Self-Study Modules on 

Tuberculosis, 6-9

Module 7

Patient Rights and Confidentiality 

in Tuberculosis Control

U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES 

Centers for Disease Control and Prevention 

National Center for HIV/AIDS, Viral Hepatitis, STD, and TB Prevention 

Division of Tuberculosis Elimination 

Atlanta, Georgia 

2014
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

2

Contents 

 Background

 Objectives

 New Terms

 Introduction to Patient Rights and Confidentiality

 The Patient-Health Care Worker Relationship

 Patient Rights

 TB Control and Confidentiality

 Measures to Protect Patient Confidentiality and Ensure Data Security

 Additional Resources

 Answers to Study Questions

 Case Study Answers
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

3

Background 

This module discusses patient rights and general recommendations for developing trust and 

maintaining confidentiality in the context of TB control. 

Health care workers need to be aware of the importance of confidentiality issues involving 

patient-health care worker encounters, as well as to the collection, management, and sharing 

of TB patient data and information. In the treatment of TB disease and latent TB infection 

(LTBI), the relationship between the patient and the health care worker is extremely 

important. If patient information is disclosed to unauthorized persons without the patient’s 

permission, the patient may be stigmatized or experience rejection from family and friends, 

lose a job, or be evicted from housing. Moreover, the health care worker may lose the trust of 

the patient. Therefore, confidentiality— the protection of a patient’s private information— is 

critical in TB control. By using the recommendations in this module, you should be able to 

protect the patient’s rights and their confidentiality and help the TB program fulfill its 

responsibilities to the public. 

Objectives 

After working through this module, you will be able to

1. Define confidentiality.

2. Explain why trust is important to a successful patient-health care worker relationship.

3. List four types of patient’s rights.

4. Describe how confidentiality is an essential issue in several of the core components of 

a TB control program.

define explain list describe
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

4

New Terms 

New terms introduced in this module are included below. Please refer to the Self-Study 

Modules 1-5 Glossary if you encounter unfamiliar terms related to TB that are not defined in 

the glossary below.

authorization— permission given by the 

patient to allow a third party to have access 

to the patient’s confidential information

autonomy— the right of a patient to 

determine what will be done with his or her 

body, personal belongings, and personal 

information; this concept applies to any 

adult person who is mentally competent

confidentiality— the protection of all 

patient information, including patient 

records and information discussed or 

identified during patient-health care 

worker encounters 

court order— an order issued by a court 

mandating an action such as compliance 

with directly observed therapy (DOT) or, in 

very rare cases, detention in a facility until 

treatment is completed

data security— protection of public health 

data and information systems to prevent 

unauthorized release of identifying 

information and accidental loss of data or 

damage to the systems. Security measures 

include measures to detect, document, and 

counter threats to data confidentiality or 

the integrity of data systems. 

 

disclosure— the act of revealing or 

distributing personal information

Health Insurance Portability and 

Accountability Act (HIPAA) Privacy Rule—

provides national standards for protecting 

the privacy of health information. The 

Privacy Rule regulates how organizations 

and health care workers use and disclose 

certain individually identifiable health 

information.

passive case reporting— the required 

reporting of suspected or confirmed TB 

cases to a public health authority

patient-identifiable information—

information in which the identity of the 

patient is directly included or can be 

deduced

privileged information— personal 

information shared by the patient with a 

health care worker
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

5

protected health information (PHI)—

individually identifiable health information 

that is transmitted or maintained in a 

database, this can be electronic media or 

any other form or medium. The protected 

information must relate to 1) the past, 

present, or future physical or mental 

health, condition of an individual; 2) 

provision of health care to an individual; or 

3) payment for the provision of health care 

to an individual. If the information 

identifies or provides a reasonable basis to 

believe it can be used to identify an 

individual, it is considered individually

identifiable health information.

statement of disagreement— a statement 

filed by the patient stating there is a 

disagreement with the health care worker 

or institution regarding the patient’s record

 

TB health care worker— any person who 

cares for and manages TB patients, 

including physicians, nurses, case 

managers, outreach workers, hospital 

discharge planners, pharmacists, social 

workers, peer educators, and volunteers 

 

third party— a person or an organization 

not directly involved in the patient’s care

waiver— a form that patients are often 

asked to sign to allow their health 

information to be used by third parties
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

6

Introduction to Patient Rights and 

Confidentiality 

Patient rights refer to certain basic rules of conduct between patients and any health care 

worker involved with the medical evaluation, treatment, or management of the patient. These 

rights need to be observed by all TB health care workers who are responsible for evaluating 

patients for TB infection or disease, treating and caring for any patient with latent TB infection 

(LTBI) or TB disease, and those health care workers involved in any other public health aspect 

of TB control. 

There are three specific issues related to patient rights of which TB health care workers need 

to be aware: 

 Patients have certain rights that are protected by law and must be respected; 

 Patient confidentiality must be protected to maintain trust and preserve the patienthealth care worker relationship; and 

 Patient rights may sometimes be overridden to protect the public’s health. 

Many patient rights are protected by law to ensure that patients are treated with dignity and 

respect, and that they are empowered to be in charge of their own health. TB health care 

workers must respect these rights to ensure a successful patient-health care worker 

relationship. In the treatment of TB disease and LTBI, the relationship between the patient and 

the health care worker is extremely important. 

TB health care workers must respect patient rights to ensure a successful 

patient-health care worker relationship. 

Maintaining confidentiality is a key component of this relationship. Confidentiality refers to 

the protection of all patient information, including patient records and information discussed 

or identified during patient-health care worker encounters. 

