A Public Records Request for a Small-County Dataset

Rank by likelihood × harm:

1. Re-identification in a county of 4,200. 'De-identified' is not a property of a file; it is a property of a file in a context. Six respondents in one ZIP, plus immigration status and mental health items, plus a small community where people know each other's households - that is a re-identification risk, and it is the highest-severity exposure because the harm (immigration enforcement, stigma, employment) is severe and irreversible.
2. Secondary use beyond consent. Consent said 'plan local health services.' Public release to a reporter and deposition in a repository are both outside that scope. This is a broken promise even where it is legal.
3. The records request itself. Whether the data is a public record depends on state law and on whether the health department holds it; many states have exemptions for health information and for small-cell data, but the exemption may need to be asserted, and asserting it is a decision with a deadline, not a default.
4. The repository condition. A blanket deposit requirement conflicts with the consent scope and with the small-county context. Funders routinely grant exceptions; asking is cheaper than complying.

Reasoning: the ordering matters because teams tend to litigate the records request first - it is the loudest - while the actual harm sits in the six-person ZIP cell and the consent mismatch.

Days 1–2 - establish the facts and the clock.

• Get the exact request language and the statutory response deadline. Notify the university's counsel, privacy officer, and IRB in writing the same day; this is not a decision a program manager makes alone.
• Determine who holds the record. If the health department holds it, their counsel leads; if the university holds it, the university does. Ambiguity here is how organizations accidentally disclose.

Days 2–3 - assess and assert.

• Ask counsel whether a statutory exemption for health information or small-cell suppression applies, and file the exemption/objection in writing before the deadline. Silence is waiver in many jurisdictions.
• In parallel, prepare a release alternative: aggregated tables with cells suppressed below a minimum (commonly 10, and higher here given the population), no ZIP-level breakdown, and immigration status collapsed or withheld. Offer this proactively - reporters usually want a story, and usable aggregate data serves that.

Days 3–5 - go upstream and repair.

• Amend the data use agreement going forward: explicit prohibition on re-disclosure, a defined suppression threshold, security requirements, and a named data custodian.
• Fix the consent language for any future instrument: separate opt-in for data sharing beyond service planning, in plain language, with the option to decline without losing services.
• Tell the community before they read it in the paper. Brief the coalition's community advisory group and let them review what will be released.

Reasoning: the sequence - facts, legal assertion, constructive alternative, structural repair - protects participants while keeping the health department out of a fight it does not need.

Respond with the specific arithmetic, then with an alternative that gets them most of what they want.

• Show the cell size in context. Six respondents in a ZIP of roughly 700 people, in a county where the school secretary knows which families use the clinic. Anyone with local knowledge can narrow six people to a handful of households. That is not a hypothetical; it is how small-area data harms people.
• Note the statistical problem too. A six-person prevalence estimate has a confidence interval so wide it cannot support any conclusion. The map would be both harmful and uninformative - a rare case where ethics and statistics agree.
• Offer the publishable version: aggregate to the county level for depression prevalence; map community assets and access (distance to nearest behavioral health provider, clinic locations, broadband coverage) at ZIP level instead of prevalence; if intra-county variation must be shown, collapse to two or three planning regions with adequate n and report ranges rather than point estimates.
• If the partner still refuses: escalate to the community advisory group and the IRB rather than deciding unilaterally, and document the disagreement. Publication is not the partner's call to make alone when the data were given under a promise to participants.

On the repository: request a written exception from the funder that permits deposit of the codebook, instrument, and aggregate tables only - not respondent-level records. Most funders accept this framing because it serves reproducibility without transferring risk to a 4,200-person county.

Reasoning: the ethical failure to avoid is treating 'de-identified' as a permission slip. In small populations, the duty is to minimize what is released, not to maximize what is technically permissible.