The outbreak started in January 2014. That’s when a resident of the Casa Maria nursing home here was diagnosed with Clostridium difficile, a highly contagious and potentially deadly “superbug” that plagues hospitals, nursing homes and other healthcare facilities.

By the end of February, six more Casa Maria residents were suffering from the infection, characterized by fever, abdominal cramps and violent diarrhea.

Under New Mexico regulations, healthcare facilities must report a suspected outbreak of C. difficile to the state Health Department within 24 hours.

But Casa Maria staff did not contact authorities until March 4, 2014, according to the Health Department report on its investigation of the outbreak, a copy of which was obtained by Reuters. By then, nine of the nursing home’s 86 residents had active infections.

Still, Casa Maria downplayed the emergency. The employee who contacted the authorities asked for information on how to handle “a few cases of C. difficile,” according to the report, but “stated it was not an outbreak.” When a Health Department staffer called Casa Maria the next day to follow up, the nursing home again denied it had an outbreak.

By June, the outbreak was over. Fifteen residents had been infected, and eight were dead. The public was never informed—until now.

“The medical profession should have been able to pick up that it was C. diff and notified the community,” said Ernie Lopez, manager of a local fast-food restaurant.

His mother, Della Baker, entered Casa Maria in December 2013, after three hospital stays for severe diarrhea and a stroke that had paralyzed her left side and rendered her mute. Several weeks after Baker arrived at Casa Maria, nurses told Lopez that his mother’s unrelenting diarrhea was caused by C. difficile.

New Mexico health officials, citing privacy laws, declined to say whether Baker caught the infection at Casa Maria or was one of several infected patients that investigators found had been transferred to the nursing home from five other healthcare facilities in New Mexico and Texas.

Baker died on March 17, 2014, age 95.

The outbreak and the way it was handled expose what a Reuters investigation found to be dangerous flaws in U.S. efforts to control the spread of superbug infections. An examination of cases across the country reveals a system that protects the healthcare facilities where superbugs thrive, while leaving patients, their families and the broader public ignorant of potentially deadly threats.

Every year, hundreds of thousands of Americans are sickened and tens of thousands die from infections by antibiotic-resistant bacteria and C. difficile, a pathogen linked to long-term antibiotic use. Timely reporting of outbreaks of these infections is essential to stopping the spread of disease and saving lives, public health experts and patient advocates say.

Yet the United States lacks a unified nationwide system for reporting and tracking outbreaks. Instead, a patchwork of state laws and guidelines, inconsistently applied, tracks clusters of the deadly infections that the federal government 15 years ago labeled a grave threat to public health.

As a result, the United States has no way to count the deadly spikes in infections that hit the nation. Reuters, drawing on reports from 29 state health departments, has assembled one of the most comprehensive counts yet—identifying at least 300 superbug outbreaks around the nation from 2011 to 2016. The number of people affected was impossible to determine because many reports didn’t include a count of the infected or the dead.

Protective Secrecy

To get an idea of how the states are handling the problem, Reuters filed public-records requests with all 50 states to obtain data and details on reported outbreaks of superbug infections in healthcare facilities over the past five years.

In all, 29 states provided at least some information on individual outbreaks. Many of the rest said they either had no outbreaks during the period or were barred by law from releasing the information. Reuters filled in gaps by asking states for additional information and scouring academic literature.

Most states require that hospitals, nursing homes and other healthcare facilities report suspected outbreaks of infectious disease, drug-resistant or otherwise, within one business day or less of identifying the problem so that health officials can intervene to halt their spread.

But while they require that outbreaks be reported, most states do not provide an explicit definition of the term. Instead, they leave it to the healthcare providers to determine when they are experiencing an increase in a particular infection beyond the usual number. That approach assumes that medical practitioners will know what’s normal in their facilities, and gives them wide latitude in deciding when, or even whether, to report.

Dr. Susan Huang, a professor of infectious diseases at the University of California at Irvine School of Medicine, said the system for identifying outbreaks relies too heavily on staff members’ interpretation of what seems unusual. “Why should anyone be reading this by hand, by eyeball and by gut check?” said Huang, who has developed a software program with Harvard University researchers to identify outbreaks. “People haven’t put real effort into this area.”

