanger asked the Attorney General whether Virginia statutes permitted the Department of Health to release aggregate COVID-19 outbreak data, naming the long-term care facilities, businesses, restaurants, churches, schools, and gyms where outbreaks had occurred. The underlying statutory tension: existing law required reporters (physicians, labs, and facilities) to send disease reports to public-health authorities and protected the confidentiality of patients and practitioners. New 2020 special-session legislation, however, required VDH to publish outbreak data during a declared communicable-disease emergency.

The AG read those statutes together and concluded that the new laws (§ 32.1-37.01 and 2020 Spec. Sess. I, Va. Acts ch. 13) required VDH to publish outbreak information, but only to the extent the release did not violate § 32.1-41, which requires the Commissioner to preserve the anonymity of each patient and practitioner. The Commissioner has "sole discretion" under § 32.1-41 to divulge identities where pertinent to an investigation, research, or study.

For most outbreak data, anonymity is preserved by releasing de-identified, aggregate figures (the entity, the case count, the death count) without information that would identify any individual patient or practitioner. In small jurisdictions or facilities with very low counts, even aggregate data can re-identify a person, so the Commissioner must apply judgment.

Currency note

This opinion was issued in 2021. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

The statutes the AG analyzed were tied to the COVID-19 state of emergency declared in March 2020. Both the emergency declaration and the special-session enactments that turned on it have since expired or evolved. Anyone making a present-day decision about VDH's authority to publish entity-level outbreak data should check the current text of § 32.1-37.01, § 32.1-41, and any later enactments, and should not assume the COVID-era publication regime still applies.

Common questions

What did the Department of Health have to publish under the 2020 legislation?
For the duration of the COVID-19 emergency, the Commissioner had to publish on the VDH website (1) total confirmed cases by week and health district, (2) cases by age, race, and ethnicity, and (3) the percentage of cases associated with nursing homes, assisted living facilities, or correctional facilities. Section 32.1-37.01 also required publication of outbreak information by entity, including the reporting entity name, number of confirmed cases, and number of deaths.

Was VDH allowed to name a specific restaurant or gym where an outbreak occurred?
Yes, the statute permitted naming the "reporting entity" so long as the release did not violate § 32.1-41's anonymity protections for patients and practitioners. Naming a facility is different from naming an individual patient.

What does "preserve anonymity" mean in practice?
The Health Commissioner has sole discretion under § 32.1-41 to determine when releasing information would compromise anonymity. Generally, releasing only de-identified data (as defined by federal HIPAA standards at 45 C.F.R. § 164.514) is sufficient. In very small populations, even de-identified counts can identify a person, so the Commissioner has to use judgment case by case.

Could VDH refuse to release outbreak data after a request?
Under the COVID-era statutes, certain publication was mandatory. Beyond that, § 32.1-41 vested the disclosure decision in the Commissioner's sole discretion, balanced against the anonymity protection.

Does this opinion still control today?
Treat it as historical context. The opinion was tied to the COVID-19 emergency and the 2020 special-session enactments. Current statutes and emergency declarations may differ.

Where do the underlying confidentiality rules come from?
Sections 32.1-36(D), 32.1-36.1, 32.1-38, and 32.1-41 together protect the identity of patients and practitioners whose information appears in disease reports. The point is to encourage truthful disease reporting by minimizing stigma and discrimination.

Background and statutory framework

Disease reporting in Virginia is governed by Va. Code § 32.1-35 et seq. Physicians, labs, and certain facility administrators must report communicable diseases to public-health authorities under §§ 32.1-36 and 32.1-37. The regulations (12 Va. Admin. Code § 5-90, including § 5-90-80(1)) specify how COVID-19 was to be reported.

Patient and practitioner anonymity protections are layered. Section 32.1-36(D) declares patient identity and disease state confidential. Section 32.1-38 prohibits the State Health Commissioner and local health directors from disclosing the name of any reported person or any reporting person. Section 32.1-41 requires the Commissioner to preserve the anonymity of each patient and practitioner whose records are examined under § 32.1-40, with a "sole discretion" carve-out for identities pertinent to an investigation, research, or study.

The 2020 special session added § 32.1-37.01, which required the Department, upon a Governor's declaration of an emergency under § 44-146.17 for a communicable disease of public-health threat, to publish outbreak information including reporting entity name, confirmed case count, and death count, subject to § 32.1-41. 2020 Spec. Sess. I, Va. Acts ch. 13 added COVID-19 specific publication requirements (by-age, by-race, ICU and hospital occupancy figures, positivity rates, and so on).

