Toolkit for Communities
Using Health Data
How to collect, use, protect, and share data responsibly
National Committee on Vital Statistics
May 2015
U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Disease Control and Prevention
National Center for Health Statistics
Table of Contents
Introduction ...................................................................................................................................7
Data Lifecycle ..............................................................................................................................11
Data Stewardship ........................................................................................................................ 15
Accountability ..............................................................................................................................1 6
Openness, Transparency, and Choice ..........................................................................................18
Community and Individual Engagement
and Participation .........................................................................................................................24
Purpose Specification .................................................................................................................29
Quality and Integrity ................................................................................................................... 33
Security .......................................................................................................................................3 6
De-identification ......................................................................................................................... 39
Appendix A: Definitions ............................................................................................................... 47
Appendix B: Federal and State Laws ........................................................................................... 49
Appendix C: Case Studies ............................................................................................................. 57
Appendix D: Worksheet and Checklists .......................................................................................65
7
Introducon
Introducon
The Naonal Commiee on Vital and Health Stascs (NCVHS)
is the U.S. Department of Health and Human Services’ (HHS)
statutory public advisory body on health data, stascs, and
naonal health informaon policy. NCVHS has historically made
recommendaons regarding stewardship of health informaon
collecon, use, and disclosure.
In recent years, NCVHS hearings and roundtable discussions
about how communies are using data to improve health at
the individual, subgroup, and community levels have shown
the need for guidance on the meaning and applicaon of
data stewardship. These eorts have focused on the needs of
community-level organizaons. NCVHS created the Community
Data User Toolkit to be a substanve introducon to the
elements of data stewardship for communies that want to use
data.
In this document, a community is dened broadly as a formal
or informal group with a shared interest, which could be
dened by a shared characterisc such as geography, race
or ethnicity, a shared medical diagnosis, or a combinaon
of characteriscs. For example, a community could be a
neighborhood in a city, an online community of individuals
aected by cancer, or a racial subgroup within a city.
This document also uses the term data broadly. Communies
may use many dierent types and sources of data to promote
the health of the community, subgroups, or individuals. Some
data will be related to health condions, but other data could
relate to environmental factors, such as locaons of grocery
stores or access to safe walking routes. Data related to health
condions could come to the community as aggregated data
collected for other purposes, such as disease surveillance.
Other health data could be abstracted from paent medical
records, or collected by the community user through a survey
or some other mechanism.
Community groups today are using data to tackle important
health issues in ways that were not even imagined a few years
ago. In the past, access was largely limited to government-
based public health agencies or health care systems. Now
communies can access data because data availability has
exploded, parcularly data in digital formats. Federal and
state governments, local health informaon exchanges, and
other organizaons have data that could be made available to
promote community and individual health. If used eecvely,
"Community
groups today are
using data to
tackle important
health issues in
ways that were not
even imagined a
few years ago."
8
ToolKit for Communies Using Health Data
"Failure to use
good stewardship
practices could
harm individuals
or communities."
data may help improve communies’ understanding of:
• Health of the community and members of the community
• Health challenges facing the community
• Health promoon successes within the community
• Opportunies to improve the health of the community
as a whole and the health of individuals living in the
community
Many organizaons have data that may be available for
communies to use. These organizaons may also provide
tools and guidance for communies wanng to use their
data. This Toolkit includes important themes in stewardship—
proper data protecon and use—and, where relevant, refers
community data users to some of these resources.
Eecve data use requires eecve stewardship pracces.
Failure to use good stewardship pracces could harm
individuals or communies. Improper data handling or the
failure to protect individuals’ privacy or condenality could
limit parcipaon and impede the use of data.
This Toolkit was created to support communies that are
using data by promong sound stewardship pracces, while
helping them avoid the missteps and potenal harm that can
result when data users do not follow sound data stewardship
pracces. The Toolkit is not meant to provide a comprehensive
explanaon of every aspect of data stewardship, nor is it
meant to be a substute for legal counsel or experse in
data collecon, use, disclosure, or security. We hope that
communies will nd this Toolkit helpful as they connue to
use data to improve health.
Why a Toolkit and Why Now?
Technology is changing everything. Thanks to technology,
informaon is now developed, shared, and used in new ways.
Communies have opportunies to use data to improve
community health and the health of individuals living in the
community, opportunies that did not exist in the past.
Another less obvious opportunity comes from the growing
realizaon that communies are in the best posion to
idenfy the challenges they face and the strengths they enjoy.
Therefore, communies themselves may be best posioned
to nd the most eecve ways to use data to understand and
address their health needs.
By bringing technology and community-dened concerns
together, data can now be eecvely used to address
community-dened problems and to secure and protect
9
Introducon
community assets. Measurement and analysis are necessary
(not oponal) pieces of the puzzle that allow communies
to know where, and why, health is improving or declining. In
addion to addressing what is known, data have the potenal
to allow communies to discover unknown factors that maer
to them. Data also have the potenal to yield ndings that may
be surprising to, or unwelcomed by, community members.
Done right, using data builds the trust that is essenal for
nding, dening, exploring, strengthening, and improving
health at the community and individual levels.
What the Toolkit Does
The Toolkit briey introduces each important principle of data
stewardship for communies using health data.
1
It provides
both broad background informaon and ps for data users.
Descripons of stewardship principles are provided, along with
checklists for each principle.
As experienced data stewards know, and as emerging data
stewards will learn, the dierent principles described in the
Toolkit do not divide neatly into separate categories, but
rather overlap and intertwine. For example, the two principles
Openness, Transparency, and Choice and Community and
Individual Engagement and Parcipaon, are relevant across
every step in the stewardship framework and throughout the
data lifecycle. To the extent that principles are interrelated,
they are introduced in a unique secon, but are also referenced
in secons addressing other topics when relevant.
Dierent types of data trigger dierent approaches to
stewardship, with the burdens of stewardship and the
balancing of interests changing from one type of data to
another. Because of its likely sensive character, health
informaon presents important issues for data stewards. A
data steward invesgang the density of grocery stores in a
neighborhood is not likely to encounter major concerns about
privacy or condenality. But a data steward who wants to use
personally idenable health records that contain the results
of genec tesng is very likely to encounter those concerns.
The primary focus of the Toolkit is health data, which will
typically require rigorous aenon to all of the elements of
data stewardship. However, the principles in the Toolkit may
be more broadly applicable to many dierent types of data and
their uses for communies.
1 For a more detailed discussion of the NCVHS framework of stewardship prin-
ciples, see Naonal Commiee on Vital and Health Stascs, Leer to Secretary
Kathleen Sebelius, “A Stewardship Framework for the Use of Community Health
Data,” (Dec. 5, 2012) available from: hp://www.ncvhs.hhs.gov/wp-content/
uploads/2014/05/121205lt.pdf.
"Measurement
and analysis are
necessary
(not optional)
pieces of the
puzzle that allow
communities
to know where,
and why, health
is improving or
declining."
10
ToolKit for Communies Using Health Data
Appendices
Appendices are provided with supplemental informaon,
including:
• Denions
• Legal Consideraons
• Case Studies
• Checklists
11
Data Lifecycle
Data Lifecycle
Data have a lifecycle, represented in the gure below. Eecve
stewardship extends to all lifecycle phases. Examples of
communies using data across the lifecycle are provided
throughout the Toolkit.
Not all data move through all parts of the lifecycle. Some are
collected and never analyzed. Some analysis fails to produce
reportable results. Some data are never destroyed but are
stored in perpetuity.
There are also steps that communies using data to improve
health must take that are outside of the data lifecycle, such as
doing a literature review to learn about the current knowledge
on the topic and to beer frame the purpose of the inquiry.
Lifecycle of Data: From Collecon to Disposion
collect/create
merge
process
repurpose
de-identify
discard
analyze
report/share
archive
destroy
"Not all data
move through
all parts of the
lifecycle. Some
are collected and
never analyzed.
Some analysis
fails to produce
reportable results.
Some data are
never destroyed
but are stored in
perpetuity."
12
ToolKit for Communies Using Health Data
Original or Repurposed Data
Community health data can be either original or repurposed.
Original data are gathered for an inially specied purpose;
they are data that did not previously exist. For example,
original data may be collected through a survey of community
members about access to fresh fruits and vegetables in local
markets, observaon of acvies of children in a playground,
or new survey research on the incidence of a health problem in
the community.
Repurposed data are collected for one purpose and then used
for a dierent purpose. Communies may want to repurpose
data from a variety of sources.
Unl recently, the data in paent medical records were used
primarily for paent care, payment, and health care instuon
operaons. Data abstracted from paper medical records were
used for research and other purposes, but it was costly and
dicult to extract data. Uses of repurposed health data have
expanded sharply with access to digital data from electronic
health records and other informaon technology; these uses
are likely to connue to expand.
For example, an individual may complete a quesonnaire about
health status as part of a doctor’s visit that is then entered
into the history and physical secon of the electronic medical
record. Later, relevant responses are pulled from the electronic
health records of all paents who completed the quesonnaire
into a new data set that will be used to evaluate the prevalence
of a condion among community members. The responses to
the inial health quesonnaire collected for the purpose of
treatment are repurposed to determine disease prevalence.
Communies also oen repurpose public health data
generated by local, state, and federal government agencies. For
example, communies might invesgate changes in teen birth
rates, opiate deaths, cancer clusters, or suicide rates. In doing
so, they might use data that were collected for one purpose,
such as to determine cause of death, for another purpose, such
as to explore correlaons between social factors and suicide.
They might also combine these public health data sets with
other available data or data they collect themselves.
"Uses of
repurposed
health data have
expanded sharply
with access to
digital data from
electronic health
records and other
information
technology; these
uses are likely
to continue to
expand."
13
Data Lifecycle
Relaonship Between Technology and the Data
Lifecycle
Informaon technology has greatly changed how data are
managed at all lifecycle stages from creaon to destrucon or
archive. Technology speeds the capture of data and makes it
available for use sooner. It can help to keep a descripon of the
characteriscs of data, called metadata, including who collected
the data, when the data were collected, what permissions or
restricons are aached to the data, aws or limitaons of the
data, and other such characteriscs. Technology can also be
used to set up rules for data capture and collecon, processing,
storage, exchange, and disseminaon in ways not imagined just
a few years ago.
New technology enables users to:
• Store large amounts of electronic data
• Process and analyze large data sets eciently
• Enrich data sets by merging data from dierent sources
• Monitor trends over me to track changes
• Repurpose data in ways not conceived when the data were
collected
• Access data remotely
• Copy or transmit data rapidly
Electronic health records are, like paper medical records,
used inially to support the delivery of paent care,
payment, provider operaons, and quality improvement,
but the electronic format makes the records more useful to
researchers, public health agencies, and communies seeking
to improve the health of individuals and communies. For
example, electronic claims data are increasingly used to track
public health issues and to allocate limited funds to areas of
greatest potenal impact.
Technological advances oer both opportunies and risks to
communies using health data.
"Technological
advances offer
both opportunities
and risks to
communities using
health data."
14
ToolKit for Communies Using Health Data
Opportunies include:
• Understanding health at a more detailed or granular level,
such as geo mapping health data to show how disease
aects individuals living on a specic block within a
community
• Evaluang the impact of programs on health by linking
data about who received an intervenon with data from
a communitywide health informaon exchange or from
repurposed claims data
Risks include:
• Data breaches: Data security is challenging, even for large
companies and governments with substanal resources.
• Data elements: They can appear to be the same but have
dierent meanings across systems, causing incorrect
interpretaon.
• Repurposing: This can cause harm when it happens
without appropriately engaging and involving individuals
and communies, as shown in many of the Case Studies
described later in this Toolkit (Appendix C ).
• Problemac inferences due to analysis of electronically
processed data: These may result in social sgma
and harm to the reputaons of wrongly categorized
individuals.
The Toolkit can help data users take advantage of the
opportunies that technology oers while avoiding risks.
Governmental and Nongovernmental Data Collectors
and Users
Data stewardship for nongovernmental data collectors or
users has much in common with, but is not the same as, data
stewardship for governmental data collectors or users. Sll,
both government and nongovernment data stewards must
follow the laws, regulaons, and policies designed to protect
the privacy and condenality of individuals and the integrity
and security of the data. Governmental data stewards hold
data in trust for the public; they have an armave duty to
serve the public by openly and transparently sharing data.