St. Mary’s Regional Medical Center in Reno, Nevada, first recognized it had a “problem” on Sept. 10, 2014, according to a state investigation report. It then waited three weeks to notify health officials of a C. difficile outbreak that infected as many as 15 of its patients, three of whom died. Nevada requires that suspected outbreaks be reported “immediately,” according to the Nevada Department of Health and Human Services.

Kimisha Causey, the department’s hospital-acquired-infections coordinator, declined to discuss details of the case. She did say, however, that St. Mary’s was late in reporting the outbreak. “You’ll find that in every state,” she said. “Facilities don’t want the state involved.”

A St. Mary’s spokeswoman said the hospital “did not submit the data late, in fact it was submitted within the standard we have per our internal policies.”

When a state does get involved, punishment is rare to nonexistent. At least 36 states are able to impose civil or criminal penalties, ranging from fines of up to $1,000 to jail time, for failure to properly report outbreaks. Yet not one of those 36 states cited an instance in the past five years when penalties were used.

In the New Mexico outbreak, Casa Maria waited until 10 percent of its patients were infected before contacting officials. Still, the state Health Department did not fault the nursing home for the delay. “Casa Maria appropriately contacted the department as soon as they identified a cluster of C. difficile cases to ensure that they were taking all necessary precautions,” said Paul Rhien, the department’s communications director.

Rhien said state officials have the power to fine facilities, revoke their licenses or even refer individuals for criminal prosecution if they fail to respond properly to an outbreak. The department did not penalize Casa Maria because, despite the 24-hour rule, authorities concluded that the nursing home reported the cases on time.

State investigators also found that medical charts were available for just six of the eight Casa Maria patients who died during the outbreak, and that poor communication between Casa Maria and the five facilities that transferred infected patients to it probably contributed to the outbreak. Rhien said all the facilities involved acted properly.

In a statement emailed to Reuters, Casa Maria said it appropriately notified the state Health Department of the infections and provided effective treatment.

Secrecy enshrouds outbreak reporting. More than a third of states are barred by law from disclosing the location of an outbreak, or in some cases, even that one occurred.

Many state health officials say disclosing information about outbreaks to the public or punishing facilities risks dissuading hospitals and nursing homes from reporting. They say they see themselves as collaborators with healthcare facilities.

“We do not behave like punishers, we behave like helpers,” said Dr. Raoult Ratard, state epidemiologist for the Louisiana Office of Public Health. Louisiana law mandates that information about outbreaks not be released to the public.

No Problem Here

Even so, the collaborative approach often fails the public. Reuters found instances in which, even without the risk of penalties, healthcare facilities didn’t report outbreaks.

Twenty-one patients were infected with drug-resistant Acinetobacter baumannii at St. Anthony’s Medical Center in St. Louis, Missouri, from 2008 to 2011, according to a hospital spokesman. The microbe is a particular scourge of hospitals and nursing homes. St. Anthony’s took special steps to eradicate the bug, the spokesman said, but didn’t think the number of cases warranted reporting. Missouri defines an outbreak as illnesses “in excess of normal expectancy.”

Richard Armbruster, a 78-year-old former minor-league baseball pitcher, died two days after he tested positive for the infection while in St. Anthony’s for hip-replacement surgery in 2009.

“You know I’m so angry that they KNEW this bacteria was floating around their hospital in 2008!!!” his daughter, Amy Fix, wrote in an email after Reuters told her about the other cases. “Had that been reported to the authorities and the story picked up by the media, there is NO WAY we would’ve allowed my Dad to have his surgery there.”

The federal Centers for Medicare & Medicaid Services mandates that hospitals and long-term care facilities participating in the huge government insurance programs provide all necessary medical information when a patient is being transferred. However, the state outbreak reports Reuters reviewed showed that hospitals and nursing homes often do not alert each other when they transfer an infected patient, which can allow contagion to spread among multiple locations.

In Ohio, at least 22 patients were infected and seven died this year when an outbreak of antibiotic-resistant Acinetobacter baumannii spread through a hospital and seven long-term care facilities. The facilities frequently failed to warn each other when transferring infected patients. The public was never notified. Nor were the infected patients or their families told of the outbreak.

