The Sheriff, the Census Block, and the Overdose Data
A 23-bed critical access hospital sits in a county of 61,000 people. Over 18 months its emergency department logged 4,812 overdose-related visits. The county sheriff's office has now asked the hospital's analytics team for visit-level records - date, approximate time, drug involved, and census block of patient residence - to build a heat map that will direct patrol routes and "saturation" checkpoints. The hospital's privacy officer notes that stripping names and dates of birth would likely satisfy HIPAA Safe Harbor, and the sheriff's attorney cites public-health and law-enforcement exceptions.
The hospital's six-member Data Ethics Committee must respond within two weeks. Its charter commits it to proportionality, purpose limitation, and "not making identifiable communities bear the cost of individual disclosures." Several census blocks in the county contain fewer than 15 households. Overdose deaths are concentrated in two census tracts, both also the county's poorest. The hospital's community health needs assessment lists "trust in institutions" as a top-three priority. The sheriff has offered no data-retention plan and no written agreement.
1. The privacy officer argues the request is "de-identified and therefore outside ethics review." Assess that argument.
Read the worked answer
The argument fails on two independent grounds.
Technical. HIPAA Safe Harbor is a shield against a specific legal penalty, not a finding that nobody can be identified. Identifiability is a property of the population, not the field list. A census block with fewer than 15 households, combined with a date and a drug type, can frequently resolve to one person: the patient's neighbor, the EMT, and the pharmacist all know who overdosed last Tuesday. Under the expert-determination route the hospital would have had to quantify that risk. The privacy officer has not attempted it, and the field list he proposes is exactly the combination that makes the quantification fail.
Ethical. Even a genuinely non-identifiable dataset can harm the population it came from. Here the two affected tracts are the county's poorest, and the stated use is patrol routing and checkpoints. People who use drugs and people who witness overdoses both respond to perceived police presence by avoiding the emergency department - which converts a data disclosure into a foreseeable clinical harm, in the population least able to absorb it. The charter language about communities bearing the cost of individual disclosures speaks directly to this.
So the correct question is not "is this PHI?" but "what does this disclosure do to the people in the data, and is that proportionate to a benefit we can actually name?" No benefit has been named.
2. Recommend a decision, and any conditions under which some sharing could proceed.
Read the worked answer
Decision: decline block-level, visit-level sharing; offer a bounded alternative.
Conditions for a counter-offer:
- Granularity - census tract or ZIP, never block; no time-of-day; monthly counts rather than visit-level rows; suppress any cell below 11 and apply secondary suppression so small cells cannot be recovered by subtraction across months.
- Purpose limitation - a written agreement that the data may not inform checkpoints, stops, or individual investigations; public-health outreach and naloxone distribution only. Any new purpose requires a new request and a new review.
- Retention - 90-day retention, certified deletion, annual audit right.
- Transparency - community notice through the county health department and the hospital's community advisory group before the first transfer; publish the agreement.
- Sunset - 12-month term, with an evaluation of whether overdose-related ED visits changed, in either direction, before renewal.
- Escalation - any request that names an individual or a block goes back to the committee, not to the analytics team.
Reasoning. Each condition maps to a specific failure mode rather than to caution in general. Granularity and suppression address re-identification. Purpose limitation addresses mission creep - the documented pattern in these arrangements is that a public-health dataset becomes an enforcement dataset in year two. Transparency addresses the trust metric the hospital already tracks. The sunset clause is an honest concession that we do not know whether saturation patrols reduce overdose deaths, and the answer should be measured rather than assumed.
3. The county executive threatens to withhold a $400,000 indigent-care contract unless the hospital complies. How should the committee and the CEO handle this?
Read the worked answer
Separate the decision from the pressure, and make the pressure visible.
Concretely:
- The committee issues its recommendation in writing before the CEO meets the county executive, so the record shows the advice was not reverse-engineered from the contract.
- The CEO, not the committee, owns the business decision. If the CEO decides to disclose anyway, the committee's dissent is minuted verbatim and the board is informed. The hospital does not get to convene an ethics review and then discard it silently.
- Any override should be a written directive with a named accountable executive, not a verbal instruction in a hallway.
Why this matters more than the $400k. A committee whose advice is purchasable is not a control; it is a decoration, and its future opinions will be priced accordingly by everyone who learns that this one was traded away. The board needs to see the trade explicitly: what the hospital gains ($400k of indigent care) against what it risks (a drop in ED care-seeking among the county's most vulnerable residents, and erosion of the trust its own needs assessment identifies as a strategic priority). Both are real costs. The governance failure would be letting one be counted and the other not.
A defensible middle path exists: hold the tract-level line, offer to co-fund a public-health dashboard, and let the county decide. That preserves the relationship without moving the boundary.