A goal of CDC's National Center for HIV/AIDS, Viral Hepatitis, STD, and TB Prevention (NCHHSTP) is to strengthen collaborative work across disease areas and integrate services that are provided by state and local programs- for prevention of HIV/AIDS, viral hepatitis, other sexually transmitted diseases (STDs), and tuberculosis (TB). A major barrier to achieving this goal is the lack of standardized data security and confidentiality procedures, which has often been cited as an obstacle for programs seeking to maximize use of data for public health action and provide integrated and comprehensive services. Maintaining confidentiality and security of public health data is a priority across all public health programs. However, policies vary and although disease-specific standards exist for CDC-funded HIV programs, similarly comprehensive CDC standards are lacking for viral hepatitis, STD, and TB prevention programs. Successful implementation of common data protections in state and local health departments with integrated programs suggest implementation of common data security and confidentiality policies is both reasonable and feasible. These programs have benefited from enhanced successful collaborations citing increased completeness of key data elements, collaborative analyses, and gains in program efficiencies as important benefits. Despite the potential benefits, however, policies have not been consistently implemented and the absence of common standards is frequently cited as impeding data sharing and use. Adoption of common practices for securing and protecting data will provide a critical foundation and be increasingly important for ensuring the appropriate sharing and use of data as programs begin to modify policies and increasingly use data for public health action. This document recommends standards for all NCHHSTP programs that, when adopted, will facilitate the secure collection, storage, and use of data while maintaining confidentiality. Designed to support the most desirable practices for enabling secure use of surveillance data for public health action and ensuring implementation of comprehensive evidencebased prevention services, the standards are based on 10 guiding principles that provide the foundation for the collection, storage, and use of these public health data. They address five areas: program policies and responsibilities, data collection and use, data sharing and release, physical security, and electronic data security. Intended for use by state and local health department disease programs to inform the development of policies and procedures, the standards are intentionally broad to allow for differences in public health activities and response across disease programs. The standards, and the guiding principles from which they are derived, are meant to serve as the foundation for more detailed policy development by programs and as a basis for determining if and where improvements are needed. The process includes seven main steps: designating an overall responsible party; performing a standards-based initial assessment of data security and confidentiality protections; developing and maintaining written data security policies and procedures based on assessment findings; developing and implementing training; developing data-sharing plans or agreements as needed; certification of adherence to standards; and#
S tandards to Facilitate Sharing and Use o f S urveillance Data fo r P ublic H ealth A c tio n
i f H i f i S )  r V 1 J H i i i i i l  o ) 

# II. Introduction
The true value of surveillance is measured by its impact on public health action and practice.1 Public health agencies at all levels have broad authority to collect, store, and use personal health information to identify, report, and control health threats and to plan, implement, and evaluate public health programs and services. The public trusts that any personal or confidential information collected as part of public health activities will be held securely and confidentially and will be used for legitimate public health purposes. Although protections exist through various laws, policies and procedures, these protections vary across jurisdictions2-4 and sometimes even within public health organizations.5
A goal of CDC's National Center for HIV/AIDS, Viral Hepatitis, STD, and TB Prevention (NCHHSTP) is to strengthen collaborative work across disease areas and integrate services that are provided by programs for prevention of HIV/AIDS, viral hepatitis, other sexually transmitted diseases (STDs), and tuberculosis (TB).6 A major barrier to achieving this goal is the lack of standardized data security and confidentiality procedures, which has often been cited as an obstacle for programs seeking to maximize use of data for public health action and provide integrated and comprehensive services.7 Although disease-specific standards exist for CDC-funded HIV programs,8,9 similarly comprehensive CDC standards are lacking for viral hepatitis, STD, and TB prevention programs.
CDC established data security and confidentiality guidelines for CDC-funded HIV surveillance programs in state and local- health departments in 19988 and updated the guidelines in 2006.9
The guidelines emphasize the protection of surveillance data and prohibit HIV surveillance programs from sharing data with programs that lack equivalent data security and confidentiality protections. These restrictions on data sharing had the unintended consequence of inhibiting the ability of some local health departments to link clients to appropriate treatment and prevention services.7,1 0
In 2008, CDC published updated recommendations for programs providing partner services for HIV, syphilis, gonorrhea, and chlamydial infections. The document includes recommendations related to record keeping, data collection, data management, and data security that were based on previously published HIV surveillance guidelines.1 1 The partner services recommendations encourage data linkage and sharing between public health service-provision prevention programs and disease-reporting surveillance systems. The recommendations suggest that sharing of individual-level surveillance data can help facilitate the timely provision of partner services but also underscore the need for well-defined security and confidentiality policies and procedures. Despite the potential benefits, however, these have not been consistently implemented.
In addition, CDC cooperative agreements with TB programs require that policies and procedures must be in place to protect the confidentiality of all TB surveillance case reports and files. TB programs should also collaborate with HIV/AIDS programs to conduct at least annual TB and AIDS registry matches to ensure completeness of reporting of HIV and TB coinfected patients to both surveillance systems. However, this collaboration has been hampered by perceived differences in policies and procedures to protect HIV test results.