Jeanette Corey, whose 79-year-old father was the seventh to die, said hospital staff told her only that he had a mysterious infection.

“They were going around two weeks saying they don’t know what it is,” Corey said. “And it doesn’t dawn on someone to tell me,” she said, that “there was an outbreak of this bacteria going on – and that people had died?”

Ideal Targets

As Reuters reported in September, the Centers for Disease Control and Prevention, the national public health monitor, lacks regulatory power to track superbug deaths. It also lacks the authority to enforce outbreak reporting. Instead, it sometimes assists states with their outbreak investigations, a spokesman said, but each state decides which diseases must be reported.

Long-term care facilities—nursing homes, rehab centers and the like—are particularly vulnerable to outbreaks. A Reuters analysis of death certificates found that from 2003 to 2014, annual superbug-related deaths at long-term care facilities increased 62 percent, from about 1,400 to almost 2,300.

Patients in these facilities are ideal superbug targets—the chronically ill, the very old, and anyone else with a compromised immune system. Collected under one roof, these people are easy prey. New Mexico’s investigation report on Casa Maria, for instance, noted that C. difficile was not the sole cause of death of anyone in the outbreak, but was one of often many contributing factors.

In its emailed statement, Casa Maria said: “All C. Diff infections were resolved within two weeks and there were no deaths as a result of the C. Diff infection.”

A Mixed Bag

State outbreak reports often lack basic information, such as how many people were affected, the source of the outbreak, or when it began or ended. In 16 states, the name of the facility must be removed from the report by law before it is released.

In West Virginia, a local hospital alerted the Berkeley County Health Department in January 2011 that nine patients had tested positive for carbapenem-resistant Klebsiella pneumoniae. A joint investigation by the county and state health departments uncovered more cases. The authorities tracked most of the infections to patients transferred from a single long-term care facility, identified only as “LTCF A” in outbreak reports.

Even as the outbreak spread, health officials were prohibited by state law from publicly identifying the facility.

“I can tell you it was very hard to me to not to shout it out,” said Angie Gray, a public health nurse at the Berkeley County Health Department, which monitored the outbreak. “You want to say, ‘Don’t take your mom or dad here.’ ”

Using other information in the report, Reuters identified “LTCF A” as Heartland of Martinsburg, one of the largest nursing homes in the rural northeast corner of the state. The hospital that reported the outbreak was Berkeley Medical Center.

Among those infected was Harold P. Lewis of Arden, West Virginia. Lewis had a urinary tract infection when Heartland transferred him to Berkeley Medical Center, where he tested positive for the Klebsiella superbug in February 2011.

“I had never heard of that disease in my life,” said Marjorie Lewis, his widow. “They said it came from unsanitary conditions.” The hospital and nursing home bickered over which was responsible, she recalled: “They passed the buck back and forth.”

Lewis was sickened but survived. Marjorie said she transferred him to another nursing home after he fell out of his wheelchair and broke a leg. His health continued to deteriorate, she said, and he died in 2013, age 80.

She sued Heartland over the fall and “numerous urinary tract infections” that the lawsuit alleged he contracted while living there. The case was settled for an undisclosed amount.

A state investigation found that Heartland had no infection-prevention officer for nine months. Though signs warned staff to take contact precautions with certain patients, there were no gloves, masks or gowns nearby, and hand-washing stations were few and far between, the report said. As many as four patients shared a single bathroom.

The state Bureau for Public Health did not penalize Heartland. The facilities involved in the outbreak “worked to stop the spread of disease,” said bureau spokesman Toby Wagoner.

Mapping The Spread

At the state’s behest, Heartland began collecting cultures on its patients during the outbreak and sent them for testing to Berkeley Medical. Berkeley Medical also began testing all patients transferred from Heartland on admission.

Berkeley Medical lab manager Tambry Harvey said she had a floor plan of Heartland that she used to track the superbug’s spread from room to room. “It started with three patients, it turned into 11, and by the time I was done, the list was this long,” she said, waving toward a printout taped to a nearby wall that was nearly two feet long.

