Expert Meeting on Privacy, Confidentiality, and Other Legal and ...
Expert Meeting on Privacy, Confidentiality, and Other Legal and ...
Expert Meeting on Privacy, Confidentiality, and Other Legal and ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
VOLUME 7NUMBER 2DATE 2009<str<strong>on</strong>g>Expert</str<strong>on</strong>g> <str<strong>on</strong>g>Meeting</str<strong>on</strong>g> <strong>on</strong> <strong>Privacy</strong>, C<strong>on</strong>fidentiality, <strong>and</strong> <strong>Other</strong> <strong>Legal</strong> <strong>and</strong> Ethical Issues inSyndromic SurveillanceReport from an Internati<strong>on</strong>al Society for Disease Surveillance C<strong>on</strong>sultati<strong>on</strong>Washingt<strong>on</strong> DC, October 4–5, 2007Michael A. Stoto, 1 James X. Dempsey, 2 Atar Baer, 3 Christopher Cassa, 4 P. Joseph Gibs<strong>on</strong>, 5<strong>and</strong> James W. Buehler 61Department of Health Systems Administrati<strong>on</strong>, School of Nursing <strong>and</strong> Health Studies, Georgetown University, Washingt<strong>on</strong> DC.2Center for Democracy <strong>and</strong> Technology, Washingt<strong>on</strong> DC.3Public Health, Seattle <strong>and</strong> King County, Seattle, WA.4Massachusetts Institute of Technology, Cambridge, MA.5Health <strong>and</strong> Hospital Corporati<strong>on</strong> of Mari<strong>on</strong> County, Indianapolis, IN.6Epidemiology Department <strong>and</strong> Center for Public Health Preparedness <strong>and</strong> Research, Rollins School of Public Health, EmoryUniversity, Atlanta, GA.For syndromic <strong>and</strong> related public health surveillance systems to be effective, health departments need accessto a variety of types of health data. Since the development <strong>and</strong> implementati<strong>on</strong> of syndromic surveillancesystems in recent years, health departments’ experience in gaining access to pers<strong>on</strong>al health informati<strong>on</strong> forsyndromic surveillance has been mixed. Although the HIPAA <strong>Privacy</strong> Rule permits health care providers to discloseprotected health informati<strong>on</strong> without patients’ c<strong>on</strong>sent to public health agencies for authorized purposes,some health care providers have cited HIPAA in refusing to provide data for syndromic surveillance. Bey<strong>on</strong>dHIPAA, a variety of federal, state, <strong>and</strong> local public health laws enable, restrict, <strong>and</strong> otherwise influence the sharingof health informati<strong>on</strong> between health care providers <strong>and</strong> public health agencies for surveillance, as well asresearch, purposes. To address these issues in the c<strong>on</strong>text of syndromic surveillance practice, an expert meetingwas c<strong>on</strong>vened to (a) share experiences regarding privacy, c<strong>on</strong>fidentiality, <strong>and</strong> other legal <strong>and</strong> ethical issues;(b) clarify how these legal <strong>and</strong> ethical issues enable or c<strong>on</strong>strain data sharing; <strong>and</strong> (c) identify approaches toprotect privacy <strong>and</strong> c<strong>on</strong>fidentiality.Rooted in the principle that state <strong>and</strong> local governments have inherent <strong>and</strong> broad powers to protect the health,safety <strong>and</strong> welfare of the people, public health agencies have the authority to collect pers<strong>on</strong>al health informati<strong>on</strong>,including the power to compel disclosure of such data under certain c<strong>on</strong>diti<strong>on</strong>s. The precise limits of thesepublic health powers have never been defined, however, <strong>and</strong> are limited by <strong>and</strong> must be balanced with the rightof privacy. Although existing laws <strong>and</strong> regulati<strong>on</strong>s provide little clarity <strong>on</strong> how to balance disclosure risks <strong>and</strong>potential benefits of public health acti<strong>on</strong>s that reas<strong>on</strong>ably follow from surveillance, guidance can be found inthe principles known as the “Fair Informati<strong>on</strong> Practices.” Two specific fair informati<strong>on</strong> practices—specificati<strong>on</strong> ofpurpose <strong>and</strong> limitati<strong>on</strong> <strong>on</strong> sec<strong>on</strong>dary use—are especially critical for syndromic surveillance.C<strong>on</strong>sidering these principles should help health officials to determine what level of health informati<strong>on</strong> detail,<strong>and</strong> thus what level of potential ability to identify individuals, is needed for the intended public health purpose,<strong>and</strong> whether surveillance will lead to effective public health acti<strong>on</strong>. The principles also suggest a number ofstrategies for dealing with c<strong>on</strong>cerns that the public or health care providers may have about sharing data withpublic health agencies: (a) improve communicati<strong>on</strong> with the public about how data are used to safeguard the1 Advances in Disease Surveillance 2009;7:2
2 Stoto et al.populati<strong>on</strong>’s health <strong>and</strong> how c<strong>on</strong>fidentiality is protected; (b) further develop approaches to sharing data in aggregateor de-identified form that have capability to link back to identified data when necessary; (c) further developstatistical approaches to an<strong>on</strong>ymizati<strong>on</strong> <strong>and</strong> aggregati<strong>on</strong>; <strong>and</strong> (d) c<strong>on</strong>duct evaluati<strong>on</strong> research <strong>and</strong> case studiesthat dem<strong>on</strong>strate utility <strong>and</strong> clarify how privacy <strong>and</strong> c<strong>on</strong>fidentiality are protected.INTRODUCTIONFor syndromic <strong>and</strong> related public health surveillancesystems to be effective, state <strong>and</strong> local health departments<strong>and</strong> the Centers for Disease C<strong>on</strong>trol <strong>and</strong> Preventi<strong>on</strong> (CDC)need access to a variety of types of health data. Since thedevelopment <strong>and</strong> implementati<strong>on</strong> of syndromic surveillancesystems in recent years, health departments have gainedvaried levels of access to pers<strong>on</strong>al health informati<strong>on</strong> forinclusi<strong>on</strong> in these systems. A variety of federal, state, <strong>and</strong>local laws enable, restrict, <strong>and</strong> otherwise influence the sharingof health informati<strong>on</strong> between health care providers <strong>and</strong>public health agencies for surveillance, as well as research,purposes. Some health care providers have expressed reluctanceor refused to provide identifiable data for syndromicsurveillance to health departments (1), citing state privacylaws or the Health Insurance Portability <strong>and</strong> AccountabilityAct of 1996 (HIPAA) <strong>Privacy</strong> Rule (2). Although the HIPAA<strong>Privacy</strong> Rule permits health care providers to disclose protectedhealth informati<strong>on</strong> without patients’ c<strong>on</strong>sent to publichealth agencies for authorized purposes, it does not supersedestate laws that provide greater protecti<strong>on</strong> of individualprivacy (2,3).The use of individuals’ health informati<strong>on</strong> for syndromicsurveillance poses challenging questi<strong>on</strong>s regarding theinterpretati<strong>on</strong> <strong>and</strong> future development of ethical <strong>and</strong> legalst<strong>and</strong>ards for public health practice <strong>and</strong> research. While thepractice of syndromic surveillance extends the l<strong>on</strong>gst<strong>and</strong>ingtraditi<strong>on</strong> of public health surveillance as an essential elementof public health practice (4), it raises in a new lightequally l<strong>on</strong>gst<strong>and</strong>ing questi<strong>on</strong>s about governments’ authorityto collect <strong>and</strong> use health informati<strong>on</strong> (5). As the practiceof syndromic surveillance evolves, it is in the nati<strong>on</strong>al interestto clarify the c<strong>on</strong>diti<strong>on</strong>s under which health informati<strong>on</strong>can be shared, the ways that privacy <strong>and</strong> c<strong>on</strong>fidentialitycan be protected, <strong>and</strong> the ways that local, state, <strong>and</strong> federalpublic health agencies can legally, ethically, <strong>and</strong> effectivelyexercise their respective resp<strong>on</strong>sibilities