The AG noted that much of the requested data was already available on VDH's "COVID-19 Outbreaks by Selected Exposure Settings" dashboard. The opinion confirmed that VDH had statutory authority (and, for some categories, an obligation) to keep doing so, with anonymity safeguards.

Citations

• Va. Code § 2.2-505 (AG advisory opinions)
• Va. Code § 32.1-3 (definitions)
• Va. Code § 32.1-35 et seq. (communicable disease reporting framework)
• Va. Code § 32.1-36; § 32.1-36.1 (patient identity confidentiality)
• Va. Code § 32.1-37; § 32.1-37.01 (facility reporting; mandatory outbreak publication)
• Va. Code § 32.1-38 (nondisclosure of reported and reporting names)
• Va. Code § 32.1-40; § 32.1-41 (Commissioner's records examination; anonymity preservation)
• Va. Code § 44-146.17 (emergency declarations)
• 2020 Spec. Sess. I Va. Acts cc. 12, 13, 24
• 12 Va. Admin. Code § 5-90; § 5-90-80(1) (Board of Health reporting regulations)
• 45 C.F.R. § 164.514 (HIPAA de-identification standard, referenced)

Source

• Landing page: https://www.oag.state.va.us/annual-reports-opinions/official-opinions
• Original PDF: https://www.oag.state.va.us/files/Opinions/2021/20-032-Hanger-issued.pdf

Original opinion text

COMMONWEALTH of VIRGINIA
Office of the Attorney General
Mark R. Herring
Attorney General

February 26, 2021

202 North Ninth Street
Richmond, Virginia 23219
804-786-2071
Fax 804-786-1991
Virginia Relay Services
800-828-1120
7-1-1

The Honorable Emmett W. Hanger, Jr.
Member, Senate of Virginia
Post Office Box 2
Mount Solon, Virginia 22843

Dear Senator Hanger:

I am responding to your request for an official advisory opinion in accordance with § 2.2-505 of the Code of Virginia.

Issue Presented

You ask whether the Code of Virginia permits the Virginia Department of Health to disseminate aggregate coronavirus-related data for long-term care facilities and about outbreaks at businesses, restaurants, churches, schools, fitness centers, gyms, and other facilities.

Applicable Law and Discussion

Section 32.1-35 et seq. of the Code of Virginia requires certain medical providers and other entities to submit reports about communicable diseases to state and local public health authorities.[1] Those statutes also authorize the Department of Health to conduct surveillance and investigation.[2] Under § 32.1-36, reports are required from (1) every physician practicing in the Commonwealth who diagnoses or reasonably suspects that a patient has a disease required by the Board of Health to be reported, as well as (2) every director of a laboratory doing business in the Commonwealth that performs a test whose results indicate the presence of any such disease.[3] A separate provision (§ 32.1-37) requires reports from persons in charge of any "medical care facility" or "residential or day program, service or facility licensed or operated by any agency of the Commonwealth, school, or summer camp as defined in § 35.1-1."[4]

After the Department of Health receives disease report information, several statutory provisions govern disclosure of such information. Under § 32.1-36(D), "[t]he patient's identity and disease state shall be confidential as provided in §§ 32.1-36.1 and 32.1-41."[5] Under § 32.1-38, neither the State Health Commissioner nor any local health director shall disclose the name of any person reported or the name of any person[6] making a disease report.[7] Finally, § 32.1-41 requires the Commissioner to "preserve the anonymity of each patient and practitioner of the healing arts whose records are examined pursuant to § 32.1-40 except that the Commissioner, in his sole discretion, may divulge the identity of such patients and practitioners if pertinent to an investigation, research or study."[8] These protections encourage truthful disease reporting, which is critical to public health efforts, by minimizing the risk that individuals and entities experiencing outbreaks of disease will be identified and face stigma, discrimination, or other negative repercussions.

During its 2020 Special Session, the General Assembly enacted legislation that requires the Department of Health to disclose information from disease reports as follows:

Upon declaration of an emergency by the Governor pursuant to § 44-146.17 in response to a communicable disease of public health threat, the Department shall make information regarding outbreaks of such communicable disease of public health threat reported pursuant to § 32.1-37 available to the public on a website maintained by the Department, provided the release of such information does not violate the provisions of § 32.1-41. Such information shall include (i) the name of the reporting entity at which an outbreak of such communicable disease of public health threat has been reported; (ii) the number of confirmed cases of such communicable disease of public health threat reported by such reporting entity; and (iii) the number of deaths resulting from such communicable disease of public health threat reported by such reporting entity.[9]