Although it is important to protect every patient’s rights, there are times that health 

departments must also consider the interests of the public’s health. Since health departments 

have a responsibility to protect the health of the public, some patient rights may need to be 

overridden to carry out TB control activities. For example, if a patient does not cooperate with 

the health care worker in completing treatment, the patient may need to continue treatment 

under a court order or be confined for the duration of treatment. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

7

Study Questions 7.1 – 7.2 

 

7.1 What is confidentiality? 

 

 

 

 

 

 

 

7.2 List three issues related to confidentiality and patient rights that health care 

workers need to be aware of. 

Answers to study questions are on pages 35-38
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

8

The Patient-Health Care Worker 

Relationship 

Who is Considered a TB Health Care Worker? 

A TB health care worker is any person who cares for and manages a TB patient, including

 Physicians

 Pharmacists

 Nurses

 Social workers

 Case managers

 Peer educators

 Outreach workers

 Volunteers

 Hospital discharge planners

For TB patients, health care workers may include individuals from both public and private 

sectors. However, because the health department has ultimate responsibility for the TB cases 

in its jurisdiction, the health department should provide oversight of the management of all 

TB cases, including those seen in the private sector. 

A TB health care worker is any person who cares for and 

manages a TB patient. 

Health care workers from the public sector may find that health care workers from the private 

sector are reluctant to share patient information. Health care workers from the public sector 

must be prepared to inform health care workers from the private sector about health 

department confidentiality policies and procedures regarding the collection, management, 

and sharing of data gathered on TB patients. Health care workers in the public sector should 

emphasize that because TB is considered a significant threat to the public’s health, the 

disclosure of patient information from the private health care worker to a designated public 

health authority without the patient’s permission or authorization is allowed for the purpose 

of TB control. For example, the Health Insurance Portability and Accountability Act (HIPAA) 

Privacy Rule and most other medical data privacy laws allow disclosure of identifiable data 

from health care workers, data clearinghouses, and insurers to public health authorities 

without individual written authorization. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

9

What is the Patient-Health Care Worker Relationship? 

The patient-health care worker relationship is the basis for: 

 Sharing information

 Communicating beliefs and feelings that affect patient care

 Building trust between the patient and the health care worker

The patient-health care worker relationship can be viewed as an agreement between the 

patient and the health care worker. This agreement includes basic rules that both the patient 

and the health care worker will observe during the course of their relationship, such as 

respecting each other’s rights and upholding responsibilities. If either person fails to keep 

their agreement, misunderstandings, a lapse in communication, or treatment failure can 

occur. 

The Importance of Trust in the Patient-Health Care Worker Relationship 

The quality of the patient-health care worker relationship is especially important in TB 

control, because long-term adherence to treatment is necessary. A strong patient-health care 

worker relationship is built on trust and the protection of confidentiality. 

Trust means that the patient believes in the integrity, ability, and character of the health care 

worker. If there is trust between a patient and his or her health care worker, the patient may 

be more likely to adhere to treatment, name contacts, and follow the health care worker’s 

instructions and advice. Therefore, health care workers should strive to gain a patient’s trust 

by 

 Maintaining confidentiality

 Providing complete and accurate information

 Respecting the patient’s autonomy

A strong patient-health care worker relationship is built on trust and the 

protection of confidentiality. 

Once developed, it is important to maintain trust. The patient may share personal information 

about lifestyle choices and risky, even potentially illegal behaviors, such as substance use. It 

is important that the health care worker assures the patient that personal information such as 

this will not be shared with authorities. 

If personal information is revealed to others without the patient’s permission, the patient’s 

trust in the health care worker could be threatened and may result in serious consequences, 

such as the 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

10

 Patient-health care worker relationship may be damaged

 Health care worker may lose the trust of other patients and/or the community

 Patient may be stigmatized

If personal information is revealed to others without the patient’s 

permission, the patient’s trust in the health care worker could be threatened 

and may result in serious consequences. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

11

Study Questions 7.3 – 7.5 

 

7.3 What does the patient-health care worker relationship serve as the basis for? 

 

 

 

 

 

 

 

7.4 List three ways health care workers can develop trust with a patient. 

 

 

 

 

 

 

 

 

7.5 Why is trust important to a successful patient-health care worker 

relationship? 

Answers to study questions are on pages 35-38
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

12

Case Study 7.1 

 

Van is a cook at a local restaurant. He came to the health department after his 

girlfriend, Tanya, told him that she had been diagnosed with TB disease. After 

undergoing a complete medical evaluation, it was confirmed that Van also has TB 

disease. 

Van is not from the United States and does not have the proper documents to be 

working in this country. During an interview with his health care worker, Van was 

reluctant to provide information on where he worked. He does not want to get 

his employer in trouble nor does he want to be reported to immigration 

authorities. Van was also afraid that if people at work found out that he had TB, 

he would lose his job. Finally, Van also admitted to injecting drugs with some 

friends occasionally, but was reluctant to give their names because he didn’t 

want his friends to know that he had TB. He was also afraid his friends might be 

reported to the police. 

 Why is it important to protect Van's personal information? 

 What can the health care worker do to develop trust with Van? 

Answers to case studies are on pages 39-41
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

13

Patient Rights 

Patients have certain rights concerning their personal information relevant to their medical 

care. These rights are explained below and summarized in Table 7.1. 

 Give or withhold authorization of disclosures

 Maintain privacy

 Have autonomy

 Be given information

The Right to Give or Withhold Authorization of Disclosures 

Disclosure is the act of revealing or distributing personal information. Patients have the right 

to give or withhold authorization of disclosures. This means that the patient should have 

control over

 Who will receive his or her personal information 

 What information should be released 

 How long the authorization of disclosure will last

Disclosure is the act of revealing or distributing personal information. 

A patient discloses personal information to a health care worker so that he or she can receive 

appropriate treatment and care. Health care workers are allowed to share patient information 

with others directly involved in the management of the patient to provide quality care. For 

example, an outreach worker can discuss a patient’s medication side effects with the clinic 

physician. 