to detect, m<strong>on</strong>itor,<strong>and</strong> resp<strong>on</strong>d to public health threats.CONSULTATION OBJECTIVES AND PROCESSTo address these issues, Georgetown University’s O’NeillInstitute for Nati<strong>on</strong>al <strong>and</strong> Global Health Law, with supportfrom the Internati<strong>on</strong>al Society for Disease Surveillance(ISDS), c<strong>on</strong>vened 17 experts in syndromic surveillance <strong>and</strong>related areas in Washingt<strong>on</strong>, DC, <strong>on</strong> October 4–5, 2007. Themeeting focused <strong>on</strong> the development, use, <strong>and</strong> evaluati<strong>on</strong>of syndromic surveillance. Its objectives were (a) to shareexperiences regarding privacy, c<strong>on</strong>fidentiality, <strong>and</strong> otherlegal <strong>and</strong> ethical issues; (b) to clarify how these legal <strong>and</strong>ethical issues enable or c<strong>on</strong>strain data sharing; <strong>and</strong> (c) toidentify approaches to protect privacy <strong>and</strong> c<strong>on</strong>fidentiality.The participants are listed in Appendix I, <strong>and</strong> the c<strong>on</strong>sultati<strong>on</strong>agenda appears in Appendix II. This report summarizesthe proceedings of the c<strong>on</strong>sultati<strong>on</strong>. The participants had anopportunity to comment <strong>on</strong> earlier drafts, but do not necessarilyagree with every c<strong>on</strong>clusi<strong>on</strong> in this report. Moreover,this report does not represent the official positi<strong>on</strong> of the participants’agencies or organizati<strong>on</strong>s or the ISDS.BACKGROUND AND ASSUMPTIONSFor the purpose of the c<strong>on</strong>sultati<strong>on</strong>, the participants choseto define “syndromic surveillance” broadly to include nearreal-time acquisiti<strong>on</strong> <strong>and</strong> use of n<strong>on</strong>clinical or prediagnostichealth data for populati<strong>on</strong> health m<strong>on</strong>itoring purposes. Inthis sense, prediagnostic refers to informati<strong>on</strong> <strong>on</strong> symptoms<strong>and</strong> stages of a patient’s illness before a diagnosis is established.Because these systems emphasize timeliness betweenthe health-related events <strong>and</strong> when trends in these events canbe m<strong>on</strong>itored, they typically use data that are routinely collected<strong>and</strong> stored electr<strong>on</strong>ically <strong>and</strong> automate the process ofdata collecti<strong>on</strong>, management, <strong>and</strong> analysis to detect unusualpatterns such as unexpected numbers of cases.Participants held a range of views <strong>on</strong> the effectivenessof syndromic surveillance for achieving different goals. Itwas not the purpose of the c<strong>on</strong>sultati<strong>on</strong> to address, let al<strong>on</strong>eresolve, questi<strong>on</strong>s of effectiveness. However, the legal justificati<strong>on</strong>for different methods of surveillance is rooted in thepresumpti<strong>on</strong> that the informati<strong>on</strong> obtained will lead to effectivepublic health acti<strong>on</strong>, so questi<strong>on</strong>s of effectiveness arerelevant. In this c<strong>on</strong>text, participants noted that the purposeof syndromic surveillance in public health practice is shiftingfrom an emphasis <strong>on</strong> the early detecti<strong>on</strong> of bioterrorismor other infectious disease outbreaks to other uses, includingidentificati<strong>on</strong> of potential cases of notifiable disease, surveillancefor n<strong>on</strong>infectious c<strong>on</strong>diti<strong>on</strong>s such as chr<strong>on</strong>ic diseasesor injuries, <strong>and</strong> “situati<strong>on</strong>al awareness.” Such uses includefollowing up potential cases when aberrant trends aredetected, m<strong>on</strong>itoring the course of outbreaks, m<strong>on</strong>itoringseas<strong>on</strong>al illnesses such as influenza <strong>and</strong> viral gastroenteritis,<strong>and</strong> preparing for surveillance of p<strong>and</strong>emic influenza.It is important to note that the practical <strong>and</strong> legal justificati<strong>on</strong>for surveillance is based <strong>on</strong> public health agencies’Advances in Disease Surveillance 2009;7:2
<strong>Privacy</strong>, C<strong>on</strong>fidentiality, <strong>and</strong> <strong>Other</strong> <strong>Legal</strong> <strong>and</strong> Ethical Issues in Syndromic Surveillance 3resp<strong>on</strong>sibility to m<strong>on</strong>itor <strong>and</strong> to take acti<strong>on</strong> when necessaryto protect the community’s health. Such acti<strong>on</strong>s comprise aspectrum of public health activities, ranging from individualcase follow-up to program evaluati<strong>on</strong> <strong>and</strong> policy development.These varying uses of surveillance result in varyinglevels of need for detailed informati<strong>on</strong>, for pers<strong>on</strong>al identifiers,<strong>and</strong> for timely data. For example, in some instances, datamay be needed daily to detect infectious disease outbreaks<strong>and</strong> resp<strong>on</strong>d in a timely way. In other instances, annual datamay be sufficient to guide programs, allocate resources, orset policies.Effective use of syndromic data sometimes requires thatpublic health epidemiologists have some capacity to “drilldown” or examine the data in more detail when aberranttrends are detected. This need derives from an importantattribute of syndromic surveillance: in order to assure thatsystems have sufficient sensitivity to detect events of publichealth significance, the systems inherently generate a sizeablenumber of statistical “false alarms” due to r<strong>and</strong>om variati<strong>on</strong>in the data. Epidemiologists are able to dismiss someof these alerts by interpreting them in the c<strong>on</strong>text of theirknowledge <strong>and</strong> experience, including reviewing the syndromicdata in greater depth or c<strong>on</strong>sidering the data in thec<strong>on</strong>text of other informati<strong>on</strong>. However, when these analyticmethods are insufficient <strong>and</strong> the initial assessment of thealert raises sufficient c<strong>on</strong>cern, it may be necessary to identifyindividuals in order to c<strong>on</strong>duct further investigati<strong>on</strong>s.Health departments represented at the meeting receivepatient-level data from local hospitals in a wide variety ofways: (a) without any patient identifiers; (b) with the hospitals’medical record number; (c) with a code generated specificallyfor such reporting; <strong>and</strong> (d) with a combinati<strong>on</strong> ofthese methods. Participants noted that in some public healthdepartments epidemiologists have direct access to hospitalinformati<strong>on</strong> systems, particularly if the hospital is managedby a public health agency, enabling them to c<strong>on</strong>duct preliminaryfollow-up assessments of alerts without troublinghospital staff. In <strong>on</strong>e jurisdicti<strong>on</strong>, data are shared througha preexisting Regi<strong>on</strong>al Health Informati<strong>on</strong> Organizati<strong>on</strong>(RHIO). In another, complete identified data are shared forpatients with certain pre-identified c<strong>on</strong>diti<strong>on</strong>s, <strong>and</strong> the list ofc<strong>on</strong>diti<strong>on</strong>s can be exp<strong>and</strong>ed through a formal approval process.For those hospitals that provide detailed clinical <strong>and</strong>diagnostic data to the CDC’s BioSense program, CDC hasthe capacity to c<strong>on</strong>duct detailed follow-back assessmentswith data maintained at CDC (6,7).In practice, a variety of c<strong>on</strong>cerns can discourage or evenprevent the sharing of data for syndromic surveillance purposes.Most prominent am<strong>on</strong>g them are c<strong>on</strong>cerns aboutpatient privacy <strong>and</strong> c<strong>on</strong>fidentiality that are reflected in variousfederal, state, <strong>and</strong> local laws <strong>and</strong> regulati<strong>on</strong>s <strong>and</strong> in theHIPAA <strong>Privacy</strong> Rule (2,3), <strong>and</strong> in varying interpretati<strong>on</strong>s ofthese laws <strong>and</strong> regulati<strong>on</strong>s, by health care providers <strong>and</strong> publichealth agencies. CDC technical guidance <strong>and</strong> stipulati<strong>on</strong>sattached to the funding also shape health departments’ privacy<strong>and</strong> c<strong>on</strong>fidentiality