# This document does not

# III. A bout this D ocum ent
This document recommends standards for data security, confidentiality, and use across surveillance and program areas for HIV, viral hepatitis, STD, and TB prevention in state and local health jurisdictions. The standards support the most desirable practices for enabling secure use of data and ensuring comprehensive preventive services while being broad enough to allow for differences in public health activities by disease program. The standards address five areas: program policies and responsibilities, data collection and use, data sharing and release, physical security, and electronic data security.
The standards are based on 10 guiding principles that provide the foundation for the collection, storage, and use of surveillance data for public health action. The guiding principles are derived from existing CDC policies and guidelines, model and existing legislation, and from related work, including current security and confidentiality principles for NCHHSTP's HIV surveillance programs and practical application of ethics in public health surveillance.8,9,11,13-20 Similar principles have been proposed as part of a national strategy2 1 consistent with public health values22,23 to ensure the privacy and security of public health data at all levels.
The standards are intended to apply to public health programs funded by NCHHSTP (including those of state and local health departments and their contractors) that are responsible for collecting, storing, and using surveillance data and to any entities with which these programs share data. The standards address the use of both identifiable (i.e., personally identifiable information ) and nonidentifiable data and may include: data used for epidemiologic investigations; data used to link patients with partner services, appropriate treatment, interventions, and other health services; and data used for case management and program evaluation. Because the use of identifiable data requires a higher level of protection than the use of nonidentifiable data, the document includes specific standards for the sharing of identifiable data. Key definitions for data sharing, data release, data release agreement, data dissemination, and personally identifiable information are highlighted in the box above and additional terms are provided in the Glossary (Appendix A).

# IV. Using this D ocum ent
Active data stewardship involves developing proactive policies, procedures, and training to ensure that public health data are collected, stored, and used appropriately. To that end, policies related to the security and sharing of data should be reviewed regularly and changed as needed. The data standards and the guiding principles from which they are derived are meant to serve as the foundation for more detailed policy development by programs and as a basis for determining if and where improvements are needed. Key components of data security and confidentiality, sharing, and use policy development are outlined below.
Overall Responsible Party (ORP)-A high-ranking official should be identified to accept overall responsibility for implementing and enforcing data security, confidentiality and sharing standards. This official should have the authority to make decisions about program operations that might affect programs authorizing, accessing or using the data, and should serve as the contact for public health professionals regarding security and confidentiality policies and practices.   Certification-Programs are required to self-certify their adherence to the standards for ensuring the security, confidentiality, and appropriate use of the data they collect, store, and share. The certification statement should:

# S a m p l e c h e c k lis ts fo r c o n d u c t i n g in itia l a n d c o m p r e h e n s i v e a s s e s s m e n t s a r e p r o v i d e d in A p p e n d i x B.