Nongovernmental data users and collectors do not share that
armave duty, although sharing data to serve the community
and public good is consistent with stewardship principles.
"The Toolkit can
help data users
take advantage of
the opportunities
that technology
offers while
avoiding risks."
15
Data Stewardship
Data Stewardship
Data stewardship is a responsibility, guided by principles and
pracces, to ensure the knowledgeable and appropriate use of
data. More specically, stewardship of health data recognizes
the benets to society of using personal health informaon to
improve understanding of health and health care, while at the
same me respecng individuals’ privacy and condenality.
The individual elements of data stewardship are driven by
ethical imperaves that require data users to respect the
individuals who are the subjects of health data.
Many people touch data as it moves through its life cycle, and
each person who touches the data should have an awareness
of relevant stewardship principles and pracces.
Communies are encouraged to use data to improve health,
while following responsible data use pracces so that
individuals or groups whose data are used by communies
to improve health can trust that private or condenal
informaon is being used appropriately.
Nonlinear, Overlapping Concepts
The gure showing the elements of data stewardship below
suggests that stewardship elements follow a certain order. In
reality, as noted throughout the Toolkit, elements overlap, and
the stewardship process may require data users to loop back or
jump forward as needed.
Principles of Data Stewardship
"The individual
elements of data
stewardship are
driven by ethical
imperatives that
require data users
to respect the
individuals who
are the subjects of
health data."
16
ToolKit for Communies Using Health Data
"Failure to
identify and
address concerns
regarding proper
data stewardship
may lead to
downstream
consequences,
some mild, others
quite serious."
Accountability
The rst thing a community should do when thinking about
a new data analysis project is assign responsibility for
accountability for all parts of the project. Accountability means
that an individual or enty is responsible for:
• Ensuring appropriate collecon or creaon, use,
disclosure, and retenon of data through policies and
pracces, and
• Establishing mechanisms to nd and respond to any failure
to follow policy and procedures.
It should be made clear who is accountable at each phase
of the data lifecycle—from project planning, through inial
collecon and use, to data destrucon, storage, or repurposing.
Dierent people or enes might be accountable for dierent
phases, but this should be made explicit. Accountability for
each aspect of data stewardship should also be clearly assigned
so data users understand who is responsible. If there is a failure
of accountability, the responsible individual or enty should
face appropriate consequences and provide remediaon to
individuals aected by the lapse.
Failure to idenfy and address concerns regarding proper data
stewardship may lead to downstream consequences, some
mild, others quite serious.
Data Use Agreements and Accountability
Data use agreements (DUAs) can help an enty enforce
the various privileges and obligaons involved in sharing
or obtaining data. In combinaon with other protecve
measures, these agreements can be useful tools for managing
accountability.
DUAs are not a guarantee that data will not be misused. With
or without statutory authority, an enty that shares data may
need to take legal steps to enforce a DUA if a data user violates
the agreement.
Consideraons in Signing DUAs
A DUA is a contract—a legal document with legal implicaons.
It should not be taken lightly. If a data user is asked to sign
a DUA, the user should consider the accountability checklist
items outlined in Appendix D. An organizaon that is asked to
sign a DUA should understand what the DUA requires of it and
should be condent that it can meet those requirements. If an
organizaon has quesons or concerns about the document, it
may be useful to consult legal counsel.
17
Accountability
Summary
• Accountability may lie with an individual or enty.
• Dierent people may be accountable for dierent phases
of the data lifecycle or dierent stewardship elements.
• An accountable individual or enty should be named and
held responsible for stewardship.
• DUAs are one way to establish accountability ground rules
among data users.
Accountability
ombudsman
Vanderbilt University, a
member of the Electronic
Medical Records and
Genomics (eMERGE) Network,
idened accountable
individuals or groups for each
stage in the data lifecycle,
but found that this was not
enough. Communies that
Vanderbilt worked with
needed one person who
could be their accountability
contact. The eMERGE network
at Vanderbilt appointed an
individual to explain the
organizaon’s accountability
policies and procedures to
people in the community and
who could ensure that their
concerns would reach the
accountable person. Members
of the eMERGE Network
describe this approach as “a
lifesaver.”
18
ToolKit for Communies Using Health Data
Openness, Transparency, and Choice
Openness, transparency, and choice promote trust among data
users, data sources, individuals, and communies. If data users
are not open and transparent or if they do not oer choices
to individuals and communies when required or appropriate,
this can create unwelcome surprises, destroy trust, and may
even reduce the ability to use health data to improve health
in the future. The Toolkit includes examples of such failures as
cauonary case studies.
Community engagement supports openness, transparency,
and choice. For example, community leaders, neighbors, or
advisory boards can serve as conduits for noce to community
members. Communies can also provide informaon to data
users about how community members view the data use,
the level of disclosure, and the range of choices necessary to
maintain the community’s trust, as depicted in the following
diagram.
Community engagement alone may not, however, be enough
to ensure openness, transparency, and choice in cases where
individuals’ preferences are not the same as the interests of the
community. To maintain trust, data users must be open about
expectaons of data use.
Noce and consent are at the heart of openness, transparency,
and choice.
Advancing Openness, Transparency, and Choice
"Community
engagement alone
may not, however,
be enough to
ensure openness,
transparency, and
choice in cases
where individuals’
preferences are
not the same as
the interests of the
community."
Individuals provide
informed consent
Community and
individual informed
about data use and
benefits
Community and
individual consulted
about data use
Community and
individual consent to
proposed data use
Data source(s) informed
about data use
Data Steward
19
Openness, Transparency, and Choice
Noce is informaon provided to the community about data
use.
Consent is the process of geng permission from a community
or individual to use data.
Noce
Data users should provide individuals and communies with
noce about:
• What informaon is being collected
• Goals and potenal benets of data use
• Risks of data use
Communies and individuals whose data will be used should
be able to ask quesons about, comment on, or object to data
use. Data users may also need to give sources of data, such as
health care providers, public health agencies, or researchers,
the same type of informaon.
Individual noce
Individual noce may be needed when those whose data
are being used are idenable, for example, by name or
home address, and when the risk of compromising privacy or
condenality or sgmazing an individual or small group is
high.
Direct Individual Noce
If data users plan to use protected, personally idenable data
without other prior noce, they may need to provide individual
noce. In some instances, laws or regulaons require individual
noce, but stewardship pracces also may warrant individual
noce if the risk of violang an individual’s condenality or
privacy is signicant, or if disclosure could cause harm. Data
users may provide individual noce through a telephone call,
a face-to-face encounter, e-mail, or tradional mail. Mail is the
most costly and burdensome form of noce. For example, a
data user may have a name but no address, so the data user
would spend me and resources nding the person’s address
or other means of contact. Even where addresses or telephone
numbers are available, it is costly to place phone calls or to
mail nocaons to individuals for more than a small number
of individuals.
"Communities and
individuals whose
data will be used
should be able
to ask questions
about, comment
on, or object to
data use."
20
ToolKit for Communies Using Health Data
Data users should be careful when the nocaon itself could
reveal private or condenal informaon. For example, a
leer mailed from an organizaon that supports individuals
with a sgmazing condion, such as substance abuse or HIV,
could inadvertently reveal informaon to others, such as other
members of the household.
Individual Noce Through Noce of Privacy Pracces
A noce of privacy pracces informs individuals about what
personal informaon may be collected and how it may be used.
Although not a noce of impending or actual use, this type of
noce alerts individuals to the possibility that their data may be
used in addional ways. Examples of this type of noce include
the noce of privacy pracces required by the Health Insurance
Portability and Accountability Act (HIPAA) Privacy Rule or Terms
of Use nocaons on social media sites.
Individual Noce of Opt-in/Opt-out Consent
In contrast to a noce of privacy pracces, noce of an opt-
in or opt-out opon gives individuals the noce of a consent
process, as discussed in more detail below.
Community Noce
In some cases, noce is given to the community, not
individuals. Dierent methods may be used to give noce to a
community, including:
• Community meengs or town halls
• Booths at community events
• Flyers or noces posted at libraries, community centers, or
government oces
• Websites or Web-based adversing
• Media stories or adversements
• Meengs with community leaders
In cases where data about small groups of individuals are being
used, more targeted noce may be needed. For example, if
data use were to aect Asian women with cancer, noce could
be given in a newsleer for this populaon, shared on blogs
for or by members of this group, or posted in cancer treatment
centers. Similarly, if a small geographic area is being studied,
everyone on the block or in a neighborhood could be sent a
leer explaining the data use that is planned.
Engaging the
community to
determine type of noce
MyHealth Access, a non-
prot health informaon
exchange in Oklahoma, took
on the challenge of engaging
the residents of Tulsa. The
organizaon’s Privacy and
Security Commiee explored
two disnct choices: noce
through the newspaper or
personal nocaon. They
conducted focus groups
in doctors’ waing rooms,
asking, “Where do you want
to learn about the sharing of
your data?” Paents did not
want to read about it in the
newspaper for a number of
reasons. Rather, they wanted
to receive noce about data
use in the doctor’s oce;
overwhelmingly they wanted
the engagement to occur on a
one-on-one basis.
21
Openness, Transparency, and Choice
Determining what noce should be provided
When determining the appropriate level and type of noce,
data users should rst determine whether laws, regulaons,
or agreements with a data source dictate the level and type
of noce required. See “Laws and Regulaons” for more
informaon.
If no legal mandates exist, data users should consider the risk
of:
• Disclosing condenal or private informaon
• Generang results that individuals or communies have
chosen not to know or that challenge fundamental beliefs
• Sgmazing individuals, small groups, or communies
Data users should weigh the burdens of individual noce,
discussed above, against the benets of using data. When the
benets of use are great and compelling and the cost of noce
is very high or impraccal, the data user may determine that
individual noce is not required.
More targeted noce is warranted when individual privacy or
condenality is at risk and when individuals can be contacted
without undue expense or diculty.
Noce can be given broadly to communies or subgroups
within a community, or targeted to the individuals whose data
will be used.
Engaging
individuals and
communies preserves
the use of fetal blood
spots to improve human
health
When a baby is born, the
hospital may collect a blood
sample by pricking the child’s
heel. In some states, parents
led legal acons to prevent
the use of these fetal blood
spots for purposes that would
not directly aect the child.
Researchers launched
naonal and local eorts to
understand parents’ views
on the issue. They learned
that most parents were
willing to allow the use of the
blood spots for research, but
parents wanted to know how
the samples were being used,
and they wanted the ability to
limit the use.
Reecng these preferences,
states passed laws and
adopted policies addressing
parents’ concerns about
use of the blood spots. For
example, in Michigan, the
parents of newborns are now
noed that the Michigan
Biotrust hosts a website
where parents can choose to
limit the use of their child’s
blood spots through an opt-
out system. If parents do not
take acon to opt out, the
child’s biological samples may
be used for research.
22
ToolKit for Communies Using Health Data
Consent
In addion to noce, individuals may have the opportunity
to choose whether their data may be used. Certain uses are
required by state public health laws and do not require or
oer the opportunity for individual consent. However, other
situaons mandate choice and consent. The HIPAA Privacy Rule
and the federal regulaons regarding the Protecon of Human
Subjects in Research, known as the Common Rule, mandate
choice in many situaons, as discussed in Appendix B.
2
Consent may be required for original data collecon, for
example, when an individual agrees to parcipate in a
research study. Or consent may be required for some ways
of repurposing data that were not included in the original
consent. For example, individuals who have consented to the
use of their data to study diabetes might need to be given a
chance to choose whether they want to parcipate in a study
of correlaons with mental illness or substance abuse. Even
if laws or regulaons do not say how data are to be used,
community stewards should assess whether ethical imperaves
or the need to maintain trust require a consent process. There
are several approaches to obtaining consent from individuals or
communies whose data are being used.
Individual Consent
Some instances of data use require individual informed
consent. This requires the user to inform the individual about
planned data use and to obtain the individual’s consent before
using the data. This type of consent is usually required in
research studies, especially those where the data use has a high
level of risk.