Sometimes health care workers are asked by a third party to disclose patient information. A 

third party is a person or organization not directly involved in the patient’s care (e.g., media 

or workplace). In these situations, health care workers are not allowed to disclose patient 

information. The patient needs to give specific authorization to allow a third party access to 

their confidential information. TB programs and health care workers should carefully consider 

if requests from third parties are legitimate before asking patients to authorize disclosures. 

To give authorization, patients are often asked to sign a waiver or a permission form. These 

documents should be carefully explained to patients. The patient has a right to refuse 

requests by third parties, as well as the right to limit the authorization in any way he or she 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

14

wishes, except where disclosure is provided by law. A public health authority can disclose 

personal information if there is an overriding public health need.

The patient needs to give specific authorization to allow a third party access 

to their confidential information. 

Patient authorization is NOT needed for passive case reporting. Passive case reporting is the 

required reporting of suspected or confirmed TB cases to a public health authority.

The Right to Maintain Privacy 

Health care workers should protect information revealed during patient-health care worker 

encounters, including all written or electronic records of these encounters. Only those 

persons directly involved in the care of the patient should have access to private information. 

Health care workers need to be aware of the patient’s right to privacy in the collection, 

management, and sharing of information and data. Personal information shared by the 

patient with his or her health care worker is considered privileged information and should be 

protected. This information is usually entered into the patient’s medical record and into any 

secondary databases that are maintained by the health care worker or institution where the 

patient receives care. 

Personal information shared by the patient with his or her health care 

worker is considered privileged information and should be protected. 

Secondary databases are usually maintained for the purposes of

 Sharing information among members of the health care team 

 Conducting reporting and surveillance of diseases or medical conditions 

 Financing health care through reimbursements from the government or a private 

organization (e.g., an insurance company) 

 Conducting institutional review of the quality of care and appropriateness of 

expenditures 

When the patient’s identity is either directly included in or can be deduced from such 

information, it is sometimes referred to as patient-identifiable information. 

 

The Right to Have Autonomy 

Autonomy is the right of a patient to determine control over his or her body, personal 

belongings, and personal information. The concept of autonomy applies to any adult person 

who is mentally competent. The right to autonomy has some limitations designed to protect 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

15

the patient. For example, if the patient is a child or a mentally incompetent adult, a parent or 

legal guardian typically acts as the decision maker. 

Autonomy is the right of a patient to determine control over his or her body, 

personal belongings, and personal information. 

Sometimes the right to autonomy can be overridden in the interest of protecting others who 

may be harmed by the patient’s decisions. This can happen in TB control when a patient with 

infectious TB disease refuses treatment. Because the patient poses a significant health risk to 

the public, he or she may receive a court order which mandates directly observed therapy 

(DOT) or, in rare cases, detention in a facility until treatment is completed. (For more 

information on legal remedies to nonadherence, refer to Module 6, Managing Tuberculosis 

Patients and Improving Adherence.) Health departments should contact their legal counsel for 

guidance on this process.

With the exception of the situations mentioned above, autonomy means that health care 

workers should respect patient decisions about their health care. 

Sometimes the right to autonomy can be overridden in the interest of 

protecting others who may be harmed by the patient’s decisions. 

The Right to Be Given Information 

The patient has a right to be given information about his or her medical diagnosis, treatment 

regimen, and progress. This allows the patient to make informed decisions about his or her 

health care. For example, a patient with TB disease has a right to know the treatment options 

available, the duration of treatment, potential side effects of the drugs, and the expected 

outcome. This information may be valuable to the patient not only for making health care 

decisions, but also for making decisions about other important issues such as housing or 

family matters. 

The patient has a right to be given information about his or her medical 

diagnosis, treatment regimen, and progress. 

The patient also has a right to review the information in his or her medical record. The patient 

may want this information to learn more about his or her health care or in preparation for a 

change of health care workers. If the record contains errors or omissions, the patient can 

request a correction. Usually, this request must be approved by the health care worker or 

institution that maintains the record. If the health care worker or institution does not agree 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

16

that the record should be corrected, the patient can usually file a statement of disagreement. 

The documentation of a patient’s medical history is very important and can affect current and 

future medical decisions for the patient. Therefore, it is important that it be as accurate and 

objective as possible when documenting patient information. 

The patient also has a right to review the information in his or her medical 

record. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

17

Table 7.1 

Summary of Patient Rights 

Type of Patient Right Description 

The right to give or 

withhold authorization 

of disclosures

The patient generally has the right to control who has access 

to confidential information except as required by law. The 

patient needs to give specific authorization to allow a third 

party to have access to confidential information. However, a 

public health authority can disclose personal information if 

there is an overriding public health need. 

The right to maintain 

privacy

Only persons directly involved in the care of the patient should 

have access to private information. Health care workers should 

protect all patient information.

The right to have 

autonomy

Autonomy is the right of a patient to determine control over his 

or her body, personal belongings, and personal information; this 

concept applies to any adult person who is mentally competent. 

Sometimes the right to autonomy can be overridden in the 

interest of protecting others who may be harmed by the patient’s 

decisions.

The right to be given 

information

The patient has a right to information about his or her medical 

diagnosis, treatment regimen, and progress. This allows the 

patient to make informed decisions about his or her health care.
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

18

Study Questions 7.6 – 7.8 

 

7.6 List four types of patient’s rights. 

7.7 What is an authorization form or waiver and when is it used? 

7.8 What is patient-identifiable information? 

Answers to study questions are on pages 35-38
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

19

 

TB Control and Confidentiality 

Confidentiality is essential in many aspects of TB control, including patient-health care 

worker encounters, as well as the collection, management, and sharing of TB patient data and 

information. It is the responsibility of health care workers to protect patient information and 

to make sure that only persons directly involved in patient care or public health activities have 

access to patient information. If patient information is disclosed to unauthorized persons 

without the patient’s permission, the patient may be stigmatized or experience rejection from 

family, friends, and others. Great care must be taken to ensure that patients’ rights to privacy 

are protected to the fullest extent possible such that the patient-health care worker 

relationship is not compromised. Additionally, it is important for health care workers to 

maintain confidentiality and have a good relationship with patients to ensure they do not lose 

the trust of the community as a whole. This is particularly important in small, close-knit 

communities. 