# Data Security and Confidentiality Policies and
 Identify one or more persons as the ORP for ensuring adherence to the standards  Attest to adherence to all standards, or explain any lapses  If lapses, describe steps to meet the standards in the future  Describe policies and procedures instituted to ensure continued adherence to the standards NCHHSTP will describe the certification process in applicable program announcements. NCHHSTP will conduct periodic reviews of the data security, confidentiality and sharing procedures of grant recipients during routine site visits and provide technical assistance as needed.

# A s u g g e s t e d f o r m a t fo r a c e r tific a tio n s t a t e m e n t is p r o v i d e d in A p p e n d i x D.
Periodic and Ongoing Reviews and Assessments-Programs should review their data security, confidentiality, and sharing policies and procedures at least annually or sooner if improved technologies or legislative/regulatory changes occur and revise as necessary. In addition, they should periodically assess whether other changes in personnel, programs, organizations, or priorities require changes in policies and procedures. For example, changes in federal standards for encryption could affect existing policies and procedures and require software updates or other revisions.
Programs should also review their data-sharing plans or agreements periodically in light of improved technologies and revise as necessary. Tracking the security and confidentiality training of staff members authorized to access data, including documenting and storing their signed confidentiality agreements, should also be part of ongoing assessment activities.

# V. Benefits, Risks, and Costs of Sharing Data and M aintaining Security and Confidentiality
There is a balance that must be maintained between protecting the individual and the public from disease and protecting individuals' confidentiality and right to privacy. Both are vital to enhancing the public's health and maintaining the public's trust. Programs that have and follow consistent guidelines for the collection, storage, and use of HIV, viral hepatitis, STD, and TB data may reassure individuals, and the public, that sharing data for public health action will not compromise confidentiality.
Adherence to harmonized standards for data security across programs will enhance the ability to share data without compromising confidentiality. As programs consider how best to meet these standards, it is helpful to consider the benefits, risks, and costs.          Written policies should address procedures for the dissemination of nonidentifiable summary data to stakeholders and the public. Summary data should be disseminated in a manner that facilitates understanding by affected populations and illuminates the compounding impact of syndemics.

# S e e A p p e n d i x E fo r a s u g g e s t e d o u t li n e o f a p o l ic y fo r d a t a se c u r ity , c o n fid e n tia lity , s h a r in g a n d u se .
Since some aggregate data could be used to identify individuals, policies should usually restrict release of certain data elements to avoid a confidentiality breach. Wider public access and searchability of databases (e.g., death records and obituaries) increases the capability to re-identify other de-identified data. Consideration should be given to consulting with de-identification experts prior to release when in doubt. In some instances, the obligation to use the data to help members of demographic groups examine trends and burden of disease for public health planning might outweigh the risk of possible stigma that could be associated with some aggregate data. For example, the release of data showing high rates of alcohol and drug use in a small community, although potentially stigmatizing, must be weighed against the potential additional resource planning and allocation for drug and alcohol treatment services that could result from such a release. -----

# STANDARD 4.6 Ensure that documents with line lists or supporting notes contain the minimum amount of potentially identifiable information  necessary and, if possible, that any potentially identifiable data are coded to prevent inadvertent release of PII.
To the extent possible, PII should not be removed from a secure location or accessed from an unsecure area. However, some public health activities (e.g., field investigations and service provision) require taking such information into unsecure areas. In these situations, the use of PII should be limited and appropriate security measures implemented.

# GUIDING QUESTIONS:
 Is access to public health notes and investigation information containing identifiable data limited to personnel requiring the information for an approved purpose?
 Are confidential data elements coded?

# ELECTRONIC DATA SECURITY
Implementation of electronic data security standards will be conducted in a rapidly evolving technological environment. While technology is changing, the following elements will remain important to consider when developing policies.
Access: Access to surveillance data needs to be planned in advance. Access groups can be set up in virtually all IT environments, which will allow the program to designate users with different levels and types of rights. Programs should specify who has access to various data, under what circumstances, and how the identity of users are authenticated. For example, they might stipulate that identifiable data should be accessed only from a properly secure network server rather than from local workstations. Isolated segments or domains can be implemented, which limits access to those in selected groups. They also might limit the times during which data can be accessed, restrict the copying or downloading of data, and set up other controls as needed. Due to the technical nature of these control measures, IT personnel should be involved in the initial assessment and both the formulation and implementation of electronic data security policies.

