The Dashboard That Would Name 34 People
A rural county of 9,800 residents runs a substance use treatment navigation program serving 34 clients. The state health agency requests a client-level data file - name, date of birth, ZIP code, race, service dates, and primary substance - for a “statewide equity dashboard” that will be posted publicly and updated quarterly. The program's data-sharing agreement is silent on public release. The consent form authorizes use of information “for program evaluation and reporting to funders.” The county has one high school, and any table cell with fewer than three people could plausibly identify a neighbor. The state's deadline is Friday; your supervisor says to “send what they asked for and sort out the paperwork later.”
1. What is your response to the supervisor, and what must happen before any file leaves the program?
Read the worked answer
Decline, in writing, and propose a lawful partial deliverable by Friday.
Three independent problems, any one of which blocks the request:
- Scope of consent. “Evaluation and reporting to funders” does not authorize a public, quarterly, publicly posted dashboard. Public release is a new purpose requiring either new consent or de-identification.
- Re-identification risk. In a county of 9,800 with one high school, date of birth + ZIP + primary substance is functionally an identifier even without a name. Cell sizes of 1–2 are disclosure risks, not statistics.
- Substance use confidentiality. If the program is federally assisted, 42 CFR Part 2 governs these records: disclosure requires written consent naming the specific recipient and purpose, and re-disclosure is restricted. A public dashboard is generally incompatible. If HIPAA also applies, DOB, ZIP, and service dates are all identifiers under the safe-harbor standard.
“Sort out the paperwork later” is not available - the disclosure cannot be undone, and the harm falls on 34 identifiable people in a small town.
Do instead: notify the privacy officer/compliance and legal immediately; tell the state you can meet Friday with an aggregate, suppressed dataset; document the request, your analysis, and your response. Escalation is a professional obligation, not insubordination.
2. Redesign the data sharing so the state's legitimate need is met. What does the state actually receive?
Read the worked answer
Tiered design, matched to purpose. The state's stated purpose - equity monitoring - requires counts and rates, not identities.
- Tier 1 (public): county-level aggregate counts and percentages only. No name, no DOB, no ZIP (county is the unit), dates collapsed to quarter/year, substance categories collapsed (e.g., “alcohol,” “ opioids,” “other”). Suppress any cell below 11, and apply complementary suppression so a suppressed cell cannot be back-calculated from totals.
- Tier 2 (restricted-use file): a de-identified record-level file with a study ID, provided under an amended data-sharing agreement specifying permitted uses, no re-identification, security controls, breach notification, and a publication-review clause.
- Tier 3 (identifiable): only if a specific analytic question genuinely cannot be answered otherwise - and then only with 42 CFR Part 2-compliant written consent from each client naming the state agency, the purpose, the fields, and revocation rights.
Also amend the DSA language on public release, since the current silence is exactly what created the conflict. Build suppression rules into the dashboard spec so this does not recur each quarter.
3. A client asks what is being shared and wants to be excluded. A colleague objects that opt-outs will bias the data. How do you handle both?
Read the worked answer
Show the client the fields, explain the purpose, and honor the exclusion.
Why the colleague's argument loses:
- Participation is voluntary and, under 42 CFR Part 2, revocation of consent is an explicit right. Bias is a limitation to be documented, never a justification for overriding a person's decision about their own treatment record.
- The instrumental point: in a 34-person program in a town of 9,800, trust is the entire data infrastructure. One disclosed record and the program loses its next 34 clients, along with any future data.
- The statistical point: a program of this size cannot produce precise estimates with or without opt-outs, so the bias objection is buying precision the dataset never had.
Practice: log each exclusion and its stated reason, report the final N and the number excluded, and note in any limitation section that exclusions may be non-random. If exclusions cluster (e.g., clients in mandated treatment), flag that specifically.
Address the colleague directly and privately first; if pressure continues, restate the obligation in writing with the compliance officer copied. Protecting participants from a colleague's convenience is part of the role.