It is the responsibility of health care workers to protect patient information. 

Multiple laws and regulations exist to protect data security and confidentiality. For example, 

the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule generally 

prohibits the use or disclosure of protected health information (PHI) without written 

authorization from the patient. There are several exceptions to this requirement, including an 

exception for public health. PHI can be disclosed to public health authorities for public health 

purposes including, but not limited to, public health surveillance, investigations, and 

interventions. Additionally, each state may have its own laws regarding security and 

confidentiality of patient information. Health care workers should become familiar with the 

confidentiality laws in their jurisdiction. 

Health care workers should become familiar with the confidentiality laws in 

their jurisdiction. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

20

Confidentiality must be preserved in the following TB control activities:

 Ensuring adequate patient care 

 Performing contact investigations

 Collecting and analyzing data 

 Conducting program evaluation 

 Referring patients to other jurisdictions

Ensuring Adequate Patient Care 

The most effective strategy to ensure patients adhere to TB treatment is directly observed 

therapy (DOT). This method of treatment involves frequent meetings between the patient and 

the health care worker. These meetings take place at locations that are convenient for the 

patient. Health care workers should make sure that the patient’s confidentiality is protected 

during these encounters. This means that 

 The location should allow for privacy

 Other persons should not be present without the patient’s permission

Occasionally, a TB patient may decide not to cooperate with the health care worker in 

completing treatment. When this happens, the health care worker has a responsibility to 

 Review the potential causes of the patient’s nonadherence

 Identify potential solutions

 Meet the patient’s needs to assist completion of therapy

A TB patient may decide not to cooperate with the health care worker in 

completing an adequate regimen. When this happens, the health care 

worker has a responsibility to review the causes of the patient’s 

nonadherence, identify potential solutions, and try to meet the patient’s 

needs to the extent possible. 

If these measures fail, the patient may be required to continue treatment under a court order 

or be isolated until noninfectious. Although disclosure of patient information is necessary to 

obtain a court order or an order for confinement, such disclosure should be limited to the 

appropriate authorities who need the information. Any health department or law enforcement 

officials who become involved should take care to protect the patient’s right to privacy. A 

breach of confidentiality in these circumstances can undermine the patient-health care 

worker relationship and lead to continued problems with adherence. (For more information 

about addressing nonadherence, refer to Module 6, Managing Tuberculosis Patients and 

Improving Adherence.) 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

21

Performing Contact Investigations 

When a case of infectious TB disease is reported, a contact investigation should be conducted 

to identify persons who may have been in contact with that person and to assess those 

persons for TB infection and TB disease. (For more information about TB contact 

investigations, refer to Module 8, Contact Investigations for Tuberculosis.) 

To conduct a contact investigation, health care workers interview the patient to get 

information about where the patient spent time and who they spent time with while 

infectious. The health care worker should ensure that interviews with the patient take place in 

private. Health care workers should emphasize confidentiality, yet inform the patient that 

relevant information may need to be shared with other health department staff who have a 

need to know. Additionally, if the patient spent time in a congregate setting (e.g., a school or 

shelter) while infectious, the health care worker should inform the patient that an appropriate 

site manager (e.g., school principal or supervisor) may need to be notified such that they can 

assist in accurately and efficiently identifying contacts who need to be evaluated. If the 

patient’s identity is revealed to a site manager, the health department should obtain a signed 

confidentiality agreement from the site manager. 

The health care worker should be careful not to inadvertently reveal clues about the TB 

patient’s identity while meeting with the patient’s contacts. Confidentiality should not be 

violated even if contacts refuse to be evaluated. The following strategies can be used to 

protect the confidentiality of the patient when meeting with contacts: 

 Use gender-neutral language. For example, “Someone you have spent time with was 

diagnosed with TB and they were concerned about you” instead of “A woman you have 

spent time with was diagnosed with TB and she was concerned about you.” 

 Do not mention the patient’s health care worker, place and dates of diagnosis, or 

hospitalization history. 

 Do not mention the environment in which the exposure occurred. For example, “You 

have been around someone who has TB” instead of “You have been around someone at 

work who has TB.” 

 Do not confirm the name of the patient if the contact correctly guesses his or her 

identity 

Confidentiality should not be violated even if contacts refuse to be 

evaluated. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

22

Patients should be informed that sometimes despite best efforts, their TB status may be 

inadvertently disclosed to others. For example, a friend, family member, or co-worker of the 

patient may share information about the patient to others. The patient and the health care 

worker should discuss this possibility and be prepared to address the situation in the event 

that privacy is not maintained. To prevent breaches in confidentiality, patients should be 

advised to inform only persons they trust about their TB diagnosis. 

Patients should be informed that despite best efforts, sometimes 

confidentiality is not preserved. 

Collecting and Analyzing Data 

An important part of confidentiality is data security. Data security is the protection of public 

health data and information systems to prevent unauthorized release of identifying 

information and accidental loss of data or damage to the systems. Security measures include 

measures to detect, document, and counter threats to data confidentiality or the integrity of 

data systems. 

Data security is the protection of public health data and information 

systems to prevent unauthorized release of identifying information and 

accidental loss of data or damage to the systems. 

All 50 states and the District of Columbia mandate that physicians and other health care 

providers report newly diagnosed cases of TB to the state health department. State health 

departments report this TB surveillance data to CDC under an agreement between the CDC 

and the Council of State and Territorial Epidemiologists (CSTE). 