practices. In additi<strong>on</strong>, data ownersmay be willing to share data with their local or statehealth department but may have c<strong>on</strong>cerns about potentialsubsequent access <strong>and</strong> use by others, including researchers,agencies aside from public health departments, or the federalgovernment. The pers<strong>on</strong>nel or other operati<strong>on</strong>al costs ofsharing data, as well as proprietary c<strong>on</strong>cerns <strong>and</strong> turf issues,may also discourage data owners from sharing informati<strong>on</strong>with public health agencies.Local health departments also express c<strong>on</strong>cern aboutinformati<strong>on</strong> overload, including the large numbers of falsepositives alerts that nevertheless require preliminary investigati<strong>on</strong>s,<strong>and</strong> about their ability to interpret surveillancereports for higher-level authorities. The sense that the effectivenessof syndromic surveillance is not yet proven, especiallyfor early detecti<strong>on</strong> of bioterrorist attacks, can alsodiscourage sharing data.LEGAL AUTHORITIES FOR SYNDROMICSURVEILLANCEAt its core, public health surveillance st<strong>and</strong>s <strong>on</strong> firm legalfooting, rooted in the principle that the state governmentshave inherent <strong>and</strong> broad sovereign power (comm<strong>on</strong>ly calledthe “police power”) to provide for the health, safety, <strong>and</strong>welfare of the people. It has l<strong>on</strong>g been recognized that thispower includes the authority to collect pers<strong>on</strong>al informati<strong>on</strong>,including the power to compel disclosure of health data forsufficiently justifiable purposes. The precise limits of thepolice power have never been defined. Specifically withrespect to informati<strong>on</strong> collecti<strong>on</strong> <strong>and</strong> disclosure, the policepower is limited by c<strong>on</strong>stituti<strong>on</strong>al protecti<strong>on</strong> of the right toprivacy in <strong>on</strong>e’s pers<strong>on</strong>al medical informati<strong>on</strong>. The scopeof this right to informati<strong>on</strong> privacy also remains unsettled.Typically, the purpose of a data collecti<strong>on</strong> program is balancedagainst the loss of privacy it may entail. Though theU.S. Supreme Court has upheld reporting requirementsgenerally (7), the absence of specific guidance from theCourt makes it difficult to determine how to strike the balancebetween the potential benefits of public health acti<strong>on</strong>s<strong>and</strong> risks to privacy in public health surveillance systemslike syndromic surveillance. In these circumstances, publichealth officials must use their authority judiciously inorder to maintain public support <strong>and</strong> ultimately legislativeapproval to retain this authority (8,9).Compounding the questi<strong>on</strong>s inherent in the c<strong>on</strong>ceptof privacy <strong>and</strong> its codificati<strong>on</strong> in the HIPAA Rule, publichealth officials are dealing with rapid changes in the natureof health care <strong>and</strong> public health itself. First, there is a trendtoward the digitizati<strong>on</strong> of medical records <strong>and</strong> the ability totransfer large quantities of data by electr<strong>on</strong>ic means <strong>and</strong> toanalyze them by sophisticated statistical techniques, creatingthe opportunity for public health to access more data, inAdvances in Disease Surveillance 2009;7:2
4 Stoto et al.greater detail. These capabilities may generate both greaterpublic c<strong>on</strong>cerns about privacy <strong>and</strong> greater public expectati<strong>on</strong>sabout the ability of health departments to automaticallydetect unusual disease trends <strong>and</strong> m<strong>on</strong>itor populati<strong>on</strong>health status.A sec<strong>on</strong>d trend is the growing public health emphasis<strong>on</strong> an exp<strong>and</strong>ing array of n<strong>on</strong>infectious c<strong>on</strong>diti<strong>on</strong>s, such aschr<strong>on</strong>ic diseases, disabilities, injuries, or reproductive healthoutcomes <strong>and</strong> their behavioral or envir<strong>on</strong>mental antecedents.Surveillance for n<strong>on</strong>infectious c<strong>on</strong>diti<strong>on</strong>s has l<strong>on</strong>g been partof modern public health practice, but the growing emphasis<strong>on</strong> health promoti<strong>on</strong> <strong>and</strong> preventi<strong>on</strong> of a large spectrum ofdiseases has exp<strong>and</strong>ed the scope of what data are of value topublic health programs <strong>and</strong> policies (10).A third trend is the increasing role of the federal governmentin public health. Unlike the states, the federal governmentdoes not have general police powers, <strong>and</strong> its authorityto collect public health data rests <strong>on</strong> less comprehensivegrounds, such as nati<strong>on</strong>al defense, immigrati<strong>on</strong>, regulati<strong>on</strong>of interstate commerce, the ability to attach c<strong>on</strong>diti<strong>on</strong>s tofederal spending, <strong>and</strong> border c<strong>on</strong>trol. However, in recentyears, particularly since 9/11, heightened c<strong>on</strong>cerns withbioterrorism <strong>and</strong> naturally emerging microbial threats haveaccelerated the expansi<strong>on</strong> of federally managed <strong>and</strong> federallyfunded public health activity. Some of these initiativesinvolve the transfer of large volumes of data to the federalgovernment, bypassing the traditi<strong>on</strong>al role of local <strong>and</strong> statehealth departments in managing the collecti<strong>on</strong> of surveillancedata <strong>and</strong> transferring it to a federal database for analysis<strong>and</strong> possible acti<strong>on</strong>. Notably, CDC’s BioSense programinvolves the transfer of large volumes of data directly fromparticipating hospitals to the federal government, bypassingthe traditi<strong>on</strong>al role of local or state health departments inmanaging the collecti<strong>on</strong> of surveillance data, <strong>and</strong> transferringit to a federal database for analysis <strong>and</strong> possible acti<strong>on</strong>(6). * A wide variety of federal, state, <strong>and</strong> local laws <strong>and</strong> regulati<strong>on</strong>sauthorize <strong>and</strong> regulate public health surveillanceactivities as well as seek to protect privacy <strong>and</strong> c<strong>on</strong>fidentiality(8). In additi<strong>on</strong> to the federal c<strong>on</strong>stituti<strong>on</strong>al right to privacy,there are state comm<strong>on</strong>-law rules, statutes, <strong>and</strong> somestate c<strong>on</strong>stituti<strong>on</strong>al provisi<strong>on</strong>s that protect rights of privacyin medical informati<strong>on</strong>. The laws of many states generallyforbid physicians <strong>and</strong> other care providers from disclosinga patient’s identifiable informati<strong>on</strong> without the patient’sc<strong>on</strong>sent. For this reas<strong>on</strong>, specific state legislati<strong>on</strong> may be*While the BioSense program still includes hospitals that reportdetailed clinical data directly to CDC, efforts to recruit additi<strong>on</strong>alhospitals to report in this manner has been superseded by a strategyto obtain less detailed informati<strong>on</strong> from existing local or statesyndromic surveillance networks, restoring the traditi<strong>on</strong>al pathwayfor health informati<strong>on</strong> flow to CDC, <strong>and</strong> to a l<strong>on</strong>ger-term strategythat extends the use of decentralized surveillance methods (6).required to authorize state public health agencies to collect<strong>and</strong> use identifiable pers<strong>on</strong>al informati<strong>on</strong> for public healthpurposes. As noted earlier, the c<strong>on</strong>stituti<strong>on</strong>ality of theselaws depends up<strong>on</strong> whether the state’s reas<strong>on</strong> for collectingthe data outweighs individuals’ reas<strong>on</strong>able expectati<strong>on</strong>s ofprivacy in the informati<strong>on</strong>. Many of these laws date froml<strong>on</strong>g before the introducti<strong>on</strong> of electr<strong>on</strong>ic data systems orgrowing federal involvement in public health surveillance; itis unclear whether the legislatures intended the kinds of datasharing c<strong>on</strong>templated