Although individual consent oers individuals the highest
level of choice, it may not always be possible or feasible. For
example, it may not be possible to link biological samples
collected by the U.S. Army from draees during World War
II to the names of the people from whom the samples were
collected and thus to obtain individual consent for use of the
samples. In other cases, while it may be possible to idenfy
the source of data, that process itself may increase the risk of
violang the privacy rights or condenality of the person. In
other cases, the cost of obtaining individual consent may be
greater than the benets.
2 Data users should take special care when requesng access to or using substance
abuse treatment records, which are strictly regulated under federal law. See 42
C.F.R. Pt. 2
"Even if laws
or regulations
do not say how
data are to be
used, community
stewards should
assess whether
ethical imperatives
or the need to
maintain trust
require a consent
process."
23
Openness, Transparency, and Choice
Community Consent
In cases where individual consent is not required, feasible,
or warranted, data users may obtain community consent.
For example, a local elected ocial may consent to
community data being used instead of obtaining consent
from individuals. This type of consent can be used when
the risks to community members are relavely low, but may
not be the best approach when risks to individuals or small
subsets of individuals in the community are high.
Opt-in/Opt-out
In some cases, individuals may be given the choice
between allowing their data to be used or not used. Opt-
in and opt-out provisions usually have a default. With
an opt-in approach, individuals must take acon to have
their data included for a parcular use. With an opt-out
approach, individuals’ data will be available for use unless
they take acon to restrict or deny access to their data.
Local or regional health informaon exchange systems
typically include or exclude data based on opt-in or opt-out
defaults. As noted above, these systems require noce so
that individuals who are aected may exercise the choice
between opons.
"Local or regional
health information
exchange systems
typically include or
exclude data based
on opt-in or
opt-out defaults."
24
ToolKit for Communies Using Health Data
Community and Individual Engagement
and Parcipaon
Data users have an ethical, and somemes legal, obligaon
to promote community and individual engagement and
parcipaon in projects that use personally idenable,
de-idened, or aggregated data and when data use could
sgmaze individuals, small groups, or communies.
When data are used without appropriately engaging
communies and individuals in data use decisions, trust may
erode. Negave consequences of a breach of trust can have
subsequent radiang eects, as shown in many case studies.
Communies can be eecvely engaged at every phase of
the data lifecycle and when applying stewardship principles.
Engagement can be a way to protect the rights of individuals,
small groups, and communies. Engagement can also help
researchers or others in using data to improve health.
Mechanisms for engaging community members
Data users can engage community members in a number of
ways. When determining how to engage the community, data
users should think about which types of engagement would
provide legimacy for the data eort. In a polically polarized
community, for example, elected ocials may not be seen as
represenng the interests of all voters. The following briey
summarizes some approaches to community engagement.
Community Leaders
Community leaders can somemes serve as representaves
for a community as a whole. Leaders may include elected
ocials, leaders of community groups, leaders of religious
or spiritual organizaons, or even informal leaders. Use
cauon when using community leaders as representaves
of the community, as they may not accurately represent the
community’s view as a whole, and they may not understand
the concerns of subgroups or individuals within the
community.
Cautionary
Tale:
Repurposed
use of blood
samples
Members of the
Havasupai Tribe
volunteered to parcipate
in research studies on
diabetes by providing blood
samples. Years later, they
were surprised to nd out
that the researcher had
used the samples to study
family lineage, schizophrenia,
alcoholism, and migraon
paerns without obtaining
addional consent. In the
resulng lawsuit, Arizona
State University, which
employed the researcher,
paid the tribe a substanal
nancial selement and
returned the remaining
samples to the tribe.
25
Community and Individual Engagement and Parcipaon
Focus Groups
Focus groups provide another way to engage communies,
and are a good way to nd out how individuals feel
about an issue. Guidelines on how to run a focus group
are available from: hps://assessment.trinity.duke.edu/
documents/How_to_Conduct_a_Focus_Group.pdf. Like
engagement through community leaders, focus groups
can miss issues that maer to subgroups if members of
subgroups are not among the focus group members.
Community Advisory Boards
Community advisory boards are a commonly used form of
community engagement. To be eecve, advisory boards
should represent a range of interests and subgroups
within a community. One issue that must be addressed
in forming community advisory boards is how members
will be chosen, and whether members will be leaders of
community groups, or community members who are not
leaders. Some data repositories have specic requirements
about characteriscs of representaves who serve on
advisory boards.
Community Surveys
Community surveys can be completed online, on paper, or
in personal interviews. They can help data users to gather
and analyze informaon from many people as a form of
community engagement. An example of a survey to assess
community members’ percepons about community
health is available from: hp://www.naccho.org/topics/
infrastructure/mapp/framework/clearinghouse/upload/
Example-Survey-CTSA-Community-Health.pdf. While a
community survey can get input from more individuals,
the scope of results may be limited because the scope of
informaon is dened by the quesons asked and by the
characteriscs of the individuals who choose to complete
the survey.
The community
takes the lead
In Denver, a community group
called Taking Neighborhood
Health to Heart is working to
address a variety of health
problems. The community
helps to determine the
quesons to be asked,
research to be conducted,
and how and when data are
released. In some cases,
community members are
hired to collect survey data.
Because the community is an
acve parcipant in all parts
of research, the iniave
has learned about issues
that might never have been
addressed for fear that results
would be used to sgmaze
community members.
26
ToolKit for Communies Using Health Data
Opportunies for engaging community members
across the data lifespan
Purpose Specicaon
When planning projects and framing research quesons,
engaging the community can help data users to:
• Understand community perspecves
• Avoid mistakes that can occur when someone outside
of the community makes assumpons about dynamics
within a community
• Target issues that are relevant and useful to the
community
Openness, Transparency, and Choice
The most important point in the engagement process
occurs when implemenng the stewardship principle
of openness, transparency, and choice. See Openness,
Transparency, and Choice for specic recommendaons on
community engagement.
Data Collecon and Acquision
Data users may engage communies in the data collecon
process, and data holders can require that those who want
to use their data engage communies:
• Community members can administer surveys, which
may improve participation and response rates (see
The community takes the lead and the case study in
Appendix C )
• Community members can provide insight into how
unique characteriscs of the community may aect
data collecon eorts (see the case study, A Refugee
Community’s Expectaons describing the University of
Maine community data project in Appendix C)
• Organizaons sharing data may require that those using
their data involve community advisory boards
Data analysis
Community members can explain to data users aspects
of the community that may inuence how data are
interpreted and analyzed by individuals who do not have an
understanding of community dynamics. Communies can
be very helpful in reviewing ndings and interpretaons of
ndings before ndings are released to the public.
Sgmazaon in
the AIDS epidemic
In the early days of the AIDS
epidemic, data suggested
that Hai was a source
of the infecon and that
Haian immigrants were
overrepresented among
the populaon subgroups
with the disease in the
United States. (See Ellio
Frank, et al. “AIDS in Haian-
Americans: A Reassessment.”
Cancer Research 45 (Suppl
9):4619s–4620s. 1985.) The
result was widespread fear
of Haian immigrants and a
drop in tourism to Hai. One
of the doctors aempng to
treat this populaon later
reported that he encountered
widespread mistrust because
of the sgmazaon. (See
Ronald Bayer, Gerald M.
Oppenheimer. AIDS Doctors:
Voices from the Epidemic: An
Oral History. New York, NY:
Oxford University Press;
p 28–29. 2000.)
27
Community and Individual Engagement and Parcipaon
Subgroup Concerns
Some data use can trigger dierent concerns from dierent
communies, so data users must consider whether mulple
communies or subgroups within a community should
be represented. A subgroup can share a racial, ethnic, or
geographic trait, or even be aected by a shared disease.
Subgroup concerns can arise whether data are personally
idenable, de-idened, or aggregated.
Avoiding Sgma and Discriminaon
Data users may engage communies to avoid or address
concerns about data uses that have the potenal to result in
discriminaon against or sgmazaon of the community or its
members. Community engagement can help data users idenfy
areas of sensivity or concern and be a means of addressing
concerns. Data users from outside the community may not
see how the data could negavely aect communies. Studies
of prevalence of health issues such as sexually transmied
diseases, substance abuse, behavioral health, or genec
disorders, whether using data from medical records or public
health surveillance data, may be used to idenfy subgroups
in the populaon with increased risks for adverse health
outcomes and have the potenal to sgmaze community
members. The data user should give thoughul consideraon
to the use and analysis of these data to avoid sgmazing
groups or individuals.
Community engagement can also help data users to
communicate ndings in ways that do not sgmaze
communies or subgroups, although in some cases it may not
be possible to publicly release certain types of data without
the risk of sgma and discriminaon. Even then, community
engagement in purpose specicaon (see below) can help data
users to strike an acceptable balance between data use and the
interests of research parcipants and communies who may
want to learn from, but perhaps not publish, results.
Engaging a
disnct community
subgroup
The Populaon Study of
ChINese Elderly (PINE)
idened aconable concerns
among older Chinese adults
in Chicago, a community
cohort that was less well
understood. By engaging more
than 20 community groups
and by using mullingual
sta to interview parcipants
according to their preferred
languages and dialects, the
survey response rate was 91%.
The result of the eort was
reported in The PINE Report,
which showed that members
of this populaon are aected
by medical comorbidies,
physical disabilies, low
health care ulizaon rates,
psychological distress, social
isolaon, and elder abuse
at higher rates than other
older adults in the United
States. The PINE Report
idened opportunies for
family members, community
stakeholders, health
professionals, and policy
makers to improve the health
and well-being of older
Chinese adults.
28
ToolKit for Communies Using Health Data
Summary
• Evaluate opportunies for engaging communies and
individuals at every step in the data lifecycle and across all
elements of the stewardship framework
• Be aware of the concerns of subgroups within
communies whose interests may be dierent from those
of the larger community
• Consider the risk of sgmazaon of communies or
small groups and engage the community or individuals to
determine an acon plan for addressing the risk
Engaging the
community in
health informaon
exchange
Health informaon exchanges
enable providers to share
health informaon across
organizaons and provider
types to improve paent
care. In some communies,
concerns about privacy and
condenality of health data
have decreased informaon
sharing through exchanges,
and adversely impacted
the quality of paent care.
To avoid similar concerns,
MyHealth Access, the Tulsa
exchange described earlier,
engaged the community in
a 100-day planning process
that involved 200–300
people. At the beginning,
parcipants agreed to focus
on the objecves of health
improvement and quality. This
focus allowed the community
to agree on a system of
privacy and condenality
protecon that permied the
ow of data needed to treat
paents opmally.
29
Purpose Specicaon
Purpose Specicaon
Researchers are trained to start every inquiry by framing
the queson. What queson is the project designed to
answer? Data users should explicitly and carefully frame the
queson and be able to explain how the data will answer
the queson. This process is called purpose specicaon.
Purpose specicaon helps data users reach the intended goal,
regardless of the data source or type.
Purpose specicaon is relevant whether data are personally
idenable or de-idened. It is also important regardless of
data source. If obtaining a data set from an enty, data users
will typically need to explain the purpose for the data use. Even
for data that are publicly available, explaining the purpose is
important if the data use is to achieve its intended goal.
Purpose specicaon has many benets:
• By requiring that data collected is carefully linked to the
purpose of the project and possible follow-on projects,
data collecon will be targeted, focused, and thorough
• Data collecon eorts that contemplate repurposing at the
outset can increase eciency while decreasing the data
collecon burden
• Purpose specicaon can help data users avoid
unwelcome surprises by emphasizing the need to
ancipate and plan to address negave impacts
Community engagement can support the purpose specicaon
process. Communies and individuals can help data users
to understand challenges or concerns about which the data
user may be unaware. Laws or regulaons may dictate the
purpose of data collecon by government agencies, such
as health surveys or infecous disease surveillance. Though
overall purpose for these eorts may be broad, even these data
collecon eorts are usually driven by a queson that the data
may help to answer.
When engaged in purpose specicaon for a project involving
original data collecon, data users should ancipate and adjust
for the possibility that data may be valuable for repurposing.
For example, biological samples may remain at the conclusion
of a study evaluang the prevalence of a vitamin deciency.
A data user, aware that samples could be used to invesgate
human health problems in the future, can ancipate
repurposing. To address ancipated repurposing, a data user
might ask for consent in the primary study for samples to be
used in later studies dened in the consent.
