Public Health Request for Line-Level Blood Culture Data
A state health department requests monthly line-level data on all positive blood cultures from a 12-hospital system to build an antimicrobial resistance surveillance dashboard. The requested fields include patient name, date of birth, ZIP code, organism, susceptibility, and admission date. The privacy officer notes that state law requires reporting of selected organisms but does not authorize a broad extract. A physician champion wants to add HIV and hepatitis status for risk adjustment. The informatics team plans to pull data from the laboratory information system into a cloud analytics platform and share a Tableau dashboard. One analyst suggests emailing a CSV to the health department because the VPN is slow. The project has not been reviewed by the IRB.
1. Identify the legal, ethical, and minimum-necessary issues raised by this request.
Read the worked answer
Legal and ethical issues
- HIPAA's public health exception permits disclosures to a public health authority authorized by law, but only for the purposes and scope the law specifies. A broad line-level extract for a dashboard is not automatically covered.
- State law is the limiting authority. The privacy officer's assessment that reporting is limited to selected organisms matters.
- Identifiers requested (name, date of birth, ZIP code) exceed what resistance surveillance generally needs.
- Adding HIV and hepatitis status is a secondary use with higher sensitivity and is not justified by risk adjustment for resistance surveillance.
- IRB review is likely required if the project is research or produces generalizable knowledge; public health practice and research can overlap.
Minimum-necessary analysis
- Needed: collection date, organism, susceptibility, specimen source, age group, sex, and perhaps ZIP3 or county.
- Not needed: name, full date of birth, full ZIP, admission date unless required for deduplication.
- Prefer a limited data set with a data use agreement, or de-identified aggregate data with small-cell suppression.
Recommendation. Do not send the requested extract. Convene privacy, legal, IRB, and the health department to define the lawful scope, execute a data use agreement, and document the minimum-necessary determination.
2. Recommend a data-sharing architecture and the controls needed to protect the data.
Read the worked answer
Recommended architecture
- Extract from the LIS into a secure, access-controlled analytics enclave covered by a business associate agreement.
- Encrypt in transit and at rest; require multifactor authentication and role-based access.
- Use a limited data set with a data use agreement; remove direct identifiers; consider a hashed study ID and ZIP3.
- Apply row-level security and audit logging; retain data only as long as the agreement specifies.
- Share aggregate dashboards with small-cell suppression rather than line-level data where possible.
- Use secure file transfer (SFTP) or an API; never email a CSV.
Controls and governance
- Privacy officer and legal sign-off on the data elements and legal authority.
- Data quality checks for organism coding, deduplication, and LOINC and susceptibility mapping.
- Document provenance and transformation steps.
- Breach response plan and vendor security review.
- If line-level data are essential, provide a de-identified or limited data set and require the health department to agree not to re-identify.
Why not the cloud dashboard as proposed. A cloud platform can be appropriate, but only with a business associate agreement, encryption, access controls, and a defined retention period. The current plan lacks these safeguards.
3. How would you handle the request for HIV and hepatitis status and the analyst's proposal to email a CSV?
Read the worked answer
HIV and hepatitis status. Reject the request as framed. These fields are not necessary for antimicrobial resistance surveillance, are highly sensitive, and would expand the disclosure beyond the legal authority. If a legitimate public health need exists, require a separate protocol, IRB review, explicit legal authority or consent, and stronger de-identification. Offer aggregate or risk-stratified analyses only if they cannot re-identify individuals.
Emailing a CSV. Refuse. Email is not an appropriate channel for protected health information and creates a reportable breach risk. Offer SFTP, an encrypted portal, or a secure API. If the analyst persists, escalate to the privacy officer and document the instruction.
Alternative. Provide the health department with a limited data set under a data use agreement, using a secure transfer method, and restrict the dashboard to aggregate views. This meets the surveillance goal while respecting minimum necessary and state law.