by today’s programs. Indeed, syndromicsurveillance per se is the subject of <strong>on</strong>ly a few veryrecent <strong>and</strong> specific laws that specifically authorize or m<strong>and</strong>ateparticipati<strong>on</strong> in local or state syndromic surveillancenetworks. Elsewhere, public health agencies have adoptedregulati<strong>on</strong>s or initiated syndromic surveillance under theumbrella of existing public health reporting laws.Specific laws setting out detailed reporting requirementsfor syndromic surveillance may make it easier for data ownersto share data with public health authorities. However,in the absence of such specific laws—or in the politicalprocess needed to develop a reporting law for syndromicsurveillance—health departments <strong>and</strong> health care providersare underst<strong>and</strong>ably left with a lot of questi<strong>on</strong>s because ofdifferences in what is meant by “syndromic surveillance,”differing federal, state <strong>and</strong> local resp<strong>on</strong>sibilities, <strong>and</strong> c<strong>on</strong>fusi<strong>on</strong>about the HIPAA <strong>Privacy</strong> Rule. As a result, the currentlegal framework for syndromic surveillance does notprovide clear guidance to public health practiti<strong>on</strong>ers. Thereis a need for a rati<strong>on</strong>al framework that can guide policymakers<strong>and</strong> public health professi<strong>on</strong>als as they necessarily <strong>and</strong>appropriately seek to balance disclosure risks against potentialbenefits of public health acti<strong>on</strong>s that reas<strong>on</strong>ably followfrom surveillance <strong>and</strong> against competing public health priorities<strong>and</strong> broader societal interests.The HIPAA <strong>Privacy</strong> Rule <strong>and</strong> Syndromic SurveillanceAlthough a variety of laws <strong>and</strong> regulati<strong>on</strong>s both enable<strong>and</strong> restrict public health surveillance, health officials, policymakers, <strong>and</strong> others typically focus their attenti<strong>on</strong> <strong>on</strong> theHIPAA <strong>Privacy</strong> Rule (11). This rule generally governs thedisclosure of pers<strong>on</strong>ally identifiable health informati<strong>on</strong> byhospitals <strong>and</strong> other health care providers (called “coveredentities”). HIPAA provides an important additi<strong>on</strong> to the lawsgoverning health privacy in the United States, but it doesnot supersede (preempt) applicable state laws that providegreater privacy protecti<strong>on</strong>. The HIPAA <strong>Privacy</strong> Rule has alsobeen the subject of c<strong>on</strong>siderable c<strong>on</strong>fusi<strong>on</strong> <strong>and</strong> c<strong>on</strong>troversy.The complexity of the rule <strong>and</strong> the ambiguities surroundingkey terms often lead to differences of opini<strong>on</strong> about what ispermissible <strong>and</strong> what is not.A key attribute of the HIPAA <strong>Privacy</strong> Rule is that it applies<strong>on</strong>ly to disclosures of “individually identifiable health informati<strong>on</strong>.”While there is debate about what is “identifiable,”Advances in Disease Surveillance 2009;7:2
<strong>Privacy</strong>, C<strong>on</strong>fidentiality, <strong>and</strong> <strong>Other</strong> <strong>Legal</strong> <strong>and</strong> Ethical Issues in Syndromic Surveillance 5the rule clearly c<strong>on</strong>templates disclosures of de-identifieddata without patient authorizati<strong>on</strong>. However, because surveillanceparameters such as the date of health care visits,the Zip code or country of residence are c<strong>on</strong>sidered as “identifiers”by HIPAA, there is a wide range of syndromic surveillancefuncti<strong>on</strong>s that could not be exempt from HIPAA<strong>on</strong> this basis al<strong>on</strong>e.In the public health sphere, c<strong>on</strong>troversy has centered <strong>on</strong>the rule’s excepti<strong>on</strong> permitting disclosure without patientauthorizati<strong>on</strong> of individually identifiable data for “publichealth activities <strong>and</strong> purposes.” Specifically, the HIPAArule allows a “covered entity” such as a hospital to discloseprotected informati<strong>on</strong> to(i) A public health authority that is authorized by lawto collect or receive such informati<strong>on</strong> for the purposeof preventing or c<strong>on</strong>trolling disease, injury, or disability,including, but not limited to, the reporting of disease,injury, vital events such as birth or death, <strong>and</strong> thec<strong>on</strong>duct of public health surveillance, public healthinvestigati<strong>on</strong>s, <strong>and</strong> public health interventi<strong>on</strong>s; or, atthe directi<strong>on</strong> of a public health authority, to an officialof a foreign government agency that is acting in collaborati<strong>on</strong>with a public health authority (12).This excepti<strong>on</strong> is not limited to disclosures of so-called“notifiable diseases,” the specified diseases or c<strong>on</strong>diti<strong>on</strong>sthat health care providers are required by law to report topublic health authorities. Rather, disclosure can be made forpatients with other c<strong>on</strong>diti<strong>on</strong>s in circumstances where publichealth officials have the authority to investigate unusualcases or clusters of disease that may herald or represent abroader threat to public health.This provisi<strong>on</strong> is qualified in that such release of informati<strong>on</strong>is limited to “the minimum necessary informati<strong>on</strong> toaccomplish the intended public health purpose of the disclosure”(10), except for disclosures that are m<strong>and</strong>ated by stateor local law. In the absence of a state or local law requiringdisclosure, the “minimum necessary” st<strong>and</strong>ard introducessome uncertainty. For purposes of syndromic surveillance,public health agencies have defined this minimum in variousways, with varying degrees of acceptance by hospitals <strong>and</strong>other health care providers. In particular, the minimum necessarydeterminati<strong>on</strong> depends <strong>on</strong> a range of factors, includingthe purpose <strong>and</strong> scope of the program (is it focused <strong>on</strong>bioterrorism, looking for patterns indicative of an infectiousdisease epidemic, or collecting data <strong>on</strong> any problem or c<strong>on</strong>diti<strong>on</strong>that might be of public health c<strong>on</strong>cern?) <strong>and</strong> the possiblepublic health acti<strong>on</strong>s that might be taken in resp<strong>on</strong>se to theinformati<strong>on</strong> (will some of these acti<strong>on</strong>s require public healthofficials to c<strong>on</strong>tact individual patients or ask clinicians to reidentifyindividual patients to obtain further informati<strong>on</strong>?).In an effort to define “individually identifiable,” theHIPAA Rule provides different ways to ensure that dataare sufficiently stripped of identifying informati<strong>on</strong> so thatthey can be disclosed without patient authorizati<strong>on</strong>. Thefirst, sometimes referred to as “the safe harbor,” is to stripthe data of 18 specified kinds of informati<strong>on</strong> that could beused to re-identify individuals (13). A sec<strong>on</strong>d, less extremeapproach (intended to make data available for research purposes)is to strip out all obvious identifiers, while leaving insome informati<strong>on</strong> such as Zip Code of the place of residence<strong>and</strong> age group. The resulting data are called a “limited dataset,” which can be disclosed if the covered entity obtains satisfactoryassurance, in the form of a “data use agreement,”that establishes who is permitted to use the limited data set<strong>and</strong> for what purposes, <strong>and</strong> that the recipient will not use itfor other purposes <strong>and</strong> will safeguard it appropriately (11).Under either of these approaches, the <strong>Privacy</strong> Rule permitsa covered entity to assign to, <strong>and</strong> retain with, the de-identifiedhealth informati<strong>on</strong>, a code or other means of recordre-identificati<strong>on</strong> if that code is not derived from or relatedto the informati<strong>on</strong> about the individual <strong>and</strong> is not otherwisecapable of being translated to identify the individual.Another issue facing public health officials is whethersome data