PHLT 8270 Week 8 Surveillance Data Governance Brief Example

Four Requests in One Month: A Governance Brief Assigning Tiers of Access to a Composite State's Carbapenemase-Producing Organism Records by What Each Requester Must Do and Which Identifiers That Work Needs

Student Name

Walden University

PHLT 8270: Health Informatics and Surveillance

Instructor Name

Month Day, Year

Four Requests in One Month: A Governance Brief Assigning Tiers of Access to a Composite State's Carbapenemase-Producing Organism Records by What Each Requester Must Do and Which Identifiers That Work Needs

The Requests

In one month, the composite state's healthcare-associated infections program received four requests for its records on carbapenemase-producing organisms. Hospital infection preventionists asked which of their transfer partner facilities had confirmed cases. A nursing home trade association asked for facility-level case counts for all nursing homes. A newspaper filed a public records request for the names of facilities with cases. A university research team asked for patient-level records, including dates of admission and transfer, to model spread between facilities. This brief answers each by asking two questions: what must the requester do with the data, and what identifiers does that work actually need?

The Legal Starting Point

Under the federal privacy rule, providers and laboratories may report patients' information to a public health authority for disease surveillance and control without first obtaining the patient's permission (45 C.F.R. § 164.512). Once the information is in the health department's hands, what it may release is governed mainly by state law, which in the composite state makes communicable disease reports confidential but allows disclosure to health care facilities when needed to prevent transmission and permits release of de-identified data. Lee and Gostin (2009) argue that public health agencies should hold themselves to explicit ethical standards for collecting and using data, beyond what law requires, including using no more identifiable information than a purpose needs.

Tier 1: Facility-to-Facility Notification

Infection preventionists need to know whether a patient they are receiving, or a facility they regularly exchange patients with, has carbapenemase producers, so they can place patients on contact precautions and screen if needed. That work requires facility names and, at the moment of transfer, patient-level status. National containment efforts depend on exactly this kind of inter-facility communication to stop carriers from seeding new facilities (Woodworth et al., 2018). The program will provide it through direct notification for specific transfers and quarterly facility-level summaries to facilities within the same transfer network, under the state law's provision for preventing transmission.

Tier 2: Aggregate Facility Counts for an Association

The trade association wants to understand the burden across its members and support infection control. That purpose is served by counts grouped by region and facility type, not by named facilities. Naming facilities could discourage testing and reporting, since a facility that tests more will appear to have more cases. The program will provide regional counts by facility type, with cells under five suppressed.

Tier 3: A Public Records Request

The newspaper's request raises the hardest question. Public reporting can motivate improvement and serves the public's interest in knowing about risks. But facility-level counts depend heavily on how much a facility tests, as earlier analyses in this course showed, so a named list would penalize facilities that look for the organisms and reward those that do not. State law treats case reports as confidential, and the program will decline to release facility names, provide the same regional data as in Tier 2 and offer an interview explaining the data's limits.

Tier 4: Researchers

The modeling study could help the program understand how organisms move between facilities, a valuable public health purpose. It requires dates and facility identifiers but not names, addresses or medical record numbers. The program will provide a limited dataset with coded patient and facility identifiers under a data use agreement and evidence of review board approval, with a prohibition on attempts to re-identify individuals or publish facility names.

Why Linking Records Needs Care

Researchers and partner facilities sometimes ask the program to link its records to other datasets, such as hospital discharge data, by patient name or address. Linking can be valuable, but every added identifier raises the risk of re-identification, especially for rare organisms in small facilities. Linkage should be done inside the program, with only the coded result shared.

Summary of Decisions

Each requester receives the least identifiable data its task requires: names and status for clinical prevention, regional counts for advocacy and the public, coded records for research. The reasons are written down so the program can apply them consistently to the next request.

References

Lee, L. M., & Gostin, L. O. (2009). Ethical collection, storage, and use of public health data: A proposal for a national privacy protection. JAMA, 302(1), 82-84. https://doi.org/10.1001/jama.2009.958

Uses and disclosures for which an authorization or opportunity to agree or object is not required, 45 C.F.R. § 164.512 (2024).

Woodworth, K. R., Walters, M. S., Weiner, L. M., Edwards, J., Brown, A. C., Huang, J. Y., Malik, S., Slayton, R. B., Paul, P., Capers, C., Kainer, M. A., Wilde, N., Shugart, A., Mahon, G., Kallen, A. J., Patel, J., McDonald, L. C., Srinivasan, A., Craig, M., & Cardo, D. M. (2018). Vital signs: Containment of novel multidrug-resistant organisms and resistance mechanisms, United States, 2006-2017. MMWR. Morbidity and Mortality Weekly Report, 67(13), 396-401. https://doi.org/10.15585/mmwr.mm6713e1