Privacy Issues at the Heart of North Carolina’s Coronavirus Response

As Sen. Thom Tillis recuperates from his bout with COVID-19, the respiratory disease caused by the novel coronavirus, North Carolina is continuing its phased reopening with eased restrictions on bars, movie theaters and amusement parks, and new case counts have been increasing only slightly in North Carolina for the past several weeks. After more than 3.4 million tests, 236,000 cases and nearing 4,000 deaths in the state, the positive test rate remains slightly above 5 percent. National headlines highlighted the University of North Carolina at Chapel Hill’s decision to take classes fully virtual after a number of clusters (of five or more cases each) showed that the virus was making its way through the student body, and other state universities followed suit.

As a southern state with a Democratic governor, North Carolina offers lessons from its coronavirus response that may have implications for states with similar state-local dynamics: Virginia, Louisiana, New Mexico, Colorado and Kansas, for example. It can also provide informative contrasts with other states. Before the president’s hospitalization with the virus, the state had become a frequent campaign stop for the Trump campaign because of its tight presidential and senatorial races, and Governor Roy Cooper was on the opposite end of Trump in a tug-of-war over the Republican National Convention that was scheduled to take place in Charlotte. To date, North Carolina’s case and death counts have hovered near the middle of the pack: It ranks the sixth-highest in terms of the total number of cases, 28th in cases per capita, and 32nd in deaths per capita compared to other states and Washington, D.C.

North Carolina has managed to skirt below the high positive-test rates that characterize other southern states. Yet it also shares a number of problems with its regional neighbors—chief among them being the failure to adequately check the virus’s spread within the state’s Hispanic community. To address this problem, Governor Cooper established the Andrea Harris Social, Economic, Environmental, and Health Equity Task Force to improve underserved communities’ access to health care and improve engagement with patients in communities of color, among other goals.

Federal prompts for testing sites to ask for driver’s license numbers and Social Security numbers have undermined testing efforts in communities with the highest prevalence of COVID-19. North Carolina’s Department of Health and Human Services has responded to this problem and others by creating the Community Testing in High-Priority and Marginalized Populations (CHAMP) Initiative, which created 300 testing sites for underserved communities, covering “2.2 million African American, LatinX/Hispanic and American Indian individuals.” Although driver’s license and Social Security numbers are not required, testing at these sites is not anonymous, and officials still ask for names and recent contacts.

North Carolina has also built SlowCOVIDNC, an app compatible with the Google-Apple API, which the two companies made to improve communication between Android and iOS, the two major operating systems used on mobile phones. According to Business Insider in June, the state was not planning to make an app, but a state Department of Health and Human Services spokesperson told me on Aug. 17 that “NC is actively exploring options for using an app for exposure notifications.” SlowCOVIDNC appeared as under development on a list on the XDA Developers website on Aug. 24, and the app was officially released Sept. 21. Because it uses the Google-Apple exposure notification system, this app does not allow for centralized access by government officials and thus has scant privacy implications. And it can only complement contact-tracing efforts as a secondary, separate system, not one that can be integrated with manual contact tracing. Two weeks after launch, the app garnered more than 100,000 downloads.

No amount of tracing and free testing will slow the spread of the virus if people are afraid to be tested because of their immigration status, and that is precisely what appears to be happening. An effective testing regime will require policies that specifically bolster privacy protections while providing economic support. Here, North Carolina’s response to the coronavirus still falls short.

The Privacy Angle

Unease regarding immigration enforcement is not the only place where privacy figures into North Carolina’s coronavirus response. In fact, privacy concerns are pulling the response in three directions. First, local authorities are fighting over access to test results and contact-tracing data. Second, fear of data leakage—whether legal (such as from the Department of Health and Human Services or law enforcement) or illegal—is impairing contact tracing, especially in the Hispanic community. And finally, well-intentioned concern for privacy is hindering research on convalescent plasma and its utility as a treatment or its indirect use for vaccine and treatment development.

Public health has a long tradition of confidentiality, and North Carolina has had a good track record in maintaining patient confidentiality. In the early 1980s, much of the United States was conducting anonymous HIV testing to confront that epidemic. North Carolina decided to conduct confidential testing rather than anonymous testing by requiring that patients provide their names so that public health authorities could act on the test results. The decreased privacy of confidential testing likely led to a decrease in testing—but it crucially enabled public health officials to conduct contact tracing. While the trade-off is still up for debate, many states have adopted a confidential testing approach, which requires naming those who test positive. In the midst of a global pandemic, that same trade-off exists for coronavirus testing confidentiality, and both approaches have valid arguments. A confidential testing program could be more effective in stopping the spread of the virus, but it would require privacy protections, such as restrictions on how data will be used and by whom, to limit any decrease in participation.