collecti<strong>on</strong> <strong>and</strong> assessment activities should bec<strong>on</strong>sidered research. Research at instituti<strong>on</strong>s receiving federalresearch funds must c<strong>on</strong>form to federal regulati<strong>on</strong>s thatprotect human subjects in research <strong>and</strong> require instituti<strong>on</strong>alreview board (IRB) approval. If a public health activity isresearch, then the questi<strong>on</strong> also arises as to whether the publichealth or research exempti<strong>on</strong>s in HIPAA apply (2,11,14).This distincti<strong>on</strong> is sometimes unclear or debatable (15,16), aswas evident from the differing views of meeting participants.As a result, the participants did not attempt to clarify orredefine this boundary in the c<strong>on</strong>text of syndromic surveillancedevelopment, operati<strong>on</strong>, or evaluati<strong>on</strong>. However, to theextent that surveillance is c<strong>on</strong>ducted for research purposesrather than for authorized public health functi<strong>on</strong>s, it is likelyto be subject to the c<strong>on</strong>sent requirements of applicable laws.In other words, agencies that c<strong>on</strong>duct surveillance must bealert to the purpose for which they collect data, because thepurpose <strong>and</strong> use of the data—research versus public healthpractice—largely determine what laws apply.FAIR INFORMATION PRACTICESIn the absence of definitive court decisi<strong>on</strong>s or law fullyspecifying what data can be collected <strong>and</strong> used for differentpurposes, those working in syndromic surveillance can seekguidance from the principles known as the fair informati<strong>on</strong>practices (FIPs).” The FIPs are a widely accepted privacyframework, first developed in the 1970s by an AdvisoryCommittee to the U.S. Department of Health, Educati<strong>on</strong> <strong>and</strong>Welfare, <strong>and</strong> later refined <strong>and</strong> exp<strong>and</strong>ed. They have beenembodied in privacy or “data protecti<strong>on</strong>” law worldwide,serving as the basis for directives of the European Uni<strong>on</strong>,influential guidelines of the Organizati<strong>on</strong> for Ec<strong>on</strong>omicCooperati<strong>on</strong> <strong>and</strong> Development, <strong>and</strong> an emerging privacyAdvances in Disease Surveillance 2009;7:2
6 Stoto et al.framework in Asia. In the United States, the FIPs can befound in the federal <strong>Privacy</strong> Act (17), which is generallyapplicable to all U.S. government systems of records, <strong>and</strong> inother federal privacy laws. Most importantly, the FIPs servedas the basis for the HIPAA <strong>Privacy</strong> Rule, although that ruleis so complicated that it is hard to discern the framework.There are various formulati<strong>on</strong>s of FIPs, but we find thefollowing 10 to be most comprehensive <strong>and</strong> useful as aframework for c<strong>on</strong>sidering the privacy issues raised in syndromicsurveillance practice. The relevance <strong>and</strong> implicati<strong>on</strong>sfor the FIPs for syndromic surveillance are discussedin the next secti<strong>on</strong>.1. Notice (or openness). An entity (in this case, both theentity that engages with the patient <strong>and</strong> the public healthauthority) should disclose when it is collecting data <strong>and</strong>specify what data it is collecting, through a publishednotice <strong>and</strong> wherever possible <strong>on</strong> an individual basis.Sometimes notice is combined with individual choiceor c<strong>on</strong>sent, which may be expressed through an opt-outor an opt-in. Public health uses, however, may not besubject to a requirement of individual c<strong>on</strong>sent, at leastnot when disclosure is required by law.2. Purpose specificati<strong>on</strong>. The notice should specify thepurpose for which data is being collected. This importantprinciple impels the data collector to think throughin advance what are all the purposes for which the datawill or could be used.3. Collecti<strong>on</strong> limitati<strong>on</strong>. The entity collecting data shouldcollect no more than is relevant <strong>and</strong> necessary for thespecified purpose.4. Retenti<strong>on</strong> limitati<strong>on</strong>. An entity should retain informati<strong>on</strong>in pers<strong>on</strong>ally identifiable form no l<strong>on</strong>ger than isnecessary for a specified purpose.5. Use <strong>and</strong> disclosure limitati<strong>on</strong>. An entity should not useor disclose informati<strong>on</strong> for purposes other than thosespecified at the time the informati<strong>on</strong> was collected. Inother words, uses <strong>and</strong> disclosures should be tied backto the purpose specificati<strong>on</strong>. An entity should obtainindividual c<strong>on</strong>sent before disclosing data for uses thatdepart from the purpose specificati<strong>on</strong>.6. Data quality. An entity holding pers<strong>on</strong>al informati<strong>on</strong> isresp<strong>on</strong>sible for ensuring that it is timely, accurate, <strong>and</strong>complete.7. Security. An entity holding pers<strong>on</strong>al informati<strong>on</strong> shouldtake reas<strong>on</strong>able measures to protect it against loss orunauthorized destructi<strong>on</strong>, disclosure or alterati<strong>on</strong>.8. Access to <strong>on</strong>e’s own records. An individual should beable to obtain a copy of his or her records. Sometimes thisis more broadly defined as “individual participati<strong>on</strong>” <strong>and</strong>may include the element of individual c<strong>on</strong>trol or c<strong>on</strong>sent.9. Redress. The subject of data should have the right tochallenge inaccurate data, to correct mistakes <strong>and</strong> toobtain redress for abuse.10. Accountability. Any privacy system should have a systemfor enforcement of the foregoing principles; thereshould be m<strong>on</strong>itoring <strong>and</strong> auditing of informati<strong>on</strong> flows,<strong>and</strong> it should be clear who is resp<strong>on</strong>sible for enforcingthe rules.The FIPs are not absolutes, but rather serve as a frameworkor roadmap to navigate through the c<strong>on</strong>fusi<strong>on</strong> aboutthe HIPAA Rule <strong>and</strong> the challenges posed by rapid changesin public health. The FIPs can serve as the basis for a “c<strong>on</strong>ceptof operati<strong>on</strong>s,” clarifying what informati<strong>on</strong> is being collected,for what purpose, with whom will it be shared, howl<strong>on</strong>g will it be retained, how accurate <strong>and</strong> reliable is the informati<strong>on</strong>,how will the data be secured against loss or unauthorizedaccess, <strong>and</strong> how individuals will know the basis fordecisi<strong>on</strong>s affecting them <strong>and</strong> be able to resp<strong>on</strong>d to mistakes.The FIPs can also guide the drafting of a local ordinancerequiring designated entities to submit certain data, <strong>and</strong> canhelp legislative staff <strong>and</strong> public health officials to write a“legislative history” showing why it was justified <strong>and</strong> howits implementati<strong>on</strong> will be accomplished. Such a historycan provide public health authorities a ground for defendingpolicies should they be challenged in court. Likewise,the FIPs can help in drafting data use agreements, providingin essence a checklist of issues that must be addressed <strong>and</strong>helping allocate resp<strong>on</strong>sibilities am<strong>on</strong>g participants.C<strong>on</strong>siderati<strong>on</strong>s for Syndromic SurveillanceThe relative importance of specific principles outlined inthe FIPs differ in the c<strong>on</strong>text of informati<strong>on</strong> managementsystems that are geared to providing health care services,reimbursement, or insurance versus syndromic surveillancesystems. We have outlined several c<strong>on</strong>siderati<strong>on</strong>s forthe interpretati<strong>on</strong> of the FIPs as they relate to syndromicsurveillance.First, syndromic surveillance is essentially a sec<strong>on</strong>daryuse of data collected in the process of providing health careto individuals, <strong>and</strong> the FIPs must be interpreted in this c<strong>on</strong>text.For example, given that syndromic data are generallycollected from instituti<strong>on</strong>s rather than individuals, the practiceof “notice” must be applied in that same framework.While public health uses of syndromic data are not subject toindividual c<strong>on</strong>sent, the notice principle could guide syndromicsurveillance practiti<strong>on</strong>ers to educate data sources aboutthe purpose <strong>and</strong> scope of data collecti<strong>on</strong>, including descripti<strong>on</strong>sof instances when investigati<strong>on</strong>s into public healththreats may prompt follow-back to individual patients, withthe involvement of health care providers where appropriate.Broadly, public health data collecti<strong>on</strong> purposes <strong>and</strong> proceduresshould be transparent to the communities that publichealth agencies serve.Sec<strong>on</strong>d, it is important to recognize that, as underst<strong>and</strong>ingis growing about the types of events <strong>and</strong> situati<strong>on</strong>s wheresyndromic surveillance is more or less useful, the purposeAdvances in Disease Surveillance 2009;7:2