Deliberave
Democracy Model
A “biobank” collects,
processes, stores, and
distributes bio-specimens
and related data for use in
research. A biobank might
include specimens of blood,
saliva, plasma, or DNA. When
the Mayo Clinic started
biobanking and repurposing
data from their electronic
medical records, it adopted a
deliberave democracy model
that engaged community
members in open dialogue for
4 days. The deliberants were
provided with background
materials on biobanking,
biomedical research, and local
eorts at Mayo. They were
then given an opportunity to
interact with domain experts,
including sciensts involved
in genecs research as well as
privacy advocates. The result
was community support and
an accepted framework for
the use of biological samples
and health data.
30
ToolKit for Communies Using Health Data
In the process of purpose specicaon, data users should
consider the balance between dening a specic and
narrow purpose or a less specic and broader purpose when
using data. The advantages of a narrow scope are that the
purposes are easily dened and described, so communies
and individuals may be more likely to trust users and allow
the desired uses of their data. However, future uses may be
circumscribed. A data project that species a more open-
ended or unknown purpose gains greater exibility for future
uses, but runs the risk that individuals may be less likely to
parcipate because they do not understand the full extent of
potenal future uses for which their consent is being sought, or
that future uses will surprise individuals or communies with
unexpected, perhaps even unwanted, results.
Repurposed Data
Repurposed data are collected for one purpose and then
used for another. Public health surveillance data collected by
state health departments is repurposed when shared with
communies or researchers to invesgate a concern that
the data may help explain. Laboratory tests performed to
guide paent diagnosis and treatment are repurposed when
combined with many other tests to show the prevalence of a
condion in a subgroup of individuals.
When using repurposed data, users should consider concerns
that may be raised by those whose data are being repurposed.
The cases of the research study of the Havasupai tribe and
the collecon of fetal blood spots show the harm that can
occur when data are repurposed without the consent of
the individuals whose data are being used. The case study
describing the community-based approach used by MyHealth
Access shows how data users can more likely avoid problems
encountered by data users who did not consider the risks of
repurposing.
Public health data used by communies might have been
originally collected for the purpose of controlling or prevenng
injury and disease, or for legal and administrave reasons,
or both. For example, birth and death cercates include
informaon useful for legal purposes (such as establishing
rights to an estate), administrave purposes (establishing family
benets or ceasing benets to decedents), or surveillance for
unusual incidence of disease (such as genec birth defects, or
deaths from suicide or cancer in a geographic area). Rates of
premature death, cancer, and obesity are examples of the types
Cautionary
Tale:
Repurposing
data without
individual or
community
engagement
Most newborn babies receive
blood tests to determine if
they have treatable medical
condions. Realizing that
these blood “spots” could also
be used for other purposes
that would benet public
health, such as monitoring
rates of genec disorders
or infecous diseases, the
holders of the blood spots
began to make them available
for research. Parents in
several states found out that
biological samples taken
from their babies were being
used without their consent
and brought legal acons. In
Texas, the legal selement
resulted in the destrucon of
more than 5 million biological
samples.
31
Purpose Specicaon
of data communies can repurpose to improve community
health.
3
Users should also be aware of any limits to repurposing that
may be imposed by laws governing the collecon and use of
the source data set or data use agreements. Laws in some
states, for example, explicitly address the repurposed use of
fetal blood spots. To take another example, state laws may
limit the repurposing of vital stascs, such as birth and death
records. However, many states have laws that allow the broad
use of health care data sets to measure health care cost,
quality, and access. In these states, the data steward will have a
data oversight commiee and data release policies that strictly
govern data release and reporng uses and these are included
in the DUA. In other cases, state laws or regulaons allow the
sharing of government health data only for specic purposes.
Tensions between data used for improving
community health and for research
Purpose specicaon can also be used to address a tension
between the goals of academic research and the goals of
advancing community health. Research ethics and funding
sources somemes mandate that researchers disseminate
their ndings through publicaon or presentaons at academic
meengs. Communies, to the contrary, may want to use
funding to improve health, while liming disseminaon of
potenally sgmazing or otherwise harmful results. Once
again, community engagement in the purpose specicaon
process can help address this tension at the outset of a project.
• At the outset of any data project, explicitly and carefully
dene the purpose of data collecon or use of repurposed
data.
• Consider how to most eecvely engage the community in
the purpose specicaon process.
• Consider and address possible adverse impacts of data use
or collecon.
• Be aware that data may be repurposed and design
collecon accordingly.
• When using repurposed data, consider how changing the
3 Community Commons oers tools to help communies use repurposed data
eecvely. From its website: “Community Commons is an interacve mapping,
networking, and learning ulity supporng broad-based and sustainable healthy
communies with free access to resources for registered users.”
See “About” available from: www.communitycommons.org.
"Laws in some
states, for example,
explicitly address
the repurposed
use of fetal blood
spots."
32
ToolKit for Communies Using Health Data
original purpose may trigger the need for addional noce
or consent or if these changes are allowed under the DUA
with the data steward.
• If the project brings together academic researchers and
communies using data to improve health, address any
tension among academic goals, funding mandates, and
community interests in protecng use limitaons.
Summary
Occasionally, rare events, even in the aggregate, in conjuncon
with detailed local knowledge may inadvertently lead to clues
or speculaon about specic individuals. These eects may
be in violaon of explicit data use agreements or generally
recognized principles of privacy.
In such cases, another strategy may be to arrange with the
original data steward for some kind of trusted intermediary
through which a community can analyze data in a secure data
center, allowing access to the data in a controlled environment
while sll honoring the need to protect the condenality of
the data in the custody of the original data steward.
Using a trusted
intermediary
The Southern Illinoisan, a
newspaper, sought cancer
registry data in an Illinois
Freedom of Informaon Act
request in order to see if there
was a cancer cluster in an
area of petroleum extracon.
Dr. Latanya Sweeney, then
a Professor of Computer
Science at Carnegie Mellon
University, and an expert in
re-idencaon of supposedly
de-idened data sets,
tesed that individuals
could be idened using the
requested data in conjuncon
with publicly available
informaon because the
number of cases was small.
The newspaper was successful
in the lawsuit and obtained
the data. To avoid the suit,
Illinois could have suggested
disclosing the data through a
trusted intermediary such as
a university, which could have
permied data analysis under
a promise of condenality in
a secure seng. Communies
seeking such cancer registry
data might want to try this
opon if they encounter
condenality concerns.
Southern Illinoisan v. Illinois
Department of Public Health,
218 Ill. 2d 390 2006).
33
Quality and Integrity
Quality and Integrity
Stewardship principles require that the quality and integrity of
data are managed so that they are usable for their intended
purposes.
Data quality refers to the accuracy, relevance, meliness,
completeness, validity, and reliability of the data. The data
collected or used for a parcular purpose must have an
appropriate nexus to that purpose that is mely, and as
complete as reasonably necessary to answer the quesons
asked without bias, skewing, or other distoron. Data must be
recorded or captured accurately, and it must represent what
it is claimed to represent. For example, quesons that are
ambiguous in a survey may not yield answers that correspond
to what the data user believes them to mean.
Data integrity means that the data have not been corrupted.
Data users must be aware of the problem that data may
be modied or otherwise garbled as they are used. When
data sets are combined, there are risks that they may not
be properly matched. Therefore, the combined data may no
longer accurately reect the sources.
It is seldom possible or necessary to have perfect data, but
stewards should consider and make a judgment about whether
data accurately and adequately measure what is being studied,
and if the data can be trusted. The data stewards of large public
health databases should provide detailed documentaon about
the underlying data and its limitaons, and should be consulted
to validate and review ndings prior to public release of reports
or stascs derived from these data sets.
Data Quality and Integrity Through the Lifecycle
Review of the Literature
Data users should research and evaluate what has already
been done; doing so helps to ensure the quality of data and
can answer the following quesons:
• Is further data collecon needed, or is the necessary
informaon already available?
• If others have addressed the issue in a dierent
populaon, can a proven methodology be used rather
than starng from scratch?
• What methodologies have failed to work?
By starng with a scienc literature review, the data user
can avoid duplicang eort and avoid others’ past mistakes.
"When data sets
are combined,
there are risks
that they may
not be properly
matched."
34
ToolKit for Communies Using Health Data
Data Collecon, Data Entry, and Data Cleaning Processes
To ensure data quality, users should assess that original
data are collected in accordance with generally accepted
procedures, and that sources of repurposed data are
trustworthy. For example, a trustworthy data source
would be able to provide assurances about how data were
collected, entered into a database, and stored. The Data
Quality and Integrity Checklist (Appendix D) outlines the
steps for users to follow.
Analysis
Data analysis should be conducted by trained and
experienced individuals or enes. If an organizaon
lacks internal experience, it may consider associang with
researchers who are interested in the issue being studied.
Reporng Results
Results, whether published in a journal or report or used
within an organizaon for internal purposes, should
accurately describe the results ndings of the analysis and
should avoid bias.
Special Consideraon for Merged Data Sets
Data users somemes merge data from two or more
sources to gain enriched data that is more useful than
either data set alone. However, data users must be careful
to combine data sets where the measures use the same
populaons, standards, and scale, so that they are not
comparing apples and oranges but using data to make valid
inferences.
Examples of Merged Data Sets
• The results of a survey of nutrional habits of
adolescents, administered by dierent school districts
in dierent cies in a state, could be combined to
increase the study’s stascal power.
• Two dierent data sets could be combined to beer
understand a phenomenon. For example, obesity rates
obtained from government sources could be combined
with a map of safe walking routes to consider whether
lack of safe walking routes is associated with higher
rates of obesity.
"...a trustworthy
data source would
be able to provide
assurances about
how data were
collected, entered
into a database,
and stored.
"
35
Quality and Integrity
Validity of Merged Data Sets
When two or more data sets are combined, users should
ensure that a merger or aggregaon is valid, and that the
data retain integrity. In determining validity, data users
should ask:
• Are the populaons the same for the dierent data
collecon eorts?
• Do survey quesons and response categories match?
• Might dierences in survey administraon dates aect
survey results?
• What were the survey sample designs?
Many of the issues involved in determining if survey data
can be combined and how they should be combined are
substanve, and require consideraon by subject-maer
experts. These issues should be resolved before any
stascal consultaon takes place.
4
Summary
• Ensure that data quality and integrity are maintained
throughout the data lifecycle, as outlined on the Data
Quality and Integrity Checklist in Appendix D.
• Before merging data sets, consider how the merger will
aect data quality and integrity.
4 For a detailed discussion on how to evaluate the validity and integrity of merging
data sets, see the U.S. Department of Health and Human Services, Oce of the
Assistant Secretary for Planning and Evaluaon’s Data on Health and Well-being
of American Indians, Alaska Naves, and Other Nave Americans: Data Catalog,
Contract No. 233-02-0087, Appendix B: Data Set Aggregaon, B-1 (Dec. 2006),
available from: hp://aspe.hhs.gov/hsp/06/catalog-ai-an-na/report.pdf.
"Might differences
in survey
administration
dates affect survey
results?"
36
ToolKit for Communies Using Health Data
Security
Securing data means protecng the data’s condenality,
integrity, and availability. Good security protects data from
loss of control, and, therefore, potenal unauthorized access,
damage, or manipulaon. Security safeguards may be technical,
administrave, or physical controls and can range from using
locks on an oce door and procedures for handling paper
forms to the use of sophiscated encrypon soware. Security
is parcularly important for personally idenable data that are
private or condenal.
Some of the primary threats to loss of data include using weak
passwords; failure to back up electronic data; infecon by
viruses or malware; and loss of portable electronic devices,
such as smart phones, thumb drives, and laptop computers.
Employees can increase the likelihood of security incidents
by either failing to follow policies and procedures designed
to protect data security, or by deliberately taking, altering,
or destroying data. Even paper can be at risk—for example,
completed surveys could accidentally be placed in a recycle bin
during an oce cleanup.
