Ethical Collection, Storage, and Use of Public Health Data: Title and subTitle BreakA Proposal for a National Privacy Protection

Public health agencies at all levels—local, state, and federal—collect, store, and use personal health and behavior data to meet their legal obligation to identify and control health threats or evaluate and improve public health programs or services. The foundation for this collection of health data is public trust, which requires maintaining the privacy and security of sensitive information. Despite its critical importance, there is no national standard for safeguarding data held by public health agencies. Instead, privacy safeguards are fragmented across 50 states, creating uncertain and inconsistent privacy protection.¹ During the 1990s, model laws were created to ensure uniform and strong privacy safeguards,² but countrywide adoption has proved difficult. The US Congress is currently debating privacy standards for electronic medical records,³ but these reforms do not include public health records because they are effectively exempt from the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.⁴ It is now time to consider a national strategy for protecting public health data.

Public health agencies rely heavily on access to identifiable health information to accomplish their core functions of monitoring health threats and responding to injury, disease, and disability among populations (eg, surveillance, program evaluation, preparedness, and outbreak investigations). However, federal privacy law effectively exempts public health data held at local and state agencies.

The HIPAA Privacy Rule safeguards personally identifiable health information contained in health care records.⁵ However, the Privacy Rule permits unauthorized disclosures of protected health information to public health authorities for specified public health activities, including reporting (disease, injury, child abuse or neglect, vital statistics); surveillance, investigations, and interventions; activities under Food and Drug Administration jurisdiction (adverse events, product recalls, postmarketing surveillance); notification of persons at risk of communicable disease; and medical surveillance in the workplace. Consequently, the rule permits public health authorities to engage in the full range of public health activities authorized by state law. Additionally, although the Privacy Rule preempts state and local law in other venues, it expressly does not preempt state and local law for public health reporting, surveillance, investigation, or intervention.⁶

Federal policy for the protection of human subjects, referred to as the Common Rule, safeguards privacy by requiring the consent of human research participants and ensuring ethical oversight.⁷ Intended for biomedical and behavioral research, the Common Rule also has been applied to public health research. Nevertheless, the distinction between “public health research” requiring Common Rule compliance and “public health practice” (which does not require regulatory compliance) has been highly challenging. Routine public health activities such as surveillance, program evaluations, and outbreak investigations often have characteristics similar to research. However, they are an essential part of a state's historic and constitutional police powers.⁸ Consequently, public health advocates have argued convincingly that public health practice activities be exempt from the Common Rule.⁹

To maintain the public's trust, fundamental reform is essential to safeguard the privacy of all data held by public health agencies, regardless of whether the activity is classified as research or practice. These data protections should be consistent with effective and flexible public health action. Although public health professionals have a good track record of safeguarding sensitive information, the privacy and security risks will increase with the rapid changes in technology and calls for more accountability and transparency about how data are handled.¹⁰ The ease with which data are stored, matched, and shared electronically could mean more opportunities for inadvertent or malevolent releases of personally identifiable data. Vulnerabilities in data security, ranging from physical and electronic breaches to sanitizing and disposing electronic devices no longer in use, raise critical concerns for all public health programs.

Based on a review of existing guidance on data use from internal Centers for Disease Control and Prevention programs, ideas from the model legislation developed in the 1990s,² and related work,¹¹ we propose the following ethical guidelines for the collection, storage, and use of public health data, with application across the public health enterprise—at the local, state, tribal, and federal levels, across categorical programs, and in accordance with key public health values.¹² In particular, the guidelines should include the values of interdependence (data uses and disclosures have unanticipated effects on others), ethical oversight (independent review of privacy and security procedures), and scientific evidence (the best evidence should support all public health data acquisition and use). In addition to existing applicable legal requirements, this ethical guidance should cover data from the moment they enter the public health arena at the smallest local jurisdiction and apply through the life of the data, regardless of level at which the data finally reside.

To ensure this formal guidance moves beyond ethical considerations to an action-oriented approach, each guideline will require further specification. This might take the form of minimum expectations for program functioning in a particular area and possible ways to meet these expectations. The ultimate goal is to guide the public health practitioner at each level to determine a course of action in a given situation. Engaging the public health community in the development of these guidelines is critical. As policy makers seek uniform ethical oversight of medical practice and research information,⁴ data held by public health officials will soon be considered in need of similar protections.

Adopting standard, consistent ethical guidelines for data security and privacy across the public health infrastructure will safeguard not only data, but also the public's trust in the nation's public health enterprise.