<strong>Privacy</strong>, C<strong>on</strong>fidentiality, <strong>and</strong> <strong>Other</strong> <strong>Legal</strong> <strong>and</strong> Ethical Issues in Syndromic Surveillance 7of these systems have shifted over time. Systems that wereat <strong>on</strong>e time designed for bioterrorism detecti<strong>on</strong> or as earlywarning systems might now be used for situati<strong>on</strong>al awareness.Indeed, such flexibility is a recognized desirableattribute. The FIPs relating to purpose specificati<strong>on</strong> <strong>and</strong> collecti<strong>on</strong>limitati<strong>on</strong> should not be so rigid as to restrict thesesystems from evolving to meet the st<strong>and</strong>ard of practice; however,they could serve to guide practiti<strong>on</strong>ers to communicatewith data providers when the purpose of their systems hasshifted over time, <strong>and</strong> periodically reevaluate, as appropriate,the necessity of collecting certain data elements to supportthat specified purpose.For infectious diseases, the following criteria can help todetermine how much data to collect <strong>and</strong> how to use the data.Although no single factor is definitive, the following shouldbe c<strong>on</strong>sidered: (a) the extent to which the disease in questi<strong>on</strong>is transmissible from pers<strong>on</strong> to pers<strong>on</strong>; (b) disease severity;(c) the extent to which identificati<strong>on</strong> <strong>and</strong> reporting of peoplewith the c<strong>on</strong>diti<strong>on</strong> benefits those individuals; (d) the extentto which identificati<strong>on</strong> <strong>and</strong> reporting of people with the c<strong>on</strong>diti<strong>on</strong>is effective in c<strong>on</strong>trolling spread in the populati<strong>on</strong> (eg,treatment may also lessen transmissibility); (e) the value ofimplementing such interventi<strong>on</strong>s so<strong>on</strong>er rather than later; (f)the vulnerability of the affected populati<strong>on</strong>; <strong>and</strong> (g) the sensitivityof the informati<strong>on</strong> reported (10,18). Similar c<strong>on</strong>siderati<strong>on</strong>smay shape assessments of the level of detail neededin to allow for “drill down” assessments in syndromic datafollowing statistical alerts.Third, the principle of “retenti<strong>on</strong> limitati<strong>on</strong>” may havelimited relevance for syndromic surveillance, if the informati<strong>on</strong>received by public health agencies is generally nottraceable to individuals without collaborati<strong>on</strong> from healthcare providers, where such assessment is merited <strong>and</strong> justifiableunder state laws. To the extent that syndromic recordsmaintained by health departments c<strong>on</strong>tain record numbersthat can be used to link back to patient records, c<strong>on</strong>siderati<strong>on</strong>should be given to the durati<strong>on</strong> of time that such numbersare needed.Similarly, the interpretati<strong>on</strong> of the “use <strong>and</strong> disclosurelimitati<strong>on</strong>” has different implicati<strong>on</strong>s for health care settings,where medical records serve the primary purpose ofenabling individual patient care versus public health departments,which legitimately use those data for the sec<strong>on</strong>darypurpose of health surveillance without obtaining patientc<strong>on</strong>sent. This FIP cauti<strong>on</strong>s public health agencies against“tertiary” uses <strong>and</strong> could also help guide them in describinghow they might share syndromic surveillance data withthird parties, such as research investigators, for example, byproviding data in aggregate form <strong>and</strong> enacting strict assuranceswhich prevent the potential identificati<strong>on</strong> of individuals.This FIP could also guide health departments tocommunicate with, <strong>and</strong> seek permissi<strong>on</strong> from, data providerswhen c<strong>on</strong>sidering use of the data that shifts from theoriginal intent.Finally, the FIPs describing “data quality,” “access to <strong>on</strong>e’sown records” <strong>and</strong> “redress” have special c<strong>on</strong>siderati<strong>on</strong>s inthe c<strong>on</strong>text of syndromic surveillance. “Data quality” doesnot mean absolute accuracy, but rather a level of adequacylikely to produce reliable outcomes in the particular c<strong>on</strong>text.Even though health departments have limited, if any,c<strong>on</strong>trol over the quality of the data captured from individualpatients, they should c<strong>on</strong>sider whether the data they areacquiring is suitably accurate for that purpose <strong>and</strong> whetherthere are ways to obtain more accurate data. Furthermore,any public health interventi<strong>on</strong> that might result in a directinteracti<strong>on</strong> with a patient as the result of a syndromic surveillancerecord would necessarily occur through collaborati<strong>on</strong>with the data provider, who must account for its disclosuresto public health unless a data use agreement is signed. Interms of access, health departments are appropriate pointsof c<strong>on</strong>tact for individual access to <strong>on</strong>e’s own records <strong>on</strong>lyto the extent that their data is reas<strong>on</strong>ably accessible by individualidentifiers.DEALING WITH CONCERNS ABOUT SHARING DATAC<strong>on</strong>siderati<strong>on</strong> of the FIPs suggests a number of strategiesfor dealing with c<strong>on</strong>cerns about sharing data between healthcare providers <strong>and</strong> with public health agencies.First, it is important to improve communicati<strong>on</strong> with thepublic about how data are used to safeguard the populati<strong>on</strong>’shealth <strong>and</strong> how c<strong>on</strong>fidentiality is protected. The latterincludes distinguishing between identifiable patient-leveldata <strong>and</strong> aggregated <strong>and</strong> processed informati<strong>on</strong> such as diseaseincidence rates <strong>and</strong> the role of different types of informati<strong>on</strong>in detecting, characterizing, or m<strong>on</strong>itoring potentialor actual outbreaks of disease in a community. It shouldalso be noted that approaches to sharing data vary in thedegree to which the data are de-identified, <strong>and</strong> that the needfor identified data varies with the intended applicati<strong>on</strong> <strong>and</strong>whether it will be used at the local, state, or federal level.The need for individual-level data is most clear at the locallevel, where it allows for “drill down” assessments of statisticalalerts <strong>and</strong> follow-back to individuals when required.Individual-level data also allow for substantial flexibility inanalyses, justifying such data collecti<strong>on</strong> even when individual-levelpublic health interventi<strong>on</strong>s are unlikely. Sometimes,however, aggregate data al<strong>on</strong>e are sufficient to guide publichealth acti<strong>on</strong>s, particularly at the federal level. For instance,aggregate data could be analyzed for anomalies that wouldtrigger collecti<strong>on</strong> of identified individual level data. At thepoint when there is evidence of an emerging event of c<strong>on</strong>cern,accessing pers<strong>on</strong>al informati<strong>on</strong> may be important foridentifying <strong>and</strong> c<strong>on</strong>taining the threat. Alternatively, in thelater stages of an influenza p<strong>and</strong>emic, when tracking individualpatients is no l<strong>on</strong>ger feasible or has diminished value,aggregate data can be evaluated to identify the populati<strong>on</strong>sthat are most heavily affected <strong>and</strong> to help distribute resourcesAdvances in Disease Surveillance 2009;7:2
