DPH 850 Module 8 Health Data Policy and Governance Example

Rules for the Data We Hold: Health Data Policy and Governance in a State Health Department

Student Name

Doctor of Public Health Program, Aspen University

DPH 850: Health Informatics for Public Health Leaders

Instructor Name

Month Day, Year

Rules for the Data We Hold: Health Data Policy and Governance in a State Health Department

Public health agencies hold some of the most sensitive data in government: diagnoses, test results, vaccinations, births and deaths. Using those data well protects the public; misusing or losing them erodes trust. This paper designs data policy and governance for a composite state health department completing a major modernization of its information systems.

Legal Basis

Under state law, clinicians and laboratories must report listed conditions and authorize the health department to collect and use the data. The federal HIPAA Privacy Rule permits covered entities to disclose protected health information to public health authorities without patient authorization for purposes such as disease surveillance. State laws often add confidentiality protections for public health records.

Privacy in the Era of Big Data

Data that once stayed in separate systems are now linked, shared and analyzed at scale. Price and Cohen (2019) note that privacy protections built for individual records struggle with big data, where combining datasets can reveal sensitive information and where data flow to entities outside traditional health care. Gostin et al. (2018) argue for privacy protections that keep pace with digital health data while preserving public health uses.

Governance Components

The table outlines the components of the department's data governance.

The Data Governance Council

A data governance council chaired by a chief data officer will include program directors, the state epidemiologist, legal counsel, the information security officer and a community member. It will approve data policies, review requests for sensitive data uses, resolve conflicts between programs and oversee compliance.

Data Use Agreements

Sharing data with local health departments, researchers, hospitals and other agencies will require written agreements specifying purpose, data elements, security, retention, publication rules and consequences of misuse. Agreements for identifiable data will require council approval. A standard template will shorten negotiation for routine requests.

Sharing With Partners

Local health departments need timely access to cases in their jurisdictions. Researchers need de-identified or limited data to answer public health questions. The governance framework will offer tiers of access, from public dashboards to restricted identifiable data, each with matching controls. Researchers requesting identifiable data must show institutional review board approval.

Reidentification Risk

De-identified data can sometimes be reidentified when combined with other information, especially for rare conditions or small areas. Release standards will set minimum cell sizes, limit combinations of geographic and demographic detail and require review of datasets before release.

Security

Security measures include encryption, multifactor authentication, role-based access, audit logs and regular testing. The department will require vendors to meet state security standards and report breaches promptly. Staff will receive annual privacy and security training. An annual external audit will test whether controls work in practice.

Findable and Reusable Data

Good governance also makes data usable. Applying the FAIR principles, the department will document datasets with metadata, use standard vocabularies and publish clear terms for access (Wilkinson et al., 2016). Well-documented data reduce errors and duplicate collection.

Transparency and Trust

Public trust depends on knowing what data are held and how they are used. The department will publish an annual transparency report listing datasets, major uses, data sharing agreements and any breaches. Community members on the council add public perspective to decisions.

Equity in Governance

Governance decisions affect communities differently. Release rules that suppress small numbers may hide disparities; sharing data with law enforcement could deter immigrants from seeking care. The council will consider equity in each policy and consult affected communities, including tribal governments with authority over their citizens' data.

What Leaders Must Do

Leaders must appoint a chief data officer with authority, fund stewards and security, insist that new systems support governance requirements, model respect for privacy and be transparent when problems occur. Governance is a leadership responsibility, not only a technical one.

Emergency Data Sharing

Emergencies test governance. During the pandemic, pressure to share data quickly sometimes outran agreements. The governance framework includes pre-approved emergency data sharing templates with defined time limits, so that data can flow quickly in a crisis without abandoning safeguards.

Data Retention and Disposal

Holding data longer than needed increases risk. Retention schedules will specify how long each type of record is kept and how it is securely destroyed. Identifiable data used for a specific investigation will be archived or de-identified once the investigation closes, while aggregate data are retained for trend analysis.

Artificial Intelligence and Analytics

Use of machine learning and advanced analytics on public health data is growing. Governance will require that any predictive tool be reviewed for accuracy, bias and appropriate use before deployment, with documentation of the data used to train it and a plan for monitoring its performance over time.

Training and Culture

Policies work only if staff understand and follow them. Beyond annual training, the department will build a culture in which staff raise privacy concerns without fear, report near misses and see data stewardship as part of their professional role.

Balancing Access and Protection

Governance must balance two risks: releasing too much and exposing individuals, and releasing too little and failing communities that need data to act. Clear release standards, tiers of access and a council that weighs both risks help the department avoid swinging between extremes after each controversy.

Evaluating Governance

The council will review its own performance each year, tracking the time taken to approve data requests, the number of agreements in force, security incidents and feedback from data users and community members. Governance that is slow or opaque can push users to informal workarounds, which create greater risks than the ones governance was meant to prevent.

Coordination With Other Agencies

Public health data increasingly connect with Medicaid, corrections, education and housing data to address social conditions. Each connection needs its own agreement, clear purpose and protections. The council will review cross-agency linkages with particular care, since data shared for one purpose can be misused for another, such as immigration or law enforcement.

Conclusion

Health data policy and governance give a public health agency the rules it needs to use sensitive data for public benefit while protecting privacy and earning trust. Grounded in law and responsive to the risks of linked, large-scale data, a governance council, data stewards, agreements, security, release standards and transparency together allow the modernized systems to serve the public safely.

References

Gostin, L. O., Halabi, S. F., & Wilson, K. (2018). Health data and privacy in the digital era. JAMA, 320(3), 233-234. https://doi.org/10.1001/jama.2018.8374

Price, W. N., & Cohen, I. G. (2019). Privacy in the age of medical big data. Nature Medicine, 25(1), 37-43. https://doi.org/10.1038/s41591-018-0272-7

Wilkinson, M. D., Dumontier, M., Aalbersberg, I. J., Appleton, G., Axton, M., Baak, A., Blomberg, N., Boiten, J.-W., da Silva Santos, L. B., Bourne, P. E., Bouwman, J., Brookes, A. J., Clark, T., Crosas, M., Dillo, I., Dumon, O., Edmunds, S., Evelo, C. T., Finkers, R., ... Mons, B. (2016). The FAIR Guiding Principles for scientific data management and stewardship. Scientific Data, 3, Article 160018. https://doi.org/10.1038/sdata.2016.18