Responsible data security includes these steps:
• Evaluate ancipated risks
• Develop a plan to reduce ancipated risks
• Re-evaluate risks periodically
Elements of a security plan could include:
• Idencaon of major risks
• Adopon of methods to secure paper documents
• Password protecon for access to computers, networks,
and electronic devices
• Encrypon of data stored on removable devices such
as laptops, tablets, or phones, ensuring data cannot be
accessed if the computer is lost or stolen
• Automated backup processes to protect against accidental
data loss
• Training for employees on security measures
• Signed condenality agreements from all sta collecng,
managing, analyzing data
As with the queson of noce, data users must assess the need
to secure data, and the costs of doing so, against the risk of
data loss, inappropriate access, or manipulaon.
"Security is
particularly
important for
personally
identiable data
that are private or
condential."
37
Security
Ways to improve data security
• Physical
Install locks on cabinets or rooms where paper records
are stored
Keep records away from areas vulnerable to damage in a
ood
Protect electronic storage facilies against break-ins or
destrucon
Back up data with o-site storage capabilies
• Administrave
Run a risk analysis
Set up policies and procedures for accessing paper re-
cords, disposing of data, or adding new equipment on a
network
Train those with access to sensive informaon in data
security
Require robust passwords
Control who has access to view or change the data
Conduct due diligence on employees who handle data
Implement an incident response program
• Technical
Maintain logs of system access and unauthorized extrac-
on of data
Add encrypon
◊ Specic elements in a data set
◊ Data set as a whole
◊ Devices that allow access to the data set, such as
laptop computers
Implement monitoring to scan for and idenfy cyber at-
tacks
38
ToolKit for Communies Using Health Data
For more detailed informaon about security, see the Naonal
Instute of Standards and Technology guides on assessing and
maintaining data security,
5
which are useful for nonfederal
organizaons. The Oce for Civil Rights of the U.S. Department
of Health and Human Services also publishes security guidance
in plain language
6
for enes covered by the HIPAA Security
Rule, which nonetheless is instrucve for organizaons not
covered by that rule.
Role of De-idencaon in Data Security
De-idencaon is a process where personal ideners such as
name, address, telephone number, or date of birth reduce the
risk that private or condenal informaon will be disclosed.
The process of de-idencaon and protecon from re-
idencaon are addressed in the next secon.
5 A list of guides published by the Naonal Instute of Science and Technology’s
Computer Security Resource Center is available from: hp://csrc.nist.gov/publi-
caons/PubsSPs.html.
6 Educaonal materials from the Oce for Civil Rights about the HIPAA Security
Rule and other sources of standards for safeguarding electronic protected
health informaon include the HIPAA Security Informaon Series, available
from: hp://www.hhs.gov/ocr/privacy/hipaa/administrave/securityrule/se-
curityruleguidance.html. In parcular, HIPAA Security Series 1: Security 101 for
Covered Enes gives an overview of basic concepts, and HIPAA Security Series
7: Security Standards: Implementaon for the Small Provider describes basic
topics for data users. Other available resources include “Privacy and Security
Training Games”(hp://www.healthit.gov/providers-professionals/privacy-
security-training-games); “Guide to Privacy and Security of Electronic Health
Informaon” (hp://www.healthit.gov/sites/default/les/pdf/privacy/privacy-
and-security-guide.pdf); “Security Risk Assessment Tool” (hp://www.healthit.
gov/providers-professionals/security-risk-assessment); and “Your Mobile Device
and Health Informaon Privacy and Security” (hp://www.healthit.gov/pro-
viders-professionals/your-mobile-device-and-health-informaon-privacy-and-
security).
"De-identication
is a process where
personal identiers
such as name,
address, telephone
number, or date of
birth reduce the
risk that private
or condential
information will be
disclosed. "
39
De-idencaon
De-idencaon
De-idencaon is the process of removing or obscuring
any directly or indirectly idenfying informaon from data
in a way that minimizes the risk of unintended disclosure of
individuals’ identy and informaon. By removing directly
idenfying elements and otherwise treang data through de-
idencaon, released informaon can be both condenal
and useful for legimate purposes.
Good de-idencaon pracces reduce risks of re-idencaon
to a level judged acceptable given the data’s sensivity. Using
de-idened data whenever possible is a strong privacy
pracce, because it reduces risks of a data breach and other
violaons of personal privacy. Data de-idencaon makes
it very hard to link data to a specic individual, allowing the
study of a variety of sensive issues while greatly reducing the
risk of disclosing personal or condenal informaon. Aside
from organizaons that must follow HIPAA de-idencaon
methods, no standard, universally adopted de-idencaon
method is used throughout health care.
Identy and Aribute Disclosures
There are two areas of concern regarding re-idencaon:
The rst is identy disclosure, which happens when an outside
party can assign an identy to a record in a disclosed data set;
the second concern is aribute disclosure.
Aribute disclosure allows an outside party to aribute
characteriscs to someone in a data set even if he or she has
not been individually idened. This form of disclosure is of
primary concern in summary data releases, and it may arise
from the presence of empty cells either in released tables
or linkable sets of tables. The presence of a zero cell within
a table could allow an outside person to infer that no one in
the parcular category had the characterisc in queson. This
could be very sensive informaon. For example, the zero
cell could indicate lack of control of blood glucose levels, and,
by inference, that no one in a specic category of diabetes
paents dened by race and sex had good control of their
blood glucose levels.
If the opposite is true—for instance, a cell has 100% of a
parcular subgroup in a sample showing a specic aribute—
then membership in the subgroup implies having that aribute.
For example, if all of the homosexual men in a sample are
posive for Hepas C, then any homosexual man in the
sample can be assumed to have Hepas C.
"Good
de-identication
practices reduce
risks of
re-identication
to a level judged
acceptable
given the data’s
sensitivity."
40
ToolKit for Communies Using Health Data
Simple De-idencaon
De-idencaon in its simplest form means deleng a paent’s
name from the associated health record. However, even
before the advent of computer databases, this simple form
of de-idencaon would have been insucient to maintain
condenality. Learning how re-idencaon aacks happen
provides some answers:
Even when an administrator removes all of the data elds he
or she thinks might be uniquely idenable from a data set, an
aacker may sll be able to unlock the identy of the subject
of a record by discovering pockets of uniqueness remaining in
the data. This type of re-idencaon is possible because, even
without a specic idener, certain combinaons of values
may be so rare that they create a “ngerprint” poinng to only
one person. A re-idencaon aack aempts to locate the
unique ngerprints in a de-idened data set, and then search
for that same ngerprint in another data set containing unique
ideners. This technique is best shown using a Venn diagram:
Looking for Unique “Fingerprints” in a Database
7
This process of re-idencaon can be as simple as doing a
reverse phone number lookup on a data set containing phone
numbers. In a more complex form, the re-idencaon aack
might idenfy a health record with a combinaon of age, zip
code, and sex that is unique in the data set, and then cross-
reference that informaon with a voter registry to determine
the one individual in that zip code of that sex who was born on
that day. De-idencaon tries to protect against this external
linkage via uniqueness.
7 See “Understanding HIPAA Privacy,” published by the Oce for Civil Rights, U.S.
Department of Health and Human Services, in Health Informat ion Privacy: Guid-
ance Regarding Methods for De-idencaon of Protected Health Informaon in
Accordance with the Health Insurance Portability and Accountability Act (HIPAA)
Privacy Rule, available from: hp://www.hhs.gov/ocr/privacy/hipaa/understand-
ing/coveredenes/De-idencaon/guidance.html.
"This type of
re-identication
is possible
because, even
without a specic
identier, certain
combinations
of values may
be so rare that
they create a
‘ngerprint’
pointing to only
one person."
Data set
(e.g., hospital
records)
Data set
uniques
Potential
links
Population
uniques
Population
records
(e.g.,
registration
list)
41
De-idencaon
"Use of
de-identied data
whenever possible
is a good privacy
practice as it
reduces risks of a
data breach and
other violations of
personal privacy."
Re-idencaon Using Public Records
8
Data Considered for Sharing
Age
Zip Code Gender
Diagnosis
15
21
36
91
00000
00001
10000
10001
Male
Female
Male
Female
Diabetes
Influenza
Broken Arm
Acid Reflux
Voter Registration Records (Idetified Resource)
Birthdate
Zip Code Gender
Name
2/2/1989
3/3/1974
4/4/1919
00001
10000
10001
Female
Male
Female
Alice Smith
Bob Jones
Charlie Doe
De-idencaon methods must not only aempt to remove
any informaon that would be personally idenable, but also
manipulate the data set to ensure that it contains no unique
ngerprints.
Individual-level De-idencaon
Data users can de-idenfy individual records through a number
of methods. The most common are suppression, generalizaon,
and distoron.
Example: Data Set
Age (years) Gender ZIP code Diagnosis
15 M 00000 Diabetes
21 F 00001 Inuenza
36 M 10000 Broken arm
91 F 10001 Acid reux
Suppression occurs when informaon is completely removed
from the data set. Direct ideners such as names and Social
Security numbers are common examples of an individual’s data
that are completely suppressed. Some data such as birth dates
and zip codes, however, cannot be completely suppressed
without destroying the ulity of the data set.
Example: Data Set—Suppressed
Age (years) Gender ZIP code Diagnosis
M 00000 Diabetes
21 F 00001 Inuenza
36 M Broken arm
F Acid reux
Where complete suppression is impraccal, data are oen
generalized. In generalizaon, a parcular variable, such as age,
is divided into broader categories, such as 5-year age spans.
Generalizaon is oen extremely eecve at balancing ulity
and privacy in a data disclosure.
8 Id.
42
ToolKit for Communies Using Health Data
Example: Data Set—Generalized
Age (years) Gender ZIP code Diagnosis
< 21 M 00000 Diabetes
21 ≤ 34 F 00001 Inuenza
35 ≤ 44 M 10000 Broken arm
> 45 F 10001 Acid reux
Distoron may also be used to de-idenfy data, but with health
data, distoron oen destroys the reliability of the data for use
in drawing eecve ndings.
De-Idencaon Through Aggregaon
Aggregaon is another way to de-idenfy data. Instead of
removing ideners from individual-level data, data can be
combined into aggregate, or stascal, reports. This form of
de-idencaon can be parcularly eecve at maintaining
ulity while protecng the data’s condenality. However, the
risk of inadvertent aribute disclosure remains. For example,
the following table logically implies that all Hispanic females
enrolled in the Healthyville School District during the 2014–
2015 school year and included in the survey used illicit drugs.
Example: Data Set—Inadvertent Aribute Disclosure
2014–2015 Healthyville School District Drug
Usage Survey
No drugs Illicit Illegal
White male 85 40 15
White female 90 12 7
Black male 45 15 8
Black female 50 11 13
Hispanic male 10 5 7
Hispanic female 0 3 0
When releasing aggregate or stascal reports, one
eecve strategy is to avoid small “cell” counts. When a
cell in aggregated data is small, it increases the risk of re-
idencaon. For example, when a data set contains health
data represenng thousands of paents, but only four paents
are aected by a specic type of cancer, those four paents are
at high risk of being idened. In the aggregated data shown in
the following gure, the number of persons of Hispanic origin
is so small that reporng the number of those individuals raises
the risk of re-idencaon.
"Data users
can de-identify
individual records
through a number
of techniques."
43
De-idencaon
Aggregated Data
The risk of re-idencaon also increases when data are
combined from more than one source, or when data represent
members of a small group of people, whether they are
members of an ethnic or racial minority, or members of a group
suering from a specic illness.
Even when aggregaon is used, and even if small cells are not
reported, some risk of re-idencaon may remain. If this is
the case, data users should seek expert advice for assistance in
methods to further reduce these risks.
In addion, data users can use data use agreements, discussed
in the following “De-idencaon, Limited Data Sets, and Data
Use Agreements ” secon, to limit aempts at re-idencaon.
Another approach is to ask individuals whose data are to be
used if they would consent to data use even if there were a risk
of re-idencaon.
Although the risk of re-idencaon may not be eliminated,
the risk may be outweighed by the benets of using health
data. Data users should explicitly address the tension between
the desire to maintain condenality and privacy and the
desire to use data to advance public health. The data steward
must consider a series of tradeos, including the applicaon
of rigorous stascal and data management controls to reduce
the risk of re idencaon, while preserving as much data
ulity as feasible.