8 Stoto et al.accordingly, without knowing which particular patients areinfected.However, even at the state <strong>and</strong> federal levels, analysesof data to examine risk factors for disease or characterizetrends, while taking into account potentially c<strong>on</strong>foundingfactors, may require access to individual-level data (but notnecessarily as many data elements, as are needed for localuses). <strong>Other</strong> multi-state or nati<strong>on</strong>al-level uses, however, maynot require individual-level data, as illustrated by the ISDS’proof-of-c<strong>on</strong>cept project for collating aggregate syndromicsurveillance data for influenza surveillance (see http://www.syndromic.org/projects/DiSTRIBuTE.htm).Sec<strong>on</strong>d, public health authorities <strong>and</strong> other stakeholdersshould further develop approaches to sharing data in aggregateor de-identified form that have “drill-down” or “breakthe glass” capability when it is necessary, such as examiningspecific chief complaints that c<strong>on</strong>tribute to a statisticalalert in a syndrome category or patient demographic attributesto assess whether the events that c<strong>on</strong>tributed to analert were related. As described above, c<strong>on</strong>sultati<strong>on</strong> participantsdescribed the current norm of syndromic surveillancepractice that allows this by collecting individual-level datawithout specific identifiers or with a code or record numberwhere the link to patients’ identity is retained by participatinghealth care providers.Changing the process so that aggregates are created byeach participating hospital could ease c<strong>on</strong>fidentiality c<strong>on</strong>cerns,but could result in substantial increases in requestsfrom public health agencies for hospitals to c<strong>on</strong>duct assessmentsthat could otherwise be d<strong>on</strong>e by health departmentstaff when statistical alerts occur, as they often do. <strong>Other</strong>opti<strong>on</strong>s include using a regi<strong>on</strong>al data repository, collectingdata <strong>on</strong>ly from individuals with certain syndromes (witha process for approval of an exp<strong>and</strong>ed list when necessary),<strong>and</strong> a direct c<strong>on</strong>necti<strong>on</strong> to provider data systems.The operating policies of such systems need to specifywhat data are shared <strong>on</strong> a regular basis, what can be sharedwhen there is an indicati<strong>on</strong> of a potential public healthproblem, <strong>and</strong> the c<strong>on</strong>diti<strong>on</strong>s that would trigger exp<strong>and</strong>edaccess. The optimal approach is to retain data where theywere created, allowing access as needed. However dataaccess is arranged, practiti<strong>on</strong>ers at the meeting stressedthe importance of keeping its interpretati<strong>on</strong> as close to thesource of data as possible, in other words ensuring thatthose who know the data systems <strong>and</strong> local health caresituati<strong>on</strong>s best are involved in c<strong>on</strong>ducting <strong>and</strong> interpretingthe analyses.Third, statistical approaches to an<strong>on</strong>ymizati<strong>on</strong> <strong>and</strong> aggregati<strong>on</strong>should be explored <strong>and</strong> further developed to mitigateprivacy c<strong>on</strong>cerns. For example, spatial data can be highlyidentifying <strong>and</strong> thus pose a special c<strong>on</strong>fidentiality threat.Even geographical data published in low-resoluti<strong>on</strong> mapscan reveal exact or nearly exact patient home addresses(19). While individual-level data <strong>and</strong> spatial visualizati<strong>on</strong>smay be needed by a local health department to c<strong>on</strong>duct itsepidemiologic investigati<strong>on</strong>s, an<strong>on</strong>ymized, or even dataaggregated by day <strong>and</strong> age group may be almost as usefulin many routine applicati<strong>on</strong>s (20), <strong>and</strong> may be sufficient forsurveillance at the nati<strong>on</strong>al level, where the primary objectivemay be to summarize spatial <strong>and</strong> temporal trends, <strong>and</strong>where drill-down capability to an individual level may notbe necessary to support that objective.An<strong>on</strong>ymizati<strong>on</strong> can be accomplished, for instance, byaggregating data with the same Zip code or age group, removingporti<strong>on</strong>s of those fields (eg, the last two digits ofZip code <strong>and</strong> the m<strong>on</strong>th <strong>and</strong> day of birth), aggregatingnearest neighbors, <strong>and</strong> r<strong>and</strong>omly skewing geocoded data.Another recent advance includes populati<strong>on</strong>-density adjustedGaussian an<strong>on</strong>ymizati<strong>on</strong> (19,20), which is designedto increase an<strong>on</strong>ymity (at a cost of decreased sensitivity<strong>and</strong> specificity of cluster detecti<strong>on</strong>). Research suggests thatexisting algorithms can add an<strong>on</strong>ymity to a dataset in a waythat does not appreciably alter the detecti<strong>on</strong> performance ofclustering <strong>and</strong> machine learning algorithms (20,21). Thesemethods <strong>and</strong> their potential tradeoffs may be worthy of furtherexplorati<strong>on</strong> in the c<strong>on</strong>text of sharing local data withnati<strong>on</strong>al surveillance systems. Questi<strong>on</strong>s to address includethe level of an<strong>on</strong>ymizati<strong>on</strong> that best balances public healthutility <strong>and</strong> privacy protecti<strong>on</strong>, <strong>and</strong> whether these approachescan assuage c<strong>on</strong>cerns yet still provide useful surveillancedata.Finally, since the justificati<strong>on</strong> for any particular surveillanceprogram should be linked to public health uses <strong>and</strong>acti<strong>on</strong>s, there is a need for additi<strong>on</strong>al evaluati<strong>on</strong>s that dem<strong>on</strong>stratethe utility of syndromic surveillance for variouspurposes <strong>and</strong> clarify how privacy <strong>and</strong> c<strong>on</strong>fidentiality areprotected across the stages of event recogniti<strong>on</strong>, assessment,<strong>and</strong> resp<strong>on</strong>se.ACKNOWLEDGMENTSThis meeting was supported in part by the O’Neill Institutefor Nati<strong>on</strong>al <strong>and</strong> Internati<strong>on</strong>al Health Law at GeorgetownREFERENCES1. Drociuk D, Gibs<strong>on</strong> J, Hodge J. Health informati<strong>on</strong> privacy<strong>and</strong> syndromic surveillance systems. MMWR. 2004;53(Suppl):221–5.2. HIPAA <strong>Privacy</strong> Rule, 45 CFR § 164.3. HIPAA <strong>Privacy</strong> Rule, 45 CFR § 160.203.4. Buehler JW. Surveillance. In: Rothman KJ, Greenl<strong>and</strong> S, LashT, eds. Modern Epidemiology. 3rd editi<strong>on</strong>, Philadelphia, PA:Lippincott, Williams <strong>and</strong> Wilkens; 2008:459–80.5. Bayer R, Fairchild A. Surveillance <strong>and</strong> privacy. Science.2000;5498:1898–99.Advances in Disease Surveillance 2009;7:2
