The US Centers for Disease Control and Prevention (CDC) added a third measles death to its dashboard on Wednesday, but the agency would not reveal whether the death occurred in Pennsylvania or another state – which is “notable” as the agency delays reporting other measles deaths, experts say.The CDC cited privacy laws in not sharing the name of the state, but experts say there are no privacy concerns in doing so – and this information is important for the public to have as the outbreak continues accelerating, growing by 8% in one week to 4,410 confirmed cases so far this year, nearly double last year’s count.“Due to privacy laws and legal restrictions, NCHS [the National Center for Health Statistics] cannot identify a state or provide additional details about the third individual,” a spokesperson with the US Department of Health and Human Services (HHS) told the Guardian in response to questions about where the death took place.The spokesperson did not respond to follow-up questions about which laws and restrictions prevented that information from being shared.“I don’t buy it,” said Dorit Reiss, a professor of law at UC Law San Francisco. “Naming a state won’t be giving personal details, and they give the number of cases in each state,” she said, adding there was “nothing to prevent giving numbers of deaths in each”.The CDC is not governed by Hipaa as health providers are. The agency is instead guided by the Federal Privacy Act, which usually prohibits disclosing government records about specific individuals, said Lindsay Wiley, professor of law and faculty director of the Health Law and Policy Program at UCLA Law.“But this general prohibition only applies to information that reveals an individual’s identity,” Wiley said. “It’s hard to see how identifying the state where a death occurred would allow the public to identify the patient.”At the same time, it’s “not unheard of” for agencies to use an “overly broad, unwarranted interpretation of privacy protections to decline to share information that they prefer not to share anyway, because it may be seen as damaging to their reputation or agenda”, Wiley said.The CDC switched in September to using NCHS rather than the National Notifiable Diseases Surveillance System (NNDSS), a system that usually reports deaths quickly and provides the state where a death occurs.

The agency has not given a clear reason for the change.When only a few deaths have occurred, NCHS usually does not say where those deaths are happening, which is one of the weaknesses in using it to report information like this.“But it’s also in the news, so it already is likely identifiable,” said Debra Houry, former chief medical officer at the CDC. And the agency still has access to other reporting systems, like NNDSS, to know which state has deaths, Houry said.Pennsylvania has strict privacy laws about not reporting demographic information or medical details, but “that still wouldn’t limit state and deaths”, she said.Pennsylvania has now reported a total of six deaths, with the most recent case still under investigation by state officials.

By carefully tracing the cause of death before reporting it on the state dashboard, officials in Pennsylvania are “doing the right thing”, Houry said.The CDC dashboard only lists three deaths from measles this year, despite five confirmed deaths in Pennsylvania. The agency has not given a reason for the delay; usually, the NCHS system is updated within days of states sending information.Reiss said it was “a change from past practice, and not a good one. [The] CDC is being less transparent than in the past.”Not having a clear picture of what’s happening in each state, including a possible death from measles, makes it hard to understand risk levels, said Paul Offit, an infectious diseases physician at the Children’s Hospital of Philadelphia. “You’d like to know what the activity is in your state.”Offit said he wondered if the secrecy was “coming from the top”, since officials such as Robert F Kennedy Jr, HHS secretary, or Erica Schwartz, CDC director, have reportedly given orders to decrease the measles death count.It’s also not clear if the public is receiving accurate numbers of cases, Offit said.

A 39-year-old woman in Franklin county, Pennsylvania, died of an acute cardiac event, a known but very rare complication of measles infection, Offit pointed out.“When you see something like that, you’re looking at the tip of a much bigger iceberg,” he said. “Are you really monitoring how many adults are getting infected? I doubt it.”It’s also harder to reach adults who may be at risk because they’re not vaccinated, because most vaccination requirements happen at the school level, Offit said. “What do you do for adults?”The decision not to include all deaths from measles is “notable” and will likely have wide-ranging consequences, Offit said.

The CDC has offered to send a support team to help Pennsylvania with the outbreak, but state and local officials may be wary of working alongside staff at an agency that is refusing to record accurate data, Offit said. “You wonder, ‘Can you trust them?’ It’s really that bad.”