State health data organizaons that maintain hospital
discharge databases apply a layered approach to protecng
the data sets they release, following standards adopted
by the Naonal Associaon of Health Data Organizaons
(NAHDO). This methodology reduces the probability of
unique re-idencaon of individuals through stascal and
technical modicaons that alter the data. De-idencaon
combined with data management measures (such as data
oversight boards, training and educaon of users, or penales
for misuse), and informaon technology soluons (such as
"This form of
de-identication
[aggregation] can
be particularly
effective at
maintaining utility
while protecting
the condentiality
of the data."
44
ToolKit for Communies Using Health Data
encrypon), are methods that may help to manage the risk of
release while making relevant health care informaon more
available to data users.
Quanfying and Evaluang the Risk of
Re-idencaon
Evaluang risk of re-idencaon can be a very technical
process that requires substanal experse, but community
data users can use certain general principles as a guide. The
most important factor to consider is the number of individuals
who share a certain set of characteriscs. Name, address, and
telephone number are obvious examples of data elements that
can reveal the identy of a person, but other data elements
may be less obvious.
Communies should be aware that merging data sets, in
parcular, may increase the risk that individuals or small groups
could be idened. Merged data sets raise concerns when
people would not expect the data to be combined (for example,
correlaons among prescripons lled, food purchases, and
method of payment for food that could be obtained from
private supermarket data); when analysis of the combined data
sets may have negave consequences for those whose data are
used; or when merger raises the risk that private or condenal
data may be disclosed.
Good data stewardship pracces require evaluang the re-
idencaon risks for new mergers of de-idened data sets,
and for all new uses of de-idened data sets. The Oce
for Civil Rights of the U.S. Department of Health and Human
Services provides guidance
9
on how HIPAA-covered enes
can evaluate risk of re-idencaon, but community-based
data users should not undertake this process without expert
guidance.
De-idencaon, Limited Data Sets, and Data Use
Agreements
The HIPAA Privacy Rule requires data use agreements (DUAs)
when researchers use “limited data sets.” A limited data set
is created from protected health informaon by removing
all ideners except certain informaon about dates and
locaons. Users obtaining de-idened data sets also may
need to enter into a DUA with the enty supplying the data, to
9 See Health Informaon Privacy: Guidance Regarding Methods for De-idenca-
on of Protected Health Informaon in Accordance with the Health Insurance
Portability and Accountability Act (HIPAA) Privacy Rule, published by the Oce
for Civil Rights, U.S. Department of Health and Human Services, available from:
hp://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredenes/
De-idencaon/guidance.html.
Cautionary
Tale:
Small cell sizes
An academic used
state vital records
data from death
cercates to
study cause of
death from a variety of causes.
This researcher was able to
idenfy one individual because
of small cell size. As a result,
the government agency that
supplied the data decided
to increase the suppression
criteria from 5 to 10. They put
in place a system where an
automac check is performed
in the background before
results are reported back to
a researcher to check for cell
sizes smaller than 10. Now, if
someone runs an analysis for
which any of the cell sizes are
less than 10, the cell will come
up blank or just indicate “<10.”
45
De-idencaon
promise to protect the data against re-idencaon or to make
addional privacy and security arrangements. Data stewards
of state data sets may be subject to laws prohibing aempted
re-idencaon of records, and many DUAs impose penales
for noncompliance with DUA requirements. Communies that
engage in the collecon of original data may share de-idened
data with other organizaons, and when doing so, should use
a DUA to make clear the expected arrangements for use of the
data, including liming aempts to re-idenfy de-idened
data.
Summary
• De-idencaon can be used to limit the risk that
individuals’ condenal or private data will be disclosed.
• Two types of de-idencaon are:
Individual de-idencaon
Aggregaon
• Data users can use a number of strategies for liming the
risk of re-idencaon, such as:
Suppressing small cell counts
Grouping variables that could make re-idencaon
easier
• Data use agreements that prohibit aempts to re-idenfy
individuals can add a layer of protecon to other strategies
for protecng condenality and privacy.
• When de-idencaon interferes with the purpose of the
data use, individuals can be asked if they accept the risk of
re-idencaon.
Cautionary
Tale:
Washington
State Hospital
Discharge Data
A researcher
purchased
hospital discharge data from
the state of Washington.
Although the data set did
not include paent names,
the researcher was able to
corroborate highly sensive
informaon about specic
individuals by linking publicly
available informaon from
newspaper reports about
accidents to the informaon
contained in the data set.
Washington did not use
the NAHDO Guidelines for
release, which recommend a
layered approach of stascal,
management, and regulatory
controls. Washington learned
from the experience and put in
place a system using data use
agreements that, among other
things, requires researchers
accessing data to agree not to
try to re-idenfy individuals in
the de-idened data set.
47
Appendix A: Denions
Appendix A: Denions
The following denions explain how terms are being used
in the Toolkit, although the denions are similar to other
common uses.
Condenality
The treatment of informaon that a person has disclosed in
a relaonship of trust with the expectaon that it will not be
passed on to others in ways that are inconsistent with the
understanding of the original disclosure without permission.
Consent
A process through which a community or individual gives
permission for data to be collected or used by a specic enty
for a specic purpose.
De-idened Health Data
Health data about an individual that has had ideners, such
as name, address, telephone number(s), and date of birth
removed. For HIPAA-covered enes using protected health
informaon (PHI), the HIPAA Privacy Rule governs the specic
data elements that must be removed to create a de-idened
data set.
Health Data
Informaon about the health of specic individuals, such as
blood pressure, or about subgroups of individuals, such as
children under 5 years old with asthma living in a specic zip
code, or about a community, such as the number of residents
with stage 4 adenocarcinoma of the colon.
HIPAA
Health Insurance Portability and Accountability Act. The part
of HIPAA that most people have encountered is the Privacy
Rule, which gives certain rights to individuals—for example, to
obtain copies of their medical records—and imposes dues on
health care providers, their business associates, and insurance
companies or other payers to maintain the privacy and
condenality of paent informaon.
48
ToolKit for Communies Using Health Data
IRB
Instuonal Review Board. A structure created by the
“Common Rule” for the Protecon of Human Subjects in
Research, that ensures that research involving people meets
legal and ethical requirements. Federal and state laws and
regulaons determine what research must be approved by an
IRB.
Noce
Informaon given to the community or individuals about how
their data may be used.
Protected Health Informaon or PHI
Refers to informaon about an individual that is subject to
the HIPAA Privacy Rule. PHI receives specic legal protecons
under the HIPAA Privacy Rule.
Stewardship
Health data stewardship is a responsibility, guided by principles
and pracces, to ensure the knowledgeable and appropriate
use of data derived from individuals’ personal health
informaon.
User of Community Health Data
Enty within a community that collects, manipulates, stores,
analyzes, or disseminates data to improve the health of a
community, or of subgroups or individual members of the
community.
49
Appendix B: Federal and State Laws
Appendix B: Federal and State Laws
Many federal and state laws and regulaons could aect
community level data use, but two sets of federal regulaons
are most likely to aect local eorts to use data. Because there
are 50 states with 50 sets of laws that may aect data use, the
Toolkit does not address state law, but data users should learn
about the laws in their jurisdicon.
The Department of Health and Human Services (HHS)
regulaons on the Protecon of Human Subjects are found in
the U.S. Code of Federal Regulaons, Title 45, Part 46 (45 CFR
46). These regulaons govern human subjects research across a
range of sengs, including research done by universies, state
and local governments, and nonprot organizaons. Research
acvies covered under 45 CFR 46 must be approved by an
Instuonal Review Board (IRB). This Toolkit provides guidance
to data users to help them determine if data use requires IRB
oversight.
The Health Insurance Portability and Accountability Act (HIPAA)
Privacy Rule may also apply to enes disclosing data when
communies are seeking access to health data, and it may be
useful to understand the dues and limitaons of the enes
from which communies want to obtain data.
This Toolkit does not give data users everything they need
to know about HIPAA or human subject protecon rules and
regulaons. Instead, the goal is to alert data users to situaons
when they need to ask for further guidance from aorneys,
or compliance experts to ensure that data use complies with
major federal regulaons that govern health data use and data
collecon eorts.
General Principles
Although the HIPAA Privacy Rule and rules governing human
subjects research may not apply to community-level use of
data to improve health, the underlying principles of these
laws and regulaons can be instrucve to data users. These
laws and regulaons were developed to respond to concerns
about perceived and actual harm resulng from data use in
the past. If a data user nds itself in an ungoverned area,
he or she should think about the types of protecons and
inquiry required of data protecon and sharing under the
HIPAA Privacy Rule and human subject protecon laws and
regulaons. These protecons may somemes put limits on
data sharing that would be unduly burdensome when using
data to promote community health; they may also be less
restricve than some communies would want when the risk of
harm to small groups or individuals is very high.
50
ToolKit for Communies Using Health Data
How the Regulatory Structure of Data Can Allow
Community User Access to Data
By learning how data are regulated, communies may be more
eecve in accessing data needed to promote community
health. For example, a community that understands which data
are regulated by HIPAA may be more condent in reaching out
to health informaon exchanges or providers to request data.
Similarly, communies may be more willing to engage with
researchers from a local college or university if they understand
the role of Instuonal Review Boards for the Protecon of
Human Subjects in Research. The nal secon of this tool kit
gives community data users an introducon to these systems.
Human Subjects Research
A brief summary of the regulaon at 45 CFR 46, Protecon of
Human Subjects, also known as the Common Rule, is given to
prompt community groups using health data to think about
whether projects must comply with this federal regulaon. The
most authoritave primary source of informaon about federal
human subjects regulaons is found on the website for the
Oce of Human Research Protecons of the U.S. Department
of Health and Human Services: hp://www.hhs.gov/ohrp/
index.html.
Other federal and state laws and regulaons may impose
requirements on data collecon and use. For example, eorts
to test intervenons or collect data in the schools may be
aected by educaon laws and regulaons.
Federal law denes research as “a systemac invesgaon,
including research development, tesng, and evaluaon,
designed to develop or contribute to generalizable knowledge.”
A human subject is “a living individual about whom an
invesgator doing research obtains either
• data through intervenon or interacon with the
individual , or
• idenable private informaon.”
Intervenons include physical procedures, such as collecng a
blood sample, or manipulang the person’s environment—for
example, changing the placement of fruits and vegetables in
a local market as part of a project to measure whether the
change aects the amount of fruits and vegetables purchased.
Interacons include any communicaon or contact between a
data collector and the person, which occurs, for example, when
a data collector interviews a person.
51
Appendix B: Federal and State Laws
Private informaon is informaon about people collected in
a place where the person would expect privacy, such as inside
their home. An observaon of mothers with their children
in a public playground would not be private informaon. But
private informaon does include informaon given by a person
for specic purposes that is expected to remain private (for
example, a medical record). Informaon that a person gives to
a reporter would not be private informaon. If the informaon
is not linked to a specic person who is or may be idened, it
is not considered private informaon under 45 CFR 46.
Systemac invesgaon
A systemac invesgaon is a plan to collect and analyze data
for answering a queson. Systemac invesgaons include:
• Medical chart reviews
• Surveys and quesonnaires
• Interviews and focus groups
• Analysis of biological specimens
• Epidemiological studies
• Psychological or sociological experiments
• Analysis of repurposed data
Generalizable knowledge
Data collecon that is “designed to develop or contribute
to generalizable knowledge” includes eorts to set up a
knowledge base that can be applied to other communies.
For example, a community group may want to inuence
policy about school nutrion. They design a project where
their members interview students across a random sample
of schools across the city about their food choices in school
cafeterias. They expect that the results can be presented to the
news media, that they might be used to change laws on student
nutrion, and that they might be presented at a naonal
conference. This project would likely be considered research.
Some acvies are usually not considered research:
• Biographies or oral histories documenng past events
• Employee or student evaluaons
• Data or evaluaon collected for use internal to an
organizaon that will not be shared with the public
• Quality improvement acvies that will not be shared with
the public
52
ToolKit for Communies Using Health Data
An IRB may need to review a proposed project to ensure that
these acvies are not research under 45 CFR 46.
Next Steps
Community data users who determine that a project is or may
be research with human subjects should consult an IRB or
compliance ocer to determine what they must do to comply
with any laws and regulaons governing their project.