<strong>Privacy</strong>, C<strong>on</strong>fidentiality, <strong>and</strong> <strong>Other</strong> <strong>Legal</strong> <strong>and</strong> Ethical Issues in Syndromic Surveillance 96. Centers for Disease C<strong>on</strong>trol <strong>and</strong> Preventi<strong>on</strong>. Biosense, 2008.CDC Web site. http://www.cdc.gov/biosense.7. Whalen v. Roe, 429 U.S. 589 (1977) (upholding New York lawrequiring prescripti<strong>on</strong>s of certain drugs to be reported).8. Mariner WK. Missi<strong>on</strong> creep: public health surveillance <strong>and</strong>medical privacy. Bost<strong>on</strong> Univ Law Review. 2007;87:347–95.9. Gostin LO. Public health law: power, duty, restraint. L<strong>on</strong>d<strong>on</strong>,Engl<strong>and</strong>: University of California Press; 2000:287–304.10. Stoto MA. Public health surveillance in the 21st century:achieving populati<strong>on</strong> health goals while protecting individuals’privacy <strong>and</strong> c<strong>on</strong>fidentiality. Georgetown Law Journal.2008;96:703–19.11. Centers for Disease C<strong>on</strong>trol <strong>and</strong> Preventi<strong>on</strong>. HIPAA privacyrule <strong>and</strong> public health: guidance from the CDC <strong>and</strong>the US Department of Health <strong>and</strong> Human Services. MMWR.2003;52(S-1):1–12.12. HIPAA <strong>Privacy</strong> Rule, 45 CFR §164.512(b)(1)(i).13. HIPAA <strong>Privacy</strong> Rule, 45 CFR § 164.514 (e).14. Council of State <strong>and</strong> Territorial Epidemiologists (CSTE). Publichealth practice vs. research: a report for public health practiti<strong>on</strong>ersincluding cases <strong>and</strong> guidance for making distincti<strong>on</strong>s.CSTE Web site. http://www.cste.org/pdffiles/newpdffiles/CSTEPHResRptHodgeFinal.5.24.04.pdf. Published May 24,2004.15. MacQueen KM, Buehler JW. Ethical issues in HIV, STD, <strong>and</strong>TB public health practice <strong>and</strong> research: results of a workshop.Am J Public Health. 2004;94:928–31.16. Fairchild A. Dealing with Humpty Dumpty: research, practice<strong>and</strong> the ethics of public health surveillance. J Law, Med &Ethics. 2003;31:615.17. The <strong>Privacy</strong> Act of 1974. 5 U.S.C. §552a.18. Centers for Disease C<strong>on</strong>trol <strong>and</strong> Preventi<strong>on</strong>. UpdatedGuidelines for Evaluating Public Health Surveillance Systems.MMWR. 2001;50(RR13):1–35.19. Brownstein JS, Cassa CA, M<strong>and</strong>l KD. No place to hide: reverseidentificati<strong>on</strong> of patients from published maps. N Engl J Med.2006;355:1741–42.20. Brownstein JS, Cassa CA, Kohane IS, M<strong>and</strong>l KD. An unsupervisedclassificati<strong>on</strong> method for inferring original case locati<strong>on</strong>sfrom low-resoluti<strong>on</strong> disease maps. Internati<strong>on</strong>al Journalof Health Geographics. 2006;5:56.21. Cassa CA, Wiel<strong>and</strong> SC, M<strong>and</strong>l KD. Re-identificati<strong>on</strong> of homeaddresses from spatial locati<strong>on</strong>s an<strong>on</strong>ymized by Gaussian skew.Internati<strong>on</strong>al Journal of Health Geographics. 2008;7:45.APPENDIX IList of ParticipantsAtar Baer, PhD, Public Health-Seattle & King CountyBenjamin E. Berkman, JD, MPH, O’Neill Institutefor Nati<strong>on</strong>al <strong>and</strong> Global Health Law, GeorgetownUniversityJames Buehler, MD, Department of Epidemiology <strong>and</strong>Center for Public Health Preparedness <strong>and</strong> Research,Rollins School of Public Health, Emory University, <strong>and</strong>Georgia Divisi<strong>on</strong> of Public HealthChristopher Cassa, PhD, Harvard/MIT Divisi<strong>on</strong> of HealthSciences <strong>and</strong> Technology, Massachusetts Institute ofTechnologyJames Dempsey, JD, Center for Democracy <strong>and</strong>TechnologyP. Joseph Gibs<strong>on</strong>, MPH, PhD, Health & HospitalCorporati<strong>on</strong> of Mari<strong>on</strong> County (Indianapolis)Julia E. Gunn, RN, MPH, Bost<strong>on</strong> Public HealthCommissi<strong>on</strong>Melissa Higd<strong>on</strong>, School of Nursing <strong>and</strong> Health Studies,Georgetown UniversityW. Gary Hlady, MD, MS, Medical Epidemiologist forEmergency Preparedness, California Department ofHealth ServicesJoseph Lombardo, Johns Hopkins Applied PhysicsLaboratory/ESSENCEWendy K Mariner, JD, LLM, MPH, Bost<strong>on</strong> UniversitySchool of Public HealthJohn M<strong>on</strong>ahan, O’Neill Institute for Nati<strong>on</strong>al <strong>and</strong> GlobalHealth Law, Georgetown UniversityElizabeth Rea, Tor<strong>on</strong>to Public Health <strong>and</strong> University ofTor<strong>on</strong>toRobert Rolfs, Utah Department of HealthHenry Rolka, Centers for Disease C<strong>on</strong>trol <strong>and</strong> Preventi<strong>on</strong>Mark Smith, MD, MedStar HealthAmy S<strong>on</strong>ricker, MPH, Internati<strong>on</strong>al Society for DiseaseSurveillanceMichael A. Stoto, PhD, Professor of Health ServicesAdministrati<strong>on</strong> <strong>and</strong> Populati<strong>on</strong> Health, School ofNursing <strong>and</strong> Health Studies, Georgetown UniversityAdvances in Disease Surveillance 2009;7:2
10 Stoto et al.APPENDIX IIAgenda for Thursday, October 4, 20079:00–9:15 Welcome <strong>and</strong> meeting objectives9:15–9:30 Introducti<strong>on</strong>s9:30–11:00 Public health practice perspective; presentati<strong>on</strong>sby• Julia Gunn, Bost<strong>on</strong> Public Health Commissi<strong>on</strong>• Atar Baer, Public Health-Seattle & KingCounty• Joe Gibs<strong>on</strong>, Health & Hospital Corporati<strong>on</strong>of Mari<strong>on</strong> County• Gary Hlady, California Department ofHealth Services• Elizabeth Rea, Tor<strong>on</strong>to Public Health11:00–11:15 Break11:15–12:15 Issues in sharing health-related data for syndromicsurveillance; presentati<strong>on</strong>s by• Chris Cassa, Harvard/MIT Divisi<strong>on</strong> ofHealth Sciences <strong>and</strong> Technology• Mark Smith, Department of EmergencyMedicine, Georgetown University School ofMedicine & Washingt<strong>on</strong> Hospital Center• Joe Lombardo, Johns Hopkins AppliedPhysics Laboratory• Henry Rolka, CDC12:15–1:00 Lunch provided in meeting room1:00–2:00 Discussi<strong>on</strong> of practice issues• What data are needed for effective syndromicsurveillance? How does this vary bytarget c<strong>on</strong>diti<strong>on</strong>, stage of the surveillanceprocess (eg, outbreak detecti<strong>on</strong>, investigati<strong>on</strong>,case tracking, situati<strong>on</strong>al awarenessetc.), <strong>and</strong> other factors?• What c<strong>on</strong>cerns prevent or discourage hospitals<strong>and</strong> other data owners from providingsyndromic surveillance data to public health?Patient privacy c<strong>on</strong>cerns? Proprietary c<strong>on</strong>cerns?HIPAA regulati<strong>on</strong>s? Pers<strong>on</strong>nel or othercosts for sharing data? <strong>Other</strong> c<strong>on</strong>cerns?• What are effective strategies for dealing withthe c<strong>on</strong>cerns of data owners about sharing informati<strong>on</strong>syndromic surveillance data withpublic health? Can technical approaches to deidentificati<strong>on</strong>assuage c<strong>on</strong>cerns yet still provideuseful surveillance data? What level of aggregati<strong>on</strong>best balances utility <strong>and</strong> privacy protecti<strong>on</strong>?Can data be shared in aggregate form butwith “drill-down” capability when necessary?2:00–3:00 <strong>Legal</strong> perspective; presentati<strong>on</strong>s by• Jim Dempsey, Center for Democracy <strong>and</strong>Technology• Wendy Mariner, Bost<strong>on</strong> University3:00–3:15 Break3:15–5:00 Discussi<strong>on</strong> of legal authorities <strong>and</strong> ethicalresp<strong>on</strong>sibilities• What are the legal authorities that enablesyndromic surveillance at the local, state,<strong>and</strong> federal level? Is more specific authorityneeded?• What does the HIPAA <strong>Privacy</strong> Rule actuallyimply for syndromic surveillance? In whatcircumstances does the public health practiceclause allow syndromic surveillance? Isspecific legal authority necessary? Are datause agreements (DUA) necessary? Is pers<strong>on</strong>alhealth informati<strong>on</strong> (PHI) that is “deidentified”according to HIPAA st<strong>and</strong>ardsuseful for syndromic surveillance?• How do other federal, state <strong>and</strong> local laws<strong>and</strong> regulati<strong>on</strong>s enable, restrict, <strong>and</strong> otherwiseinfluence the ability to share data forpublic health surveillance purposes?• How does the applicati<strong>on</strong> of the HIPAAprivacy rule <strong>and</strong> other laws <strong>and</strong> regulati<strong>on</strong>sdepend <strong>on</strong> whether data are being used forresearch as opposed to public health practice?In this c<strong>on</strong>text, how are distincti<strong>on</strong>smade between research, practice, <strong>and</strong> evaluati<strong>on</strong>of public health practice? Is some newform of ethical review called for?• If syndromic surveillance data are sharedwith law enforcement <strong>and</strong> intelligence agencies,or used for other n<strong>on</strong>public health purposes(or perceived by the public as beingused for these purposes), how with that affectthe public’s c<strong>on</strong>fidence in public health <strong>and</strong>public health’s ability to functi<strong>on</strong>?Agenda for Friday, October 5, 20079:00–10:30 Discussi<strong>on</strong> of issues from previous day10:30–10:45 Break10:45–12:00 Identificati<strong>on</strong> of areas of c<strong>on</strong>sensus <strong>and</strong>where further research is needed12:00–12:30 Disseminati<strong>on</strong> plansAdvances in Disease Surveillance 2009;7:2