Data Security and Confidentiality Guidelines for HIV, Viral Hepatitis, Sexually Transmitted Disease, and Tuberculosis Programs: Standards to ... of Surveillance Data for Public Health Action

A goal of CDC’s National Center for HIV/AIDS, Viral Hepatitis, STD, and TB Prevention (NCHHSTP) is to strengthen collaborative work across disease areas and integrate services that are provided by state and local programs* for prevention of HIV/AIDS, viral hepatitis, other sexually transmitted diseases (STDs), and tuberculosis (TB). A major barrier to achieving this goal is the lack of standardized data security and confidentiality procedures, which has often been cited as an obstacle for programs seeking to maximize use of data for public health action and provide integrated and comprehensive services. Maintaining confidentiality and security of public health data is a priority across all public health programs. However, policies vary and although disease-specific standards exist for CDC-funded HIV programs, similarly comprehensive CDC standards are lacking for viral hepatitis, STD, and TB prevention programs. Successful implementation of common data protections in state and local health departments with integrated programs suggest implementation of common data security and confidentiality policies is both reasonable and feasible. These programs have benefited from enhanced successful collaborations citing increased completeness of key data elements, collaborative analyses, and gains in program efficiencies as important benefits. Despite the potential benefits, however, policies have not been consistently implemented and the absence of common standards is frequently cited as impeding data sharing and use. Adoption of common practices for securing and protecting data will provide a critical foundation and be increasingly important for ensuring the appropriate sharing and use of data as programs begin to modify policies and increasingly use data for public health action. This document recommends standards for all NCHHSTP programs that, when adopted, will facilitate the secure collection, storage, and use of data while maintaining confidentiality. Designed to support the most desirable practices for enabling secure use of surveillance data for public health action and ensuring implementation of comprehensive evidence-based prevention services, the standards are based on 10 guiding principles that provide the foundation for the collection, storage, and use of these public health data. They address five areas: program policies and responsibilities, data collection and use, data sharing and release, physical security, and electronic data security. Intended for use by state and local health department disease programs to inform the development of policies and procedures, the standards are intentionally broad to allow for differences in public health activities and response across disease programs. The standards, and the guiding principles from which they are derived, are meant to serve as the foundation for more detailed policy development by programs and as a basis for determining if and where improvements are needed. The process includes seven main steps: designating an overall responsible party; performing a standards-based initial assessment of data security and confidentiality protections; developing and maintaining written data security policies and procedures based on assessment findings; developing and implementing training; developing data-sharing plans or agreements as needed; certification of adherence to standards; and performing periodic reviews of policies and procedures. CDC will work with state and local health departments to monitor the implementation of the guidelines and evaluate their impact on securing data, facilitating data use, and increasing program effectiveness.

A goal of CDC’s National Center for HIV/AIDS, Viral Hepatitis, STD, and TB Prevention (NCHHSTP) is to strengthen collaborative work across disease areas and integrate services that are provided by state and local programs* for prevention of HIV/AIDS, viral hepatitis, other sexually transmitted diseases (STDs), and tuberculosis (TB). A major barrier to achieving this goal is the lack of standardized data security and confidentiality procedures, which has often been cited as an obstacle for programs seeking to maximize use of data for public health action and provide integrated and comprehensive services. Maintaining confidentiality and security of public health data is a priority across all public health programs. However, policies vary and although disease-specific standards exist for CDC-funded HIV programs, similarly comprehensive CDC standards are lacking for viral hepatitis, STD, and TB prevention programs. Successful implementation of common data protections in state and local health departments with integrated programs suggest implementation of common data security and confidentiality policies is both reasonable and feasible. These programs have benefited from enhanced successful collaborations citing increased completeness of key data elements, collaborative analyses, and gains in program efficiencies as important benefits. Despite the potential benefits, however, policies have not been consistently implemented and the absence of common standards is frequently cited as impeding data sharing and use. Adoption of common practices for securing and protecting data will provide a critical foundation and be increasingly important for ensuring the appropriate sharing and use of data as programs begin to modify policies and increasingly use data for public health action. This document recommends standards for all NCHHSTP programs that, when adopted, will facilitate the secure collection, storage, and use of data while maintaining confidentiality. Designed to support the most desirable practices for enabling secure use of surveillance data for public health action and ensuring implementation of comprehensive evidence-based prevention services, the standards are based on 10 guiding principles that provide the foundation for the collection, storage, and use of these public health data. They address five areas: program policies and responsibilities, data collection and use, data sharing and release, physical security, and electronic data security. Intended for use by state and local health department disease programs to inform the development of policies and procedures, the standards are intentionally broad to allow for differences in public health activities and response across disease programs. The standards, and the guiding principles from which they are derived, are meant to serve as the foundation for more detailed policy development by programs and as a basis for determining if and where improvements are needed. The process includes seven main steps: designating an overall responsible party; performing a standards-based initial assessment of data security and confidentiality protections; developing and maintaining written data security policies and procedures based on assessment findings; developing and implementing training; developing data-sharing plans or agreements as needed; certification of adherence to standards; and performing periodic reviews of policies and procedures. CDC will work with state and local health departments to monitor the implementation of the guidelines and evaluate their impact on securing data, facilitating data use, and increasing program effectiveness.