Is a project “human subjects research”?
yes no
Likely will be considered human subjects
research under 45 CFR 46
yes no
yes no
yes no
yes no
living individual?
collecting data through intervention or
interaction with individual
identifiable private information
systematic investigations?
seeking generalizable knowledge?
Likely not human
subject research
under 45 CFR 46
53
Appendix B: Federal and State Laws
Health Insurance Portability and Accountability Act
(HIPAA) Privacy Rule
A brief summary of the HIPAA Privacy Rule is provided to
prompt community groups using health data to consider
whether they may be covered and to understand the dues of
enes providing data to them
1
.
Health data users should know:
• Individuals and organizaons covered by the HIPAA Privacy
Rule
• Informaon protected by the HIPAA Privacy Rule
• Disclosures of informaon allowed by the HIPAA Privacy
Rule
• Nocaon that must be given to individuals whose data
are being shared
1 A comprehensive, authoritave summary of the HIPAA Privacy Rule may be
obtained from the Oce for Civil Rights, U.S. Department of Health and Human
Services, Summary of the HIPAA Privacy Rule, at hp://www.hhs.gov/ocr/
privacy/hipaa/understanding/summary/. The full text of the HIPAA Privacy Rule
can be found at 45 CFR Part 160 and Subparts A and E of Part 164.
Who is covered by HIPAA?
What is covered by HIPAA?
What disclosures does HIPAA permit?
Covered entities Others
Health plans
Health care providers billing
electronic
Health care clearinghouses
Business associates are subject to
some parts of the rule and to
terms of an agreement
Researchers may be affected
by HIPAA under a data use
agreement (DUA)
No authorization required
Data sets
For treatment, payment, and
health care
Business associates
Public health activities
For research when approved by Privacy
Board preparatory to research
Limited data set with a DUA
After removal of 18 specific identifiers
Certified by a statistical expert that
re-identification is unlikely
Protected health information (PHI)
Identifies an individual’s: -
Physical or mental health -
Health care received
- Payment for health care
When authorized by the patient
54
ToolKit for Communies Using Health Data
An enty asking to use data from a HIPAA-covered enty
(broadly speaking, health care providers, insurers, and health
care clearinghouses) may need more informaon than is
included in this Toolkit.
HIPAA Privacy Rule and Research
The Privacy Rule species when a covered enty may share
an individual’s data without an authorizaon for release
from the paent. The following is provided to help data users
understand the limitaons on data sharing by covered enes.
The covered enty is allowed to share paent data only when
doing so complies with the HIPAA Privacy Rule. The Privacy
Rule addresses access to protected health informaon, not
human subjects research; projects using protected health
informaon from covered enes are governed by the Privacy
Rule and regulaons protecng human subjects in research.
De-identified Data
Researchers may be able to access de-idened paent data
from a covered enty. The Privacy Rule does not restrict
the use or disclosure of de-idened data, but there is no
requirement that a covered enty disclose de-idened data.
Data are considered de-idened if the 18 ideners listed
below are excluded from the data used for research and the
covered enty does not know that remaining informaon can
be used to idenfy the individual, or if a qualied stascian
determines that the data are de-idened.
55
Appendix B: Federal and State Laws
Privacy Rule De-idened Data Elements
To create a de-idened data set from HIPAA-protected health
informaon, a covered enty must remove the following
ideners:
*Ideners marked with an asterisk may be included in a
limited data set.
Names
*Geographic subdivisions
smaller than a state
*Dates
Telephone numbers
Fax numbers
E-mail addresses
Social Ssecurity numbers
Medical record numbers
Health plan beneciary
numbers
Account numbers
Cercate/license numbers
Vehicle ideners and serial
numbers, including license
plate numbers
Device ideners and serial
numbers
Web universal resource
locators (URLs)
Internet protocol (IP) address
numbers
Biometric ideners, including
ngerprints and voiceprints
Full-face photographic images
and any comparable images
Any other unique idenfying
number, characterisc, or
code, unless otherwise
permied by the Privacy Rule
for re-idencaon
56
ToolKit for Communies Using Health Data
Limited Data Set
Recognizing that de-idened data may be needed for research
to improve health, the HIPAA Privacy Rule allows covered
enes to use or share a limited data set. A limited data set
excludes most, but not all, elements excluded in a de-idened
data set. Specically, certain dates and geographic data may
be provided in a limited data set. A covered enty may use or
disclose a limited data set only for research, public health, or
health care operaons. In addion, the covered enty must
have a data use agreement when sharing a limited data set.
Relaonship Between HIPAA Privacy Rule and Protecon
of Human Subjects in Research
Meeng the Privacy Rule’s requirements for receiving health
data from a covered enty does not relieve an organizaon of
meeng requirements imposed on research involving human
subjects. An organizaon planning to use data from a covered
enty should consult with an Instuonal Review Board or
compliance ocer to determine addional requirements that
other federal or state laws or regulaons may impose.
57
Appendix C: Case Studies
Appendix C: Case Studies
eMERGE Network
The eMERGE network is studying the relaonship between
genome-wide genec variaon and common human traits. The
eMERGE network has emphasized privacy and ethical data use.
Members of the eMERGE network have used a variety of
methods for engaging communies in discussions about the
use of individuals’ genec samples. In Phase 1, four of ve
sites used Community Advisory Boards; three of ve sites used
focus groups; and fewer than three used telephone surveys,
consensus panels, deliberave engagement, Web surveys of
dierent populaons, interviews, or newsleers.
Just as dierent network members used dierent ways to
engage the community, they have dierent approaches to
protecng individual privacy and condenality. The eMERGE
network is connuing to work to dene what it means to de-
idenfy biospecimens, biological data, and clinical informaon.
Vanderbilt
Vanderbilt’s system involved a Web survey of 4,037 individuals
and a Community Advisory Board, set up to ensure that the
community had a voice. Board members worked with members
of the eMERGE network at Vanderbilt and brought informaon
back to the community. It inially consisted of 12 individuals
who represented interests including parenng, church groups,
civic communies, and educaon. Board members were
not expected to have educaonal or genecs backgrounds.
Vanderbilt found community board members to be inquisive
and acve parcipants. They were not passive; instead, they
wanted to know about what the eMERGE network was doing,
and they wanted to give recommendaons.
Vanderbilt also found that community boards alone were not
enough: People in the community needed a specic person to
talk with about the project. That focal person, somemes called
an ombudsman, can explain the organizaon’s accountability
policies and procedures when working with the community and
ensure that concerns reach the right person.
Members of the eMERGE Network have found that community
engagement has been “a lifesaver.”
Although Vanderbilt’s Instuonal Review Board did not
view the project to be “human subjects research” (see Legal),
they added more layers of oversight, including evaluaon
by the university’s Ethics Commiee and three oversight
58
ToolKit for Communies Using Health Data
boards: Ethics, Scienc, and Community Advisory Boards.
Their de-idened repository allows individuals to opt out of
parcipaon. In addion, researchers using eMERGE data must
register each study separately, and alert researchers when their
data use may violate policies and the intent of the persons in
the community whose data are being used.
Sources:
Bradley Malin, Ph.D., Vanderbilt University (tesmony and
correspondence)
eMERGE website: hp://emerge.mc.vanderbilt.edu/
Mayo Clinic
When the Mayo Clinic started biobanking and reuse of
electronic medical records, it adopted a deliberave democracy
model. The model engaged people in the community in open
dialogue for four days. The deliberants were given background
materials on biobanking, biomedical research, and local eorts
at Mayo. They were then given an opportunity to interact
with domain experts, including sciensts involved in genecs
research, as well as privacy advocates.
Parcipants debated the issues and formulated specic
recommendaons about how Mayo should address noce,
consent, and privacy within its biobanking and medical record
reuse system.
Sources:
eMERGE website: hp://emerge.mc.vanderbilt.edu/
McGuire AL, Basford M, Dressler LG, Fullerton SM, Koenig BA, Li
R, McCarty CA, Ramos E, Smith ME, Somkin CP, Waudby C, Wolf
WA, Clayton EW. Ethical and praccal challenges of sharing
data from genome-wide associaon studies: The eMERGE
Consorum experience. Genome Res 2011 21(7):1001-7.
Newborn Blood Spots
Almost every baby born in the United States is screened for
a range of diseases via the taking of a small amount of blood
shortly aer birth. Parents have been rounely told that the
blood spots are used for diagnosis and quality improvement.
Over me, however, researchers realized that the blood spots
could be used for biomedical research that could potenally
benet public and individual health. Ocials in some states
allowed blood spots to be used for research purposes without
rst nofying parents about the repurposing of the blood
spots.
59
Appendix C: Case Studies
When some parents learned that the samples were stored
long aer the blood spots were used to diagnose diseases in
newborns, and were later used for research without consent
or nocaon, they brought lawsuits against states, academic
instuons, and researchers. Although a case in Minnesota was
dismissed, a Texas case was seled aer the pares reached
an agreement to destroy 5.3 million newborn blood spots.
The destroyed samples were potenally a valuable source of
informaon about genec variaon, infecous disease, and
other public health challenges.
The U.S. Department of Health and Human Services engaged
researchers to evaluate parents’ preferences about future use
of newborn blood spots. The researchers reported that most
parents approved of using the samples for research, but they
wanted to be noed of the possible use. Some asked for the
ability to opt out of research.
For samples collected aer April 30, 2010, parents of children
born in Michigan can opt out of research on behalf of their
children, but if they do not opt out, the biological samples
default to an “opt in” status. Michigan BioTrust has created
a website where parents can learn more and complete the
process of opng in or out of research. This website is a
good example of how data users can promote openness,
transparency, and choice.
Sources:
Botkin JR, Goldenberg AJ, Rothwel, E, Anderson RA, Lewis MH.
Retenon and research use of residual newborn screening
bloodspots. Pediatrics. 2013; 131(1):120–7. Available from:
hp://www.ncbi.nlm.nih.gov/pmc/arcles/PMC3529945/.
Michigan Department of Community Health. Biotrust
consent opons. Available from: hp://www.michigan.gov/
mdch/0,1607,7-132-2942_4911_4916_53246-244016--,00.
html.
Community Engagement on the Community’s Terms
In tribal communies, leaders may be older individuals
who may not have “the demeanor that is expected in a
governmental, bureaucrac seng where eciency is highly
valued.” Instead of blocking out a 15-minute period for a
meeng, the leader might say, “If this is important, let’s spend
a few days on it.” To eecvely engage a community, data users
may have to ignore how management gurus say a meeng
should be run; instead, “just follow your grandmother's advice:
somemes you just need to listen and not say anything.”
60
ToolKit for Communies Using Health Data
Source:
Tesmony of Dr. Phillip Smith, Indian Health Service
Instuonal Review Board, NCVHS Subcommiee on Privacy,
Condenality and Security, April 17, 2012.
A Refugee Community’s Expectaons
One community health promoon project found that people
in some immigrant and refugee communies did not expect
privacy and did not understand how sharing informaon might
cause harm. In the same project, researchers encountered
a clash between the U.S. emphasis on individuals and some
communies’ emphasis on the family unit. Families did not
want the “head of household” represenng the family on a
survey; instead, they wanted the family to complete the survey
as a unit. Although the organizaon’s Instuonal Review
Board found this approach disturbing because it would not
preserve condenality among family members, the board
agreed to proceed by following the preferences of people in
the community.
Source:
Linda Silka, Ph.D., University of Maine (interview and
correspondence)
Taking Neighborhood Health to Heart
Taking Neighborhood Health to Heart (TNH2H) started as a
community-based parcipatory research project involving
diverse urban neighborhoods in Denver, the University of
Colorado Denver, and the Stapleton Foundaon. Funding from
the Naonal Instutes of Health allowed TNH2H to study the
impact of the built and social environment on health and
health disparies among neighborhood residents. Informaon
about the project is available at TNH2H.org.
TNH2H involves community members at every stage. In
addion to involving them in creang the survey, community
members gave informaon that helped develop the surveys,
and people in the community were employed to administer
surveys. The outcomes of the original research project were
shared with neighborhoods. In addion, the community
idened and directed follow-up studies and outcome
disseminaon.
Laws and regulaons do not rounely require the level of
involvement from community members in research that
is found in TNH2H. By going beyond legal requirements of
openness, transparency, and choice, TNH2H earned the trust of
the community and has successfully engaged the community in
61
Appendix C: Case Studies
improving the health of its members.