As of 2013, Harvey said, the lab had identified 40 patients with the superbug, including one who died, and 61 carriers – people who had no symptoms but could infect others. Most had been patients at Heartland, she said.

That year—more than two years into the outbreak—a resurgence of infections prompted the county to stop new admissions to Heartland for several days. Public health staff worked with the facility to improve infection control procedures. “That was considered an extreme measure, and it certainly got their attention,” said Dr. Diana Gaviria, Berkeley County health officer at the time.

During the outbreak, Heartland of Martinsburg was owned by HCR ManorCare, one of the largest nursing-home chains in the country. The company sold Heartland in 2015 to Stonerise Healthcare, which changed Heartland’s name to Clary Grove.

HCR ManorCare said: “We became aware of an issue in our center in 2011 and aggressively addressed it.” HCR’s owner, the giant private equity firm Carlyle Group, declined to comment.

Passing It Around

Reuters documented cases in which infected patients were transferred, sometimes multiple times, without any of the receiving facilities being notified. In some cases, the transferring facility knew of the infections. In others, it was unaware.

Bungled handoffs were the issue from January through September this year as a deadly Acinetobacter baumannii infection swept through healthcare facilities in three counties in south-central Ohio.

Staff at Adena Regional Medical Center in Chillicothe detected the superbug on an incoming transfer patient in January, said Julie McCray, the infection prevention manager there. Two more cases were detected on admission the next month. More appeared over the next couple of months.

McCray said nursing homes regularly failed to notify the hospital when sending patients with confirmed drug-resistant infections. By the time hospital staff discovered the information buried in the patient’s record or through lab tests, the bug might have spread.

She acknowledged, too, that while the hospital usually gave notice to the receiving facility when transferring an infected patient out, “sometimes it was missing.”

McCray didn’t contact local public health officials until late May, after the count had swelled to nine infections and five deaths. Ohio requires notice within one business day of an outbreak, which it defines as “above the expected” number of infections. McCray said she didn’t consider the case reportable until three patients died within two weeks in May.

Her move prompted an Ohio Department of Health investigation. It found that the same A. baumannii strain had spread through seven nursing homes, as well as Adena, and confirmed what McCray had suspected: That nursing homes were transferring infected patients without alerting the receiving facilities.

Jeanette Corey’s father, David Houser, had been in and out of the hospital and nursing homes for multiple ailments, when he was transferred to Adena in July with a suspected case of bacterial pneumonia. The nursing home he came from was Heartland of Chillicothe, owned by HCR ManorCare – the same company that owned Heartland of Martinsburg in West Virginia during that outbreak.

Corey said hospital staff told her they didn’t know what kind of infection her father had. And, she said, they never mentioned that the hospital was in the midst of an A. baumannii outbreak. A. baumannii can cause pneumonia, but McCray said medical records show Houser wasn’t tested for the superbug until Aug. 4, the day he died. Three days later, lab results confirmed the infection. The hospital didn’t wait for those results to complete Houser’s death certificate. Cause of death: “Congestive heart failure.” Adena confirmed that Houser was the seventh patient to die in the outbreak.

McCray said she left the decision of whether to inform patients and the community about the outbreak to health officials because the hospital was not the only source of the infections. “Was it our role to tell them or the health department’s?” she said.

An Ohio Department of Health spokeswoman said the outbreak wasn’t made public because “there are no national public health guidelines suggesting public notices in such instances.”

Adena Regional Medical Center and the nursing homes involved in the outbreak agreed at a Dec. 16 meeting to use a new form to alert other facilities when transferring infected patients, McCray said.

It wasn’t the only recent A. baumannii outbreak Ohio kept under wraps.

In the summer of 2015, three patients fell ill and one died at Galion Community Hospital, two hours north of Adena. Last winter, an hour north of Adena, a dozen patients fell ill and three died at Mount Carmel West. Adena was in the dark.

“That would have been good to know,” McCray said.

(Reporting by Deborah J. Nelson in Chillicothe, Ohio; David Rohde in Roswell, New Mexico; and Benjamin Lesser and Ryan McNeill in New York. Additional reporting by Yasmeen Abutaleb in San Francisco. Edited by John Blanton and Janet Roberts.)