Dozens of diseases are being tracked within the North Carolina Electronic Disease Surveillance System, and this is made possible only by the strength of the state’s public health law, which preserves individual privacy while empowering public health officials to fight the further spread of disease. Naturally, such a guarantee of privacy should also be a central pillar in the state’s response to the coronavirus, so privacy shortcomings would make contact tracing difficult. On top of the barriers created by scam callers and an increasing reluctance to answer phone calls from strange numbers, distrust of the government’s privacy protections for undocumented immigrants plays a major role in impeding contact tracing.

Immigration Complications

The federal government has made clear that legitimate contact tracers should not ask about a person’s immigration status—an important step toward allaying fears that would prevent cooperation with public health authorities. But this basic level of protection does not suffice when the coronavirus is spreading disproportionately through Hispanic communities because of factors such as poverty, lack of information in Spanish, large families in crowded housing and increased likelihood of being an essential worker. This is a trend across the country, and North Carolina’s response—and mistakes—can inform other states on how to address it.

In testing—equally important to tracing in a trace-and-test strategy—immigration status, has already posed a problem. The Coronavirus Aid, Relief, and Economic Security (CARES) Act created a mechanism for the federal government to reimburse testing locations like CVS and Walgreens for tests administered to uninsured individuals, but the Health Resources and Services Administration (HRSA) portal through which testing centers apply for reimbursement asks for a Social Security number, driver’s license or state identification. HRSA allows testing centers to apply for reimbursement without this information only if they attest to having attempted to collect it, and that reimbursement process takes longer. Even in an ideal situation where testing center employees know that the information is not required and where HRSA fully reimburses the cost, simply asking for the information could create a chilling effect. This identification was an impetus for the CHAMP Initiative, although there has yet to be a statewide solution that covers those outside of CHAMP’s target communities.

People in the country illegally may worry that the information they provide to public health officials performing contact tracing—such as contacts, family members, their home address and where they work—could be shared with Immigration and Customs Enforcement (ICE) or other law enforcement bodies. Contact tracing can reveal the identity of family and friends who are in the country illegally. Publicly releasing some of this information, then, could certainly cause concern. In one case, North Carolina considered releasing information about coronavirus cases among meat processing plant employees, although the state ultimately decided against doing so in part because the data would be incomplete and in part because, in the words of Chatham County Health Director Layton Long, releasing processing plant case counts would be “very detrimental to any cooperative relationships that we have with the plants.”

But the state did release some information. In late April, North Carolina released information about which nursing homes had outbreaks when Attorney General Joshua Stein authorized a “public health exception” to confidentiality requirements under GS 130A-143(4), which allows for the release of health information if it is “necessary to protect the public health and is made as provided by the Commission in its rules regarding control measures for communicable diseases and conditions.”

Migrant housing was found to enable the spread of the virus, leading to the public release of additional information in May—first naming specific farms and later the names of streets where migrant housing facilities were located without farm names. While the redaction is likely to better protect the farms’ reputations, it does little to protect the residents of migrant labor camps. The data might have been better released to local health authorities rather than to the public, where immigration enforcement can obtain it as easily as anyone else.

Political and Economic Factors

In my interview with Duke Immigrant Rights Clinic faculty members Shane Ellison and Kate Evans, they said that the Trump administration has decreased trust in the government among Hispanic communities affected by the administration’s immigration policy. Political messages about immigration are being reinforced by local raids—a feature that also marked the Obama administration. Decreasing trust causes advocates and service providers to lose access to communities, something that contact tracers are just now realizing.

Evans said that the pandemic has only more widely exposed the fact that distrust of government within immigrant communities is at an all-time high. “Immigrant communities are understandably fearful of any interactions with government. One of the many changes to immigration policy implemented in this administration is that of the Inadmissibility on Public Charge Grounds rule, which is dissuading immigrants from coming forward to report crimes or, in this case, COVID-19 cases, before it has even been implemented.” The public charge rule scores certain groups of immigrants on their likelihood of needing support from the government. When the Trump administration issued the new rule in 2019, the message received by immigrants was that they should never enroll in government programs or contact social workers out of fear that doing so may be held against them in future attempts to become American citizens. Since its inception, public perception surrounding the rule has been closely linked to access to medical services, such as benefits for pregnant and nursing mothers.

The federal response to the coronavirus gives no economic stimulus access to mixed-status families—those in which some family members are U.S. citizens or legal residents and others are undocumented—a crucial factor in encouraging nonessential workers to stay home. And Evans said that while coronavirus testing and treatment services are excluded from the public charge measures regardless of documentation status, the extent to which this is understood is limited.