The disclosure of patient information to a designated public health authority is allowed 

without written authorization from the patient because TB is considered a significant threat to 

public health. Health departments are required to comply with privacy laws intended to keep 

TB patient information confidential. 

Security and confidentiality is particularly important when collecting and analyzing data with 

identifiable (e.g., names and addresses) and potentially identifiable (e.g., dates of birth, lab 

report dates, immigration status, county, or age greater than 89) patient information. TB 

control programs should develop specific policies to ensure the security and confidentiality of 

TB records. For example, policies and procedures should be in place to protect all TB reports, 

records, and files containing patient names or other identifying information. Data security 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

23

and confidentiality guidelines were developed by the CDC National Center for HIV/AIDS, Viral 

Hepatitis, STD, and TB Prevention in 2011 as a reference for states implementing data 

confidentiality policies. These guidelines are available at www.cdc.gov/nchhstp/ 

programintegration/docs/PCSIDataSecurityGuidelines.pdf . Staff members should have a 

clear understanding of these and other existing state and local data security and 

confidentiality requirements.

Policies and procedures should be in place to protect all TB reports, records, 

and files containing patient names or other identifying information. 

National Electronic Disease Surveillance System (NEDSS)- compliant systems such as the 

NEDSS Base System (NBS) Tuberculosis Program Area Module (TB PAM) or the Electronic 

Report of Verified Case of Tuberculosis (eRVCT) should be used to maintain the security and 

confidentiality of data. These surveillance systems encrypt protected information during 

transfers of data to CDC for national surveillance purposes. Although these systems allow for 

the collection and storage of personal identifiers such as names and street addresses for local 

and state TB surveillance purposes, these identifiers are not transmitted to CDC. These 

precautions help to limit unauthorized access to surveillance information. 

Because HIV/AIDS can have serious implications for TB care and treatment, some health 

jurisdictions have additional confidentiality rules and regulations for the sharing of 

information between TB and HIV/AIDS programs. AIDS is a reportable disease in every state. 

The requirements for reporting HIV infection differ from state to state, and health care 

workers should be familiar with local reporting requirements. For clinical care purposes, HIVrelated information should be shared between TB health care workers and other health care 

workers in accordance with state and local laws. 

For clinical care purposes, HIV-related information should be shared 

between TB health care workers and other health care workers in 

accordance with state and local laws. 

TB programs often collaborate with HIV/AIDS programs to conduct annual TB and HIV/AIDS 

registry matches to ensure completeness of reporting for HIV and TB coinfected patients. 

These TB programs should adhere to the same confidentiality standards as HIV/AIDS 

surveillance programs and should work with local HIV/AIDS programs to establish equivalent 

data security and confidentiality policies. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

24

Conducting Program Evaluation 

Program evaluation reports serve as a basis for policy and program development and are 

often shared with appropriate public, private, and community groups. TB programs collect 

and analyze 

 Morbidity rates

 Trends

 Demographic characteristics of TB patients in the area

Evaluation reports also assess program performance by determining the rates for

 Completion of therapy 

 Contact identification

 Initiation and completion of treatment for LTBI

Program evaluation reports should never include patient-identifiable information, such as 

names, addresses, or detailed demographic information that could be used to identify the 

patient.

Program evaluation reports should never include patient-identifiable 

information. 

Referring Patients to Other Jurisdictions 

If a patient travels or moves from one health jurisdiction to another, the health department of 

the patient’s home jurisdiction should notify the health department for the area to which the 

patient is moving. It is important that information is given to the receiving jurisdiction, to 

ensure the patient continues their TB care and treatment. Health care workers should be 

aware that confidentiality and security laws and procedures may vary from state to state. (For 

more information about interjurisdictional referrals, refer to Module 6, Managing 

Tuberculosis Patients and Improving Adherence.) 

If a patient travels or moves from one health jurisdiction to another, the 

health department of the patient’s home jurisdiction should notify the 

health department for the area to which the patient is moving. 

Although sharing information between health care workers, health departments, and health 

jurisdictions is encouraged to protect the health of the patient and the public, information 

should be shared only on a need-to-know basis. Confidential information should be 

transferred via secure electronic methods, personal communication, or hard-copy mail 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

25

delivery whenever possible. When sending information via mail, email, or fax, measures 

should be taken to ensure confidentiality. For example, any materials sent through the mail 

should be sent directly to a specific person and, if possible, with added security such as 

signature confirmation, restricted delivery, or certified mail. Health care workers should never 

fax patient information if they are unsure that the receiving fax machine is in a secure area. 

All information sent by fax or email should be sent to a specific person and labeled 

confidential. Never send any information with patient-identifiable information through email 

without encryption. 

When sending information via mail, email, or fax, measures should be taken 

to ensure confidentiality. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

26

Study Questions 7.9 – 7.12 

 

7.9 List two ways health care workers can protect patient confidentiality 

during DOT encounters. 

 

 

 

 

 

7.10 List four strategies health care workers can use to protect patient 

confidentiality when conducting contact investigations. 

 

 

 

 

 

7.11 Why is disclosure of patient information allowed for routine case 

reporting? 

 

 

 

 

 

7.12 How can health care workers ensure security and confidentiality when 

referring patients to other jurisdictions? 

Answers to study questions are on pages 35-38

 

 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

27

Case Study 7.2 

 

Miranda is a high school student who was recently diagnosed with infectious TB 

disease. During an interview with her health care worker, she reported that she 

rides the bus to school every day and participates in a few extracurricular 

activities. Miranda was reluctant to provide additional information about her 

contacts because she did not want anyone at school to know she has TB. 

 How should the health care worker respond to Miranda’s concerns 

about confidentiality? 

 

 

 One of Miranda’s classmates refuses to be evaluated without knowing 

the identity of the person who may have infected them. What should 

the health care worker do in this situation? 