# A p p e n d i x G a ls o a d d r e s s e s e le c tr o n ic d a t a s e c u r ity issu e s.
Encryption and Backups: Although encryption may not be needed for data on a production registry or surveillance data system located within a secure area and separate from any networks, encryption is still recommended. Any data in such a registry or system do need to be encrypted before being transmitted or downloaded to approved locations and while being used in the field on laptops or similar devices. Although surveillance databases and other files with identifying information need to be backed up, back-up databases and files should be encrypted in accordance with federal encryption standards and stored in a secure location.  Before any portable device containing sensitive data is removed from a secure area, the data must be encrypted. Methods used to sanitize a storage device must ensure that any data on the device cannot be retrieved by using "undelete" or data retrieval software. Hard drives, flash drives, or any other storage media of computers that once contained PII must be sanitized or physically destroyed before the computers are labeled as excess or surplus, reassigned to other staff members, or sent off-site for repair. This requirement also applies to copiers, printers, fax machines, or other equipment that contain internal storage devices.  The faxing of identifiable information is allowed but should be avoided when possible (see Appendix F for guidelines on the use of facsimile machines). The sender of a fax cannot be certain that the fax will actually be received by the person for whom it was intended. Although encrypted fax machines are available, they would be needed at both ends of an encrypted fax transmission.

# GUIDING
 When a fax is necessary, minimize inclusion of confidential information.
 Take precautions (such as a telephone call) to ensure that the recipient is present to receive, and confirm receipt of, the fax.

# GUIDING QUESTIONS:
 Have all alternatives to faxing PII been explored?  Have confidential data items been kept to a minimum?
 Have steps been taken to ensure that a person is standing by to receive and confirm receipt of a fax containing PII?
 Have the steps in Appendix F been followed to ensure secure use of fax machines? control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purpose have access or potential access to personally identifiable information, whether physical or electronic.
Confidential information: Any private information about an identifiable person who has not given consent to make that information public.
Confidentiality: Protection of personal information collected by public health organizations. The right to such protection is based on the principle that personal information should not be released without the consent of the person involved except as necessary to protect public health.
Confidentiality agreement (or nondisclosure agreement): A contract between at least two parties that outlines confidential material, knowledge, or information that the parties wish to share with one another for certain purposes, but wish to restrict access to by third parties. It is a contract through which the parties agree not to further disclose information covered by the agreement. Disclosure: Occurs when identifiable information concerning an individual is made known to a third party. Disclosures may be a u t h o r i z e d (as when a person has consented to the information being so divulged), u n a u t h o r i z e d (as when information is intentionally revealed to a party not consented to by the person), or i n a d v e r t e n t (as when a tabulation or file is unintentionally made available to the public that reveals or can be used to reveal personal information).
Encryption: Manipulation or encoding of information so that only parties intended to view the information can do so. The most commonly available encryption systems involve public key and symmetric key cryptography. In general, for both public and symmetric systems, the larger the key, the more robust the protection.
Identifiable data or identifiable information: See P e r s o n a lly id e n tifia b le i n fo r m a tio n . Personal identifier: Information that allows the identity of a person to be determined with a specified degree of certainty. This could be a single piece of information or several pieces of data which, when taken together, may be used to identify an individual. Therefore, when assembling or releasing analysis data sets, it is important to determine which fields, either alone or in combination, could be used to identify a person and which controls provide an acceptable level of security. Syndemic: Synergist interaction of two or more conditions that contribute to an excess burden of disease in a population.
Virtual private network (VPN): Network of computers that uses encryption to scramble all data sent through the internet-making the network "virtually" private.

# Periodic A ssessm en t Checklist
This checklist can be used to guide the periodic assessment of a program's compliance with the Standards for Data Security and Confidentiality.
For the answer to be "yes" to a question with multiple parts, all boxes must be checked. For each "No" response, provide additional information describing how the program intends to achieve compliance with that standard.