The announcement that coronavirus testing and treatment would not be considered under the public charge rule could be considered a change to—or incompatible with—the law, and it implicitly concedes that the public charge rule’s change has had a chilling effect on immigrants’ cooperation with authorities. Challenges to the public charge rule change are working their way through the federal courts. While the Supreme Court has allowed the rule to stand for now, the high court said that challenges to its implementation during the coronavirus pandemic could proceed. The rule was subsequently stalled by the U.S. District Court for the Southern District of New York “for any period during which there is a declared national health emergency in response to the COVID-19 outbreak.”

The piece playing out specifically in North Carolina, although it is not unique to the state, is a high-profile discussion of entanglement between the priorities of public health officials and law enforcement. As documented in the Netflix series “Immigration Nation,” ICE raids in North Carolina were made specifically to push local sheriffs to support the federal 287(g) program, which allows state and local law enforcement to perform immigration enforcement duties with ICE supervision. These efforts to increase collaboration between local law enforcement officers and ICE have continued even during the pandemic.

Solutions that would increase trust are not out of reach. Ellison used his experience as an immigration lawyer and professor in Nebraska to draw conclusions about the importance of community involvement. South Omaha, Nebraska, he described, was witnessing low rates of mask wearing and social distancing in the immigrant community during the early stages of the outbreak. State Sen. Tony Vargas worked with Hispanic community leaders to communicate with the community in a way that allowed the message to be received better than one coming solely from government voices. Focusing the government response on those most severely affected may seem obvious, but it is a lesson that leaders from other states could learn.

North Carolina’s CHAMP Initiative may have helped increase access to testing among those with privacy concerns associated with a lack of documentation, although concerns about economic stability and housing remain. Immigrants with low to no savings fear being forced to quarantine because of the financial cost of missing work, and Evans and Ellison contended that the only solution is to introduce economic support mechanisms hand-in-hand with community messaging and access to testing and treatment. If a quarantine is not economically viable for patients who have tested positive because they are excluded from unemployment insurance and economic stimulus payments, then increased access to testing provides little help in slowing the spread of the virus.

For now, pressure to provide economic support to undocumented immigrants in North Carolina is coming mostly from community organizations such as the Farmworker Advocacy Network, which is pushing Cooper’s office to come up with concrete policy responses that include treatment and unemployment support. There is a chance that the state could unlock federal funds provided by Trump’s executive order to extend unemployment benefits to those required to quarantine.

Privacy Theater

North Carolina has maintained privacy protections for personal health records, releasing information on the spread of the virus only at the ZIP code and county levels. Some of these protections have been characterized as counterproductive. Buz Waitzkin, faculty lead for a number of Duke University projects focused on COVID-19, found that policies intended to protect patient privacy were inhibiting the ability of the state to effectively combat the disease.

In an interview, Waitzkin told me that when one of his research groups asked the state to inform recovered COVID-19 patients of the demand for blood plasma and encourage donations that could be valuable for last-ditch treatment or longer term research, it was considered an inappropriate use of the registry of infected individuals. At the same time, the registry was routinely being shared with county health departments to launch contact-tracing programs.

Under state law, doctors, hospitals and public health authorities are required to report all infections to the state government. Local implementation of contact tracing would require the coordination of potentially hundreds of local health authorities, which not only requires disclosure of patients’ identities but also involves contacting them to seek the identities of everyone with whom they had contact. As Waitzkin commented, permitting use of the registry for contract tracing, but not for soliciting plasma donors, did not contribute to maintaining patients’ privacy but, rather, undermined efforts to find treatments for the disease.

Conclusion

North Carolina’s government, and the state Department of Health and Human Services specifically, has made strides in creating some of the necessary privacy protections that would characterize an effective response to the coronavirus. The state has had success in increasing access to testing in poor communities, has implemented a privacy-preserving exposure notification system, and erred on the side of caution with its privacy protections in manual contact tracing. Other states would do well to emulate North Carolina’s direct strategy for low-income communities and its emphasis on caution with regard to privacy (in addition to caution in reopening businesses). And they would also do well, wherever politically feasible, to learn from North Carolina’s mistakes, such as its failed reopening of colleges without a robust testing regime—a mistake replicated across the country.

But barriers with roots in federal policies remain. As long as these stand in the way and without a clear and comprehensive state response in which privacy protections dovetail with economic support, the virus is likely to disproportionately affect North Carolina’s Hispanic community.

Ultimately, the state’s privacy crisis highlights the need for federal privacy legislation, which would ideally forbid public health data from being used in immigration enforcement. The virus’s disproportionate spread through certain communities shows that privacy protections such as offloading responsibilities to counties fall short of a real solution. In the throes of the pandemic, a state’s response must address the immediate need to increase trust and empower local health authorities to do their jobs.