Answers to case studies are on pages 39-41
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

28

Measures to Protect Patient 

Confidentiality and Ensure Data 

Security 

Measures to Protect Patient Confidentiality 

Health care workers should take the following measures to protect patient confidentiality 

when meeting with a patient

 Confirm the patient’s identity at the first encounter

 Conduct patient interviews in private (Figure 7.1)

 Ensure interpreters understand the importance of confidentiality

Figure 7.1 Conducting patient interviews in privacy.

After meeting a patient, health care workers should 

 Never discuss the patient’s case with anyone without the patient’s permission (unless 

there is a public health need)

 Never discuss cases or use patient names in a public area

 Use only secure routes to send patient information and always mark as confidential
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

29

Ensuring Data Security and Confidentiality in an Office, Clinic, or 

Institution 

Data security is also an important aspect of confidentiality. Care should be taken to ensure 

the safeguarding of patient information in an office, clinic, or institution. 

 If a staff member or health care worker requests patient information, establish his or 

her authority to do so before disclosing anything. 

 Keep records that contain patient names and other identifying information in closed, 

locked files (Figure 7.2). Never leave hard copies of forms or records where 

unauthorized persons may access them. 

 Restrict access to electronic databases to designated staff. 

 Carefully protect computer passwords; never give them to unauthorized persons. 

 Keep computers in a locked or restricted area; password protect computers. 

 Keep printouts of electronic information in a restricted or locked area; printouts that 

are no longer needed should be shredded. 

Figure 7.2 Closed, locked files.

Health care workers have a responsibility to protect patient records from unauthorized 

access. Information that should be kept in locked files except when being processed by 

authorized staff include: 

 Medical records

 Report of Verified Case of Tuberculosis (RVCT) forms

 Communicable disease report cards

 Other records that contain patient names and other identifying information
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

30

Health care workers have a responsibility to protect patient records from 

unauthorized access. 

No papers should be exposed when workers are away from the work area, even for brief 

periods. Access to all RVCT forms, communicable disease report cards, and the files 

containing this information should be restricted to designated TB program staff who are 

directly involved with surveillance or case work and who have a need to know. Access to such 

databases should be protected by a combination of user IDs and passwords. User IDs should 

be issued only to staff who require access to the database to perform their official duties. 

Protecting Confidentiality in the Field 

When conducting field visits, health care workers may need to ask for patients by name or ask 

about a patient’s work location and habits. This should be done as discreetly as possible. For 

example, a health care worker could ask for a patient by name but should not explain that 

they are from the TB Program. 

In the field, there are important measures that can be taken to protect patient confidentiality: 

 Conduct patient interviews in private; never discuss the case in a public place.

 Do not leave confidential information in messages for the patient on a door.

 Do not leave confidential information on an answering machine.

 Do not leave confidential information with a neighbor or friend.

 Do not disclose the patient’s condition when gathering information on his or her 

whereabouts.

In the field, there are important measures that can be taken to protect 

patient confidentiality. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

31

Study Questions 7.13 – 7.15 

 

7.13 List three general measures to protect patient confidentiality. 

7.14 List four ways to ensure data security in the office, clinic, or institution. 

7.15 List four measures health care workers can take to protect confidentiality 

while working in the field. 

Answers to study questions are on pages35-38
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

32

Case Study 7.3 

Rolando is a health care worker at a TB clinic. It is the end of a very busy Friday 

afternoon. He is trying to wrap things up and go home after his extremely 

stressful week. He is going through the patient-related forms he has been 

working on that day. He is on his way to put the forms in the file cabinet when he 

is interrupted by a phone call from his babysitter. His babysitter explains that 

she has to leave early that day. Thinking it is an emergency, Rolando hastily 

hands over the files to his co-worker Sam in the clinic area. He asks Sam to put 

the files on his desk. Before getting a reply from Sam, he leaves. Sam was not 

very happy because he was also just about to leave. He ends up leaving the files 

on the table in the clinic, an area where other patients may see the files. 

 What measures should Rolando have taken to ensure security and 

confidentiality? 

Answers to case studies are on pages 39-41
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

33

Case Study 7.4 

Janice is an outreach worker at a TB clinic. She has been trying to contact her 

patient Jerry for several days. She has visited his home several times and tried to 

call him. One time when she visits Jerry’s house, she sees Jerry’s neighbor. The 

neighbor tells Janice that Jerry just left. Janice introduces herself to Jerry’s 

neighbor and explains that she is from the TB clinic in the health department and 

is looking for Jerry. She tells the neighbor that if she sees Jerry, please tell him 

that she has stopped by to see him. Finally, she leaves a message for Jerry on the 

front door of his house. She does not have any envelopes for her letter, but 

decides Jerry must really get her message and so she tapes it to his door. 

 Did Janice do anything that possibly threatens Jerry's confidentiality? 

 What measures should Janice have taken to protect Jerry’s 

confidentiality? 

Answers to case studies are on pages 39-41
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

34

Additional Resources 

1. CDC. Data Security and Confidentiality Guidelines for HIV, Viral Hepatitis, Sexually

Transmitted Disease, and Tuberculosis Programs: Standards to Facilitate Sharing and

Use of Surveillance Data for Public Health Action. Atlanta, GA: Department of Health

and Human Services, CDC: 2011. www.cdc.gov/nchhstp/

programintegration/docs/PCSIDataSecurityGuidelines.pdf.

2. CDC. Frequently Asked Questions About HIPAA Privacy Rule: Provisions Relevant to

Public Health Practice. Atlanta, GA: Department of Health and Human Services, CDC;

2013. www.cdc.gov/nhsn/faqs/FAQ_HIPPArules.html.

