Here's Why Nebraska isn't Showing up on National COVID Case Maps

Lucas Peterson supervises the food and beverage department at Pinnacle Bank Arena. It’s a job that puts him in close contact with people across the state. Lately, he’s been working concerts there and doing so at a greater risk than most people.

“In the beginning of the pandemic, I was calling my doctor pretty much every day at that point,” he said.

Peterson was cautious at the start of the pandemic because he’s immunocompromised with an undetectable HIV status. He’s someone who checks COVID-19 trends regularly – through the county health department website and what’s in the Lincoln Journal Star.

As the Delta Variant has caused a new COVID spike, Peterson can’t check trends across different parts of the state anymore, and that’s because the state quit publishing its COVID dashboard at the end of June.

In Lancaster county, where Peterson lives, there are local numbers, but they’re an exception, as other local health departments across Nebraska can only share county data for those with more than 20,000 people.

“It would be helpful if the Governor were to not have stalled the reporting statewide because we would then be able to capture that information for those people coming in,” Peterson said. “So that's why I have a lot of caution and a lot of concern.”

The state’s decision to withhold county data is not unchallenged, and Nebraska’s legal justification for not publishing complete county level COVID-19 data may be based on a misreading of federal privacy guidance, according to a Creighton University law professor. In a written statement, DHHS defends its interpretation of medical privacy law, a decision that makes it an outlier among all U.S. states during the pandemic.

Data, De-Identified

The COVID dashboard went away when Nebraska Gov. Pete Ricketts ended an emergency declaration that suspended some laws – including Nebraska’s HIPAA equivalent law. Ricketts said the decision was made because the pandemic was waning in the state. At the time, cases, hospitalizations and deaths were at all-time lows.

After not publishing any state data for two weeks, Nebraska’s Department of Health and Human Services began releasing weekly updates with just total numbers. Advocates urge that’s not enough information because with totals it’s harder to see trends.

“I don't think I've ever been in an emergency response where we said we had enough information,” said Dr. James Lawler, the co-executive director for the Global Center for Health Security at the University of Nebraska Medical Center. “So the more information you can get, the better. And certainly, transparency with data is an important function of public health, and being able to navigate public health emergencies effectively.”

Populations with low vaccination rates are driving the Delta surge. Lawler and his fellow public health experts have said that’s concerning for many rural counties – with fewer than 20,000 people – that have lost out on county data. Rural areas also have lower vaccination rates, meaning their level of risk may be higher.

“I've never seen anyone dictate that data like this should not be disclosed,” said Dr. Tom Safranek, Nebraska’s former state epidemiologist, who adds the failure to report important data at a time like this is what he calls “public health malpractice.”

An Overabundance of Caution?

Now, there’s some questions around the way Nebraska’s Department of Health and Human Services has chosen to handle the dashboard and which Nebraska counties can release data.

This, by no means, is a simple subject. The 20,000 person limit comes from federal guidelines on de-identifying data.

There are two methods for an entity that falls under HIPAA to remain compliant to the privacy law and still release data.

One method to do this strips data of geographic information smaller than a state, and that’s where the 20,000 number comes from. However, a Creighton University law professor, Kelly Dineen, said Nebraska’s DHHS is possibly misinterpreting the 20,000 number because it’s used for ZIP codes and not counties.

“If you read the text of that regulation, you shouldn't be able to report any data at a county level because the 20,000 number applies to subunits of ZIP codes,” said Dineen, the associate professor and director of Creighton’s health law program.

Nebraska is not publishing data for 76 counties in the state, and all have less than 20,000 people. By Dineen’s analysis, the state is not either not applying the federal guidance correctly and coincidentally using 20,000 and a different method. If the rest of the country followed this methodology – some states in the West and Great Plains would be nearly blank.

DHHS stands by its interpretation, though, saying the state department is able to provide data by an aggregate of ZIP codes under the first method.

That second method relies upon an expert – an epidemiologist, like Safranek, or a statistician – to deem what data will serve the public’s interest without breaking any laws. It’s called expert determination.

“There's certainly absolutely nothing that prohibits them from giving us more meaningful information and probably nothing that prohibits us from getting more information,” Dineen said. “To what extent and to what degree, it would probably depend on something like an expert determination.”

Dineen pointed out that DHHS has published 2020 reports for tuberculosis and abortions that include age and county data, which is more than what is currently being reported for COVID. Those reports, it appears, could have been de-identified through expert determination. DHHS said this reporting is mandated under different laws.

Dr. Safranek, the former state epidemiologist, says, at no point in his 30 years in public health, did he ever receive a complaint that he had released data which violated HIPAA or harmed an individual.

“There is clearly a way to present and publicize incredibly valuable data at this point in time – data that is being collected and is sitting in the computers of our public health epidemiologists,” he said. “And there's a way to do that, that respects HIPAA, that respects the privacy and the confidentiality of individuals.”

An Unknown Level of Risk

For Peterson, the state’s decisions have consequences working at the Pinnacle Bank Arena. The venue hosts concerts, high school sports and graduations. Peterson said many guests come from across the state to these events. That worries him even those he’s vaccinated because the immunocompromised community is at a greater risk of serious illness.

“I should assume that these people are not vaccinated in order for me to feel safer about things because, if I get comfortable with these guests coming in, making the assumption that they are vaccinated, that's probably not going to end well,” Peterson said.

The 37-year-old is originally from Bertrand, Nebraska – a small town in southwest Nebraska. It’s places like that, with lower vaccination rates, that worries Dr. Lawler because those counties have lost the ability to publish specific data and are, instead, forced to publish data by aggregating counties within the health departments.

“All of that creates additional challenges for them to be able to provide appropriate guidance and information for decision makers within their communities,” Lawler said, “and also to put out the best up to date information for citizens to understand where things are with the pandemic.”

Peterson’s father still lives back in Gosper County, and his aunt is currently the mayor of neighboring Smithfield. He’s only seen his dad twice during the pandemic and going back home, where there is a lack of data, isn’t ideal for someone who’s immunocompromised.

“I have no clue how many people back home are vaccinated and if it's safe, and if COVID is running rampant, which I have to make the assumption that it is,” Peterson said. “So it's just... it's overwhelming.”