Source:
Debbi Main, Ph.D., University of Colorado Denver (interview
and correspondence)
PINE Study
The PINE Study is the joint product of collaboraon among the
Chinese Health, Aging, and Policy Program at Rush University,
Northwestern University, and more than 20 community services
organizaons in the Chicago area, including the Chinese
American Service League and Xilin Asian Community Center
as the main community partners. This academic–community
partnership is guided by a community-based parcipatory
research approach. The PINE Study was designed to idenfy
aconable health policy concerns among a populaon of
individuals whose preferences and service needs are poorly
understood. Older Chinese adults are hard to reach because
they tend to distrust programs run by the federal government,
due to the Chinese community’s past experience with harsh
violence and decimaon. The issue is further compounded by
vast cultural and linguisc barriers.
During 2011–2013, the PINE Study carried out face-to-face
interviews with 3,159 community-dwelling older adults from 60
to 105 years old. The mullingual sta interviewed parcipants
based on their preferred languages and dialects, including
English, Cantonese, Taishanese, Mandarin, or Teochew dialects.
Data were collected using Web-based soware that recorded
simultaneously in English, Chinese tradional, and simplied
characters. Due to the careful planning and community
engagement, the response rate was 91%.
The result of the eort was The PINE Report, a comprehensive
study that examined the health and well-being of Chinese older
adults in the greater Chicago area—the largest cohort of older
Chinese adults ever assembled for epidemiological research
in Western countries. The report revealed that individuals in
this populaon are aected by medical comorbidies, physical
disabilies, low health care ulizaon rates, psychological
distress, social isolaon, and elder abuse at higher rates than
the average older adult in the United States. Many experience
low acculturaon levels, nancial hardship, and insucient
social support. The PINE Report idened opportunies for
family members, community stakeholders, health professionals,
and policymakers to improve the health and well-being of older
Chinese adults.
62
ToolKit for Communies Using Health Data
Source:
Dong XQ, Chang ES, Wong E, Wong B, Skarupski KA, Simon MA.
Assessing the health needs of Chinese older adults: Findings
from a community-based parcipatory research study in
Chicago's Chinatown. J Aging Res 2011 2010:1–12.
MyHealth Access
MyHealth Access Network is a nonprot coalion of more
than 200 organizaons in northeastern Oklahoma, with
a goal of improving health care quality and the health of
area residents while controlling costs. The organizaon was
chartered to facilitate communicaons and connecons among
parcipants in the health care systems. MyHealth does not
directly provide care, but gives those that do the technology,
informaon, communicaons, and analycs to support
improved care quality and reduced costs (see hp://www.
myhealthaccessnetwork.net/).
MyHealth Access Network engaged the community in a 100-
day planning process that involved 200–300 people. At the
beginning, parcipants agreed to focus on the objecves
of health improvement and quality. They recognized that a
primary focus on privacy and security, without starng by
dening the return on investment, would scule any eort to
share and use health data to improve health.
A subset of task forces was formed to address specic issues,
including content, clinical, privacy and security, and costs.
The recommendaons and ndings from these groups were
reviewed by top-level governance to create a plan.
Throughout the process, facilitators refused to allow conict
to become disengagement, which led to the model’s widely
recognized success.
Source:
Interview with David Kendrick, M.D., M.P.H., MyHealth Access
Research on biological samples from members of the
Havasupai Tribe
Members of the Havasupai tribe gave DNA samples to Arizona
State University (ASU) researchers in the early 1990s. The
researchers suggested that the DNA samples might provide
informaon about the tribe’s very high diabetes rates. In the
early 2000s, however, a tribal member heard a presentaon
about the data that addressed migraon, mental health, and
“inbreeding.”
The tribe was deeply disturbed that biological samples taken to
63
Appendix C: Case Studies
assist tribal members with a specic health concern were used
in ways that directly challenged beliefs of tribal members, while
also sgmazing all people of the tribe. This shows that harm
is not only caused when personal health data are disclosed (as
in the hospital discharge data set), but when every person in a
small group can be sgmazed.
Aer a lawsuit was led, ASU agreed to a selement to “right
the wrong” in using the data in a way that violated tribal
members’ right to consent.
Source:
American Indian and Alaska Nave Genecs Resource Center
website: hp://genecs.ncai.org/case-study/havasupai-Tribe.
cfm.
64
Appendix D: Worksheet and Checklists
Purpose Specicaon Worksheet
Accountable enty or individual(s) ___________________________________________
Describe the purpose of data use
Describe the role of the community and aected individuals in specifying the purpose of data collecon
or use
Describe data elements needed to achieve the purpose
From what source(s) will you get the data?
Federal public data sets
State public data sets
Medical records
Original survey
Other
Will data be repurposed?
Yes No
Appendix D: Worksheet and Checklists
6
5
ToolKit for Communies Using Health Data
What potenal adverse consequences, if any, do you ancipate:
Risk of breaching individual’s privacy or condenality
Negave impact on community
Sgmazaon of individuals or small groups
Describe plans to lessen possible adverse consequences (e.g., noce, data protecon, community
consultaon)
Describe possible future use/repurposing
Describe procedures for considering, and limits on, unplanned use
Describe how to evaluate the need to consider addional consent when repurposing data
Data Quality and Integrity Checklist
Data Collecon
Accountable individual/enty:________________________________________
Describe the plan for community engagement in the data collecon process.
66
Are either original or repurposed data collected following acceptable data collecon and use pracces?
If the organizaon lacks experse in data collecon best pracces, look for outside assistance
from a researcher, health care provider, state health department, or other organizaon with
experse in data collecon and entry
Sample is representave of populaon of interest
Data collecon procedures set up and documented before data collecon
Training for those engaged in data collecon
Require those collecng data to sign condenality agreements
Audit data collecon processes
Training for those entering data (if a separate process)
Audit data entry processes
Repurposed Data
Data source is trustworthy
Merging Data Sets
Accountable individual/enty: ________________________________________
Are the populaons the same for the dierent data collecon eorts?
Do survey quesons and response categories match?
Might dierences in survey administraon dates aect survey results?
What were the survey sample designs?
Describe methods to be used when merging data sets.
Data Analysis
Accountable individual/enty: ________________________________________
Describe valid methods for analyzing qualitave or quantave data, or idenfy the individual or enty
that will do the analysis
Appendix D: Worksheet and Checklists
6
7
ToolKit for Communies Using Health Data
Reporng Results
Accountable individual/enty: ________________________________________
Describe how reported results will protect communies, subgroups, or individuals from bias or sgma.
Describe protecons to ensure accurate reporng of results.
Data Security
Accountable individual/enty: ________________________________________
Idenfy ways to protect data integrity/security
Encrypt personally idenable informaon on mobile devices
Create a de-idened data set
Use valid methods if producing a de-idened data set
Limit password-protected access to idenable data to those with a need to know
Limit the ability to delete, add, or change data to those with appropriate training and need
Store paper records with idenable informaon in a dierent place from records that do not
contain ideners
Openness, Transparency, and Choice
Accountable enty or individual(s): ___________________________________________
Describe community engagement in the data collecon process
68
Determine the appropriate level of disclosure
Community noce (describe)
Small group noce (describe)
Individual noce (describe)
Create a feedback loop with parcipants/community to report ndings and recommendaons
(describe)
Data Use Agreement Checklist
Data use agreements designed to limit re-idencaon of de-idened data should, at a minimum,
address the following elements:
Dene the scope of data use
Require recipient to use safeguards to prevent use or disclosure not allowed in the scope of the
agreement
Require recipient to report to the data source any use or disclosure not allowed in the scope of
the agreement
Require recipient’s agents, such as subcontractors, that receive the data to agree to the same
restricons and condions that apply to the recipient
Require the recipient to agree to refrain from idenfying or contacng individuals whose health
informaon is contained in the shared data set.
Dene scheduled monitoring by data source and/or assurances by data recipient conrming that
terms of the agreement are being honored
Specify consequences of the data recipient’s failure to comply with terms of the agreement
Specify who bears the cost of enforcing the agreement if the data recipient is alleged to violate
the agreement
Appendix D: Worksheet and Checklists
69
ToolKit for Communies Using Health Data
If you are being asked to sign a data use agreement in order to receive data, nd out:
What laws or regulaons, if any, govern the data sharing and what the laws or regulaons
require of you as a recipient of data
What the document allows you to do and not do with the data
How does the document dene the scope of use?
Limits on aempts to re-idenfy or contact individuals associated with the data
Who can see or work with the data, inside or outside of the organizaon
Can you provide physical or technological safeguards that must be in place to secure the data
under the agreement?
Can you meet requirements to audit data use or track access to data?
What are your dues if there is a breach of the agreement
Reporng? To whom?
How will you address any allegaon that you or your agents have breached the agreement?
Limited Data Set Checklist
If receiving a limited data set (LDS) from a covered enty, an organizaon should conrm that the data
use agreement includes the following elements
1
:
Idenes the receiving organizaon as the recipient of the LDS
States that the LDS will be used only for research, public health, or health care operaons
Describes the purpose for using the LDS
LDS recipient agrees to refrain from using or disclosing the LDS for any purpose not specied in
the agreement
LDS recipient agrees to use appropriate safeguards to prevent use or disclosure not specied in
the data use agreement
LDS recipient agrees to report LDS use or disclosure of LDS not specied in the DUA
LDS recipient agrees that its agents, such as subcontractors, that receive the LDS agree to the
same restricons and condions that apply to the LDS recipient
LDS recipient agrees to refrain from idenfying or contacng individuals whose health
informaon is contained in the LDS
1 The University of Wisconsin has compiled “HIPAA Privacy and Security Rule Policies and Procedures,” including limited data set infor-
maon as noted above. The compilaon is available from: hp://hipaa.wisc.edu/hipaa-policies.htm.
70
NCVHS Membership, September 2014
Larry A. Green, M.D., Chair
John J. Burke, M.B.A, MSPharm.*
Raj Chanderraj, M.D., F.A.C.C.
Bruce B. Cohen, Ph.D.
Llewellyn J. Cornelius, Ph.D.
Leslie Pickering Francis, J.D., Ph.D. *Subcommiee Co-Chair
Alexandra Goss
Linda L. Kloss, M.A., RHIA *Subcommiee Co-Chair
Vickie M. Mays, Ph.D., M.S.P.H.*
Sallie Milam, J.D., CIPP, CIPP/G*
Len Nichols, Ph.D.
W. Ob Soonthornsima
William W. Stead, M.D.
Walter G. Suarez, M.D., M.P.H.*
James M. Walker, M.D., FACP
* Member of the Privacy, Condenality and Security
Subcommiee
Lead Staff for the Subcommittee
Maya A. Bernstein, J.D. ASPE
Execuve Sta Director
James Scanlon
Deputy Assistant Secretary,
Oce of Science and Data Policy
Oce of the Assistant Secretary for Planning and Evaluaon,
DHHS, ASPE
Acng Execuve Secretary
Debbie M. Jackson, M.A.
Senior Program Analyst
Classicaons and Public Health Data Standards Sta,
Office of the Director
National Center for Health Statistics, CDC
This report was written by NCVHS Consultant Writer Maureen Henry,
in collaboration with NCVHS members and staff.
The Naonal Commiee on
Vital and Health Stascs
(NCVHS) is the statutory [42
U.S.C. 242k(k)] public advisory
body to the Secretary of Health
and Human Services (HHS) for
health data and stascs. The
Commiee provides advice and
assistance to the Department and
serves as a forum for interacon
with interested private-sector
groups on a variety of key health
data issues. The Commiee is
composed of 18 members from
the private sector who have
disnguished themselves in
the elds of health stascs,
electronic interchange of health
care informaon, privacy and
security of electronic informaon,
populaon-based public
health, purchasing or nancing
health care services, integrated
computerized health informaon
systems, health services
research, consumer interests in
health informaon, health data
standards, epidemiology, and
the provision of health services.
Sixteen of these members are
appointed by the HHS Secretary
to terms of four years each,
with about four new members
appointed each year. Two
addional members are selected
by Congress.
For more informaon, see the
NCVHS website:
hp://www.ncvhs.hhs.gov/
National Committee on Vital and Health Statistics