3. CDC. HIPAA Privacy Rule and Public Health: Guidance from CDC and the U.S.

Department of Health and Human Services. MMWR 2003; 52 (S-1): 1–12.

www.cdc.gov/mmwr/preview/mmwrhtml/su5201a1.htm.

4. CDC. Privacy Legislation and Regulations. Atlanta, GA: Department of Health and

Human Services, CDC; 2010. www.cdc.gov/od/science/integrity/privacy.

5. CDC. Tuberculosis Control Laws— United States, 1993: recommendations of the

Advisory Council for the Elimination of Tuberculosis (ACET). MMWR. 1993;42(RR15):1–28. http://www.cdc.gov/mmwr/preview/mmwrhtml/00030715.htm.
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

35

Answers to Study Questions 

7.1 What is confidentiality? 

Confidentiality is the protection of all patient information, including patient records and

information discussed or identified during patient-health care worker encounters.

7.2 List three issues related to confidentiality and patient rights that health care workers 

need to be aware of. 

Three specific issues related to confidentiality and patient rights that health care workers

need to be aware include

 Patients have certain rights that are protected by law and must be respected;

 Patient confidentiality must be protected to maintain trust and preserve the 

patient-health care worker relationship; and

 Patient rights may sometimes be overridden to protect the public’s health.

7.3 What does the patient-health care worker relationship serve as the basis for?

The patient-health care worker relationship is the basis for

 Sharing information

 Communicating beliefs and feelings that affect patient care

 Building trust between the patient and the health care worker

7.4 List three ways health care workers can develop trust with a patient. 

Health care workers should strive to gain a patient’s trust by: 

 Maintaining confidentiality

 Providing complete and accurate information

 Respecting the patient’s autonomy

7.5 Why is trust important to a successful patient-health care worker relationship? 

Trust means that the patient believes in the integrity, ability, and character of the health 

care worker. If there is trust between a patient and his or her health care worker, the 

patient may be more likely to adhere to treatment, name contacts, and follow the health 

care worker’s instructions and advice. Once developed, it is important to maintain trust.

The patient may share personal information about lifestyle choices and risky, even 

potentially illegal behaviors, such as substance use. It is important that the health care 

worker assures the patient that personal information such as this will not be shared with 

authorities.
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

36

If personal information is revealed to others without the patient’s permission, the 

patient’s trust in the health care worker could be threatened and may result in serious 

consequences, such as the: 

 Patient-health care worker relationship may be damaged

 Health care worker may lose the trust of other patients and/or the community

 Patient may be stigmatized

7.6 List four types of patient’s rights. 

 The right to give or withhold authorization of disclosures

 The right to maintain privacy

 The right to have autonomy

 The right to be given information

7.7 What is an authorization form or waiver and when is it used? 

An authorization form or waiver is a document that patients sign in order to allow a third 

party access to their confidential information. These documents should be carefully 

explained to patients. The patient has a right to refuse requests by third parties, as well 

as the right to limit the authorization in any way he or she wishes, except where 

disclosure is provided by law. TB programs and health care workers should carefully 

consider if requests from third parties are legitimate before asking patients to authorize 

disclosures. 

7.8 What is patient-identifiable information? 

Patient-identifiable information is when the patient’s identity is either directly included 

or can be deduced from the information. 

7.9 List two ways health care workers can protect patient confidentiality during DOT 

encounters. 

Health care workers should make sure that the patient’s confidentiality is protected 

during DOT encounters. This means that

 The location should allow for privacy

 Other persons should not be present without the patient’s permission

7.10 List four strategies health care workers can use to protect patient confidentiality when 

conducting contact investigations. 

The health care worker should ensure that contact investigation interviews with the 

patient take place in private. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

37

The health care worker should also be careful not to reveal identifying clues about the 

TB patient while meeting with the patient’s contacts. Confidentiality should not be 

violated even if contacts refuse to be evaluated. The following strategies can be used to 

protect the confidentiality of the patient when meeting with contacts: 

 Use gender-neutral language. For example, “Someone you have spent time with 

was diagnosed with TB and they were concerned about you” instead of “A woman 

you have spent time with was diagnosed with TB and she was concerned about 

you.” 

 Do not mention the patient’s health care worker, place and dates of diagnosis, or 

hospitalization. 

 Do not mention the environment in which the exposure occurred. For example, 

“You have spent time with someone who has TB” instead of “You have spent time 

with someone at work who has TB.” 

 Do not confirm the name of the patient if the contact correctly guesses his or her 

identity. 

7.11 Why is disclosure of patient information allowed for routine case reporting?

The disclosure of patient information to a designated public health authority is allowed 

for routine case reporting without written authorization from the patient because TB is 

considered a significant threat to public health. Health departments are required to 

comply with privacy laws intended to keep TB patient information confidential.

7.12 How can health care workers protect patient confidentiality when referring patients to 

other jurisdictions? 

Confidential information should be transferred via secure electronic methods, personal 

communication, or hard-copy mail delivery when possible. When sending information via 

mail, email, or fax, measures should be taken to ensure confidentiality. For example, any 

materials sent through the mail should be sent directly to a specific person and, if 

possible, with added security such as signature confirmation, restricted delivery, or 

certified mail. Health care workers should never fax patient information if they are 

unsure that the receiving fax machine is in a secure area. All information sent by fax or 

email should be sent to a specific person and labeled confidential. Never send any 

information with patient-identifiable information through email without encryption.

7.13 List three general measures to protect patient confidentiality. 

Measures health care workers can take to protect patient confidentiality include:

 Confirm the patient’s identity at the first encounter. 

 Conduct patient interviews in private. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

38

 Ensure interpreters understand the importance of confidentiality. 

 Never discuss the patient’s case with anyone without the patient’s permission. 

 Never discuss cases or use patient names in a public area. 

 Use only secure routes to send patient information and always mark as confidential. 

