Is sharing de-identified data legal? The state of public health confidentiality laws and their interplay with statistical disclosure limitation techniques.

Abstract

The diversity of state confidentiality laws governing public health data presents a significant challenge for public health initiatives. This challenge is further complicated by the array of confidentially laws that are relevant within a state as disclosure and usage standards vary depending upon data holder, type, and source. These laws often have not been updated to address modern confidentiality risks such as unlawful data linkage or breach, leaving many public health organizations without clear guidance in the contentious area of individual privacy. To address these challenges, public health organizations have increasingly turned to the science of de-identification, but whether de-identification adequately meets the many and varied state confidentiality legal requirements remains an unanswered question.