As of Wednesday, April 8, Yavapai County has confirmed 63 positive tests of the novel coronavirus, 26 of which are in the Verde Valley. Cottonwood has 8 confirmed cases, Sedona has 12, and the assorted remaining areas of the Verde Valley have 6. The county also reported that the area’s first death due to COVID-19 took place on Saturday, April 4. Though the Prescott area has seen signs of a possible increasing growth rate, where the number of new cases on each given day is higher than the day before, the Verde Valley continues to only have limited linear growth.
Officials at Yavapai County Community Health Services warn that despite efforts to reduce the spread of the virus, they expect the growth rate in the Verde Valley to increase in the coming days.
They also suggested that the positive case totals are likely not representative of the total number of cases, due to the continued testing shortage.
“Please do not rely solely on numbers of confirmed positive cases,” YCCHS Director Leslie Horton wrote in an email. “We have had very limited testing available in Yavapai County thus far, and therefore, we need to approach the issue with the mentality that COVID-19 is widespread, and the number of positive cases reported should not be considered indicative of the actual number of people who are carriers or are COVID-19 positive. The data would indicate that there are anywhere from 10 to 50 additional cases of COVID-19 untested in the community for every positive case.”
Initially, the county identified the location of cases down to specific municipalities, reporting the first two cases in Sedona and one in Prescott. However, on March 27, the county switched to just reporting cases regionally, assigning them to either “Verde Valley” or the “Quad Cities,” which are Prescott, Prescott Valley, Chino Valley, Dewey-Humboldt and surrounding communities.
The March 30 press release from the county announcing updates on cases included an explanation for the change:
“Yavapai County’s health director, Leslie Horton, and county attorney have read the HIPPA [sic] guidelines regarding protected information during an outbreak and have determined it is inappropriate to give out specific location information. It is important to know there is widespread exposure to COVID-19 and all residents of Yavapai County should assume the virus is present in their community and take precautions.”
On Monday, April 6, [after the print version of this article went to print] the county returned to reporting cases at the level of municipalities. However, the county last week refused attempts by the Cottonwood Journal Extra and The Camp Verde Journal to return to identifying the more specific locations of cases.
Kristen Rosati, the former president of the American Health Lawyers Association, and an attorney at the Phoenix-based firm Coppersmith Brockelman PLC specializing in the application of the Health Insurance Portability and Accountability Act that protects the privacy of patient health information, questioned the county’s previous legal requirement.
“Most county governments do not have to comply with HIPAA, because HIPAA only applies to HIPAA-covered entities, [such as medical providers, health insurers, health care clearinghouses and businesses that handle health care information],” Rosati said. “County governments usually don’t have to comply with HIPAA because they don’t fall within those categories. But the caveat for it is that the only real concrete standard around for de-identifying information is the HIPAA de-identification standards, so lots of other organizations who are concerned about individual privacy will follow the HIPAA regulations.”
Horton cited the guidelines from the Centers for Disease Control and Prevention on the application of HIPAA for public health authorities, which grant entities bound by HIPAA to provide limited information to public health entities despite the Privacy Rule, in claiming that the county was bound by the same rule. The CDC guidelines, however, include the following:
“Also, after PHI [Public Health Information] is disclosed to a public health authority pursuant to the Privacy Rule, the public health authority, if it is not a covered entity, may maintain, use and disclose the data consistent with the laws, regulations and policies applicable to the public health authority.”
“The reason we had to move from identifying cases by city is that the individual cases could be too easily identified in smaller rural towns,” Horton wrote in an email. “Originally, our cases were all in Prescott or Sedona, both of which have an adequate population base to allow for sharing the information. However, at the point where cases began being identified in our smaller towns, we made the deci- sion to regionalize the cases into Verde Valley or Prescott/Quad-Cities area, in order to protect the individual’s privacy. This allows us to maintain the integrity and patient privacy of the information for those that could be too easily identified in small rural communities.”
According to Rosati, although this concern is one that makes sense for HIPAA compliance, it does not prohibit the county from releasing information in larger municipalities where that is not an issue and could be ameliorated in the smaller municipalities of only a few hundred people or less by masking other identifying data such as age or sex to protect patient confidentiality. The county data does not reveal these specifics, only outlining the age bracket and sex breakdown of the total cases in the county.
Shortly after the Cottonwood Journal Extra brought up these questions about the county’s legal opinions, the county switched to giving more detail in case reporting.