7.14 List four ways to ensure data security in the office, clinic, or institution. 

Health care workers can ensure data security by doing the following:

 If a staff member or health care worker requests patient information, establish his 

or her authority to do so before disclosing anything.

 Keep records that contain patient names and other identifying information in 

closed, locked files. Never leave hard copies of forms or records where 

unauthorized persons may access them.

 Restrict access to electronic databases to designated staff.

 Carefully protect computer passwords; never give them to unauthorized persons.

 Keep computers in a locked or restricted area; password protect computers.

 Keep printouts of electronic information in a restricted or locked area; printouts 

that are no longer needed should be shredded.

7.15 List four measures health care workers can take to protect confidentiality while working 

in the field. 

In the field, there are important measures that can be taken to protect patient 

confidentiality:

 Conduct patient interviews in private; never discuss the case in a public place. 

 Do not leave confidential information in messages for the patient on a door. 

 Do not leave confidential information on an answering machine. 

 Do not leave confidential information with a neighbor or friend. 

 Do not disclose the patient’s condition when gathering information on his or her 

whereabouts. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

39

Case Study Answers 

7.1 Van is a cook at a local restaurant. He came to the health department after his 

girlfriend, Tanya, told him that she had been diagnosed with TB disease. After 

undergoing a complete medical evaluation, it was confirmed that Van also has TB 

disease. 

 

Van is not from the United States and does not have the proper documents to be 

working in this country. During an interview with his health care worker Van was 

reluctant to provide information on where he worked. He did not want to get his 

employer in trouble and he does not want to be reported to immigration authorities. 

Van was also afraid that if people at work found out that he had TB, he would lose his 

job. Finally, Van also admitted to injecting drugs with some friends occasionally, but 

was reluctant to give their names because he didn’t want his friends to know that he 

had TB. He was also afraid his friends might be reported to the police. 

 

 Why is it important to protect Van's personal information? 

If personal information is revealed to others without Van’s permission, his trust in the 

health care worker could be threatened and may result in serious consequences, such 

as:

• The patient-health care worker relationship may be damaged

• The health care worker may lose the trust of other patients and/or the 

community

• Van may be stigmatized

 What can the health care worker do to develop trust with Van? 

The health care worker should strive to gain Van’s trust by: 

• Maintaining confidentiality

• Providing complete and accurate information

• Respecting Van’s autonomy

Once developed, it is important to maintain trust. The health care worker should 

assure Van that personal information, such as injecting drugs, will not be shared with 

authorities. 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

40

7.2 Miranda is a high school student who was recently diagnosed with infectious TB 

disease. During an interview with a health care worker, she reported that she rides 

the bus to school every day and participates in a few extracurricular activities. 

Miranda was reluctant to provide additional information on her contacts because she 

did not want anyone at school to know she has TB. 

 How should the health care worker respond to Miranda’s concerns about 

confidentiality? 

The health care worker should tell Miranda that all of her personal information will 

be kept as confidential as possible. Since Miranda is in school, it may be necessary 

for the health care worker to inform an appropriate site manager (e.g., the school 

principal) such that they can assist in accurately and efficiently identifying contacts 

who need to be evaluated. The health care worker should tell Miranda that if this 

needs to happen, the health department will obtain a signed confidentiality 

agreement from the site manager.

The health care worker should tell Miranda that he or she will not reveal her

name or any clues about her while meeting with contacts.

 One of Miranda’s classmates refuses to be evaluated without knowing the identity 

of the person who may have infected them. What should the health care worker do 

in this situation? 

The health care worker should not violate Miranda’s confidentiality even if one of 

her contacts refuses to be evaluated. Additionally, the health care worker should 

not confirm Miranda’s name even if the contact correctly guesses her identity.

 
Module 7—Patient Rights and Confidentiality in Tuberculosis Control 

41

7.3 Rolando is a health care worker at a TB clinic. It is the end of a very busy Friday 

afternoon. He is trying to wrap things up and go home after his extremely stressful 

week. He is going through the patient-related forms he has been working on that 

day. He is on his way to put the forms in the file cabinet when he is interrupted by 

a phone call from his babysitter. His babysitter explains that she has to leave early 

that day. Thinking it is an emergency, Rolando hastily hands over the files to his 

co-worker Sam in the clinic area. He asks Sam to put the files on his desk. Before 

getting a reply from Sam, he leaves. Sam was not very happy because he was also 

just about to leave. He ends up leaving the files on the table in the clinic, an area 

where other patients may see the files. 

 

 What measures should Rolando have taken to protect patient confidentiality?

Rolando should have ensured that patient records that contain patient names and 

other identifying information were placed in a closed locked file cabinet. In 

addition, no papers should be exposed when workers are away from the work area, 

even for brief periods of time. 

7.4 Janice is an outreach worker at a TB clinic. She has been trying to contact her patient 

Jerry for several days. She has visited his home several times and tried to call him. One 

time when she visits Jerry’s house she sees Jerry’s neighbor. The neighbor tells Janice 

that Jerry just left. Janice introduces herself to Jerry’s neighbor and explains that she is 

from the TB clinic in the health department and is looking for Jerry. She tells the 

neighbor that if she sees Jerry, please tell him that she has stopped by to see him. 

Finally, she leaves a message for Jerry on the front door of his house. She does not 

have any envelopes for her letter, but decides Jerry must really get her message and so 

she tapes it to his door. 

 Did Janice do anything that possibly threatens Jerry's confidentiality? 

Yes. Janice revealed private information about Jerry to his neighbor without his 

permission.

 What measures should Janice have taken to protect Jerry’s confidentiality? 

Janet should not have revealed to Jerry’s neighbor that she was from the TB clinic in 

the health department. Janice could have gathered information on Jerry’s 

whereabouts without revealing sensitive information to his neighbor. Finally, Janice 

should not have left the letter on Jerry’s door.