With respect to COVID-19 specifically, legislation from the 2020 Special Session also requires:

§ 1. For the duration of the emergency declared by the Governor pursuant to § 44-146.17 of the Code of Virginia in response to COVID-19, the Commissioner of Health shall make available to the public on a website maintained by the Department of Health information about confirmed cases of COVID-19 in the Commonwealth, by week and by health district, including (i) the total number of confirmed cases of COVID-19; (ii) the number of confirmed cases by age group and by race and ethnicity; and (iii) the percentage of cases that are known to be associated with a nursing home, assisted living facility, or correctional facility, provided that the release of such information does not violate the provisions of § 32.1-41 of the Code of Virginia.

§ 2. For the duration of the emergency declared by the Governor pursuant to § 44-146.17 of the Code of Virginia in response to COVID-19, the Commissioner of Health shall make available to the public on a website maintained by the Department of Health information about and analyses of data required to be made available to the public pursuant to § 1 to facilitate better understanding of such data.

§ 3. For the duration of the emergency declared by the Governor pursuant to § 44-146.17 of the Code of Virginia in response to COVID-19, the Commissioner of Health shall develop and make available to the public on a website maintained by the Department of Health COVID-19 indicators with thresholds to include case incidence rate, percentage of polymerase chain reaction (PCR) tests that are positive, rate of COVID-like illness visits to emergency departments, rate of current confirmed COVID-19 intensive care unit hospitalizations, and percentage of hospital beds that are currently occupied.[10]

These new laws specify the disease report information related to COVID-19 that the Department of Health must disclose on its website.[11] By their own terms, however, the new statutes make clear that any disclosure still must comply with § 32.1-41, and, for that reason, the Commissioner is required to preserve the anonymity of each patient and practitioner as specified in that section. Generally, in the context of health information, patient anonymity is preserved by releasing only de-identified data.[12] And, as noted above, the balance between preserving anonymity and disclosing information under § 32.1-41 is reserved to the "sole discretion" of the State Health Commissioner.[13]

Conclusion

It is my opinion that the dissemination of data related to the COVID-19 pandemic by the Virginia Department of Health is permitted, and in some cases required, as set forth in Virginia Code § 32.1-37.01 and 2020 Spec. Sess. I Va. Acts ch. 13, provided the release of such information preserves patient and practitioner anonymity pursuant to § 32.1-41.

With kindest regards, I am,
Very truly yours,

Mark R. Herring
Attorney General

1. VA. CODE ANN. § 32.1-35 et seq. All citations to the Code of Virginia are from LexisNexis and are current through the 2020 Special Session I of the General Assembly.
2. Id.
3. VA. CODE ANN. § 32.1-36(A). Regulations adopted by the Board of Health govern how diseases are reported. See 12 VA. ADMIN. CODE § 5-90. Recent amendments to those regulations specify how COVID-19 is to be reported. See 12 VAC 5-90-80(1), http://register.dls.virginia.gov/details.aspx?id=9317 (last visited February 25, 2021).
4. VA. CODE ANN. § 32.1-37.
5. Id. § 32.1-36(D).
6. "Person" is defined in § 32.1-3 to mean "an individual, corporation, partnership, or association or any other legal entity." Under the plain language of § 32.1-3, the term "person" is to be given that meaning when it is "used in [Title 32.1] unless the context requires otherwise or it is otherwise provided." VA. CODE ANN. § 32.1-3. The context of § 32.1-38 does not require a different meaning.
7. VA. CODE ANN. § 32.1-38.
8. Id. § 32.1-41.
9. Id. § 32.1-37.01; 2020 Spec. Sess. I Va. Acts chs. 12, 24.
10. 2020 Spec. Sess. I Va. Acts ch. 13.
11. I note that much of the data about which you inquire is available on the Department of Health's website. See, e.g., "COVID-19 Outbreaks by Selected Exposure Settings," available at https://www.vdh.virginia.gov/coronavirus/covid-19-data-insights/covid-19-outbreaks-by-selected-exposure-settings/.
12. Generally, to be de-identified, information must have identifiers removed such that the remaining information cannot be used alone or in combination with other information to identify the individual. See, e.g., 45 C.F.R. § 164.514. In small jurisdictions with very low case counts, it may be possible that releasing statistical information could be used in combination with other information that is already known in the community to identify an individual. It is my understanding that the Virginia Department of Health maintains a Communicable Disease Surveillance Data Release Policy that contains the methodology it uses to preserve patient anonymity in such situations.
13. VA. CODE ANN. § 32.1-41.