3.7 Notifiable Disease Reporting, Data Sources, & Registries
Key Takeaways
- Disease reporting is a state and local legal authority; the national notifiable disease list is a voluntary standard developed by CSTE and CDC, so the operative list is always the one published by the facility's own jurisdiction.
- HIPAA expressly permits disclosure of protected health information to public health authorities legally authorized to receive it, without patient authorization, under 45 CFR 164.512(b).
- Electronic laboratory reporting transmits reportable results directly from the laboratory information system to public health, but it does not relieve clinicians and facilities of their own reporting duties.
- Syndromic surveillance uses near-real-time emergency department chief complaint and triage data to detect events days before laboratory confirmation.
- A line list is the core investigation artifact and should carry one row per case with identifiers, onset date, location, unit, organism, and exposures.
3.7 Notifiable Disease Reporting, Data Sources, & Registries
Quick Answer: Reporting requirements are set by state and local law, not by CDC. The National Notifiable Diseases Surveillance System (NNDSS) is a voluntary national standard built from CSTE position statements. HIPAA permits reporting to public health without patient authorization (45 CFR 164.512(b)). Timeframes range from immediately by phone to within one week, by disease and jurisdiction.
Who Sets the Rules
A persistent misconception is that CDC requires disease reporting. It does not, and cannot — communicable disease reporting is an exercise of state police power.
| Body | Role |
|---|---|
| State/territorial health department | Legally mandates which conditions are reportable, by whom, how fast, and to whom |
| Local health department | Often the actual point of receipt; issues jurisdiction-specific requirements |
| CSTE (Council of State and Territorial Epidemiologists) | Writes position statements defining which conditions are nationally notifiable and their case definitions |
| CDC / NNDSS | Aggregates voluntarily submitted, de-identified state data into national surveillance |
Practical consequence: the reportable list at a hospital in one state differs from that of a hospital 20 miles away across a state line. The IP must work from the current list published by their own jurisdiction, posted where staff can reach it, and reviewed at least annually.
Reporting Timeframes
Jurisdictions tier conditions by urgency:
| Tier | Typical timeframe | Representative conditions |
|---|---|---|
| Immediate — by telephone | Immediately, 24/7 | Anthrax, botulism, plague, smallpox, viral hemorrhagic fevers, measles, novel influenza A, any suspected bioterrorism event, any unusual cluster |
| Urgent | Within 24 hours | Meningococcal disease, pertussis, rabies exposure, E. coli O157:H7, hepatitis A, foodborne outbreak |
| Routine | Within 1–3 business days to 1 week | Hepatitis B and C, tuberculosis, salmonellosis, Lyme disease, most STIs |
Two triggers deserve emphasis because they are not disease-specific: any suspected outbreak or unusual cluster, and any suspected intentional release, are immediately reportable everywhere.
HIPAA Is Not a Barrier
Staff frequently hesitate to release patient information to a health department. The HIPAA Privacy Rule at 45 CFR 164.512(b) expressly permits covered entities to disclose protected health information, without patient authorization, to:
- Public health authorities legally authorized to collect it for preventing or controlling disease, injury, or disability
- Persons at risk of contracting or spreading a disease, where authorized by law
- Employers, in defined OSHA/workplace-surveillance circumstances
Mandatory reporting is a legal duty, and failing to report is the violation — not reporting.
Routine Data Sources
| Source | What the IP gets |
|---|---|
| Microbiology / LIS | Positive cultures, organism identification, susceptibilities, the raw material of the antibiogram |
| Electronic health record | Signs and symptoms, notes, vital signs, imaging, device documentation needed to apply NHSN criteria |
| ADT feed (admission/discharge/transfer) | Patient-day and location denominators, movement history for exposure tracing |
| Pharmacy | Antimicrobial use for stewardship and for NHSN AUR reporting |
| Radiology | Imaging findings needed for pneumonia and VAE definitions |
| Occupational health | Exposures, immunization status, work restrictions |
| Sterile processing / EVS | Reprocessing logs, cleaning audit results |
| Immunization information system (IIS) | State registry confirming patient and staff vaccination |
| Vital records | Death certificate data for outcome linkage |
| Trauma, cancer, transplant registries | Denominators and risk factors for special populations |
| NHSN | National benchmarking, SIRs, and the reporting pathway for CMS requirements |
Electronic laboratory reporting (ELR)
ELR transmits reportable laboratory results automatically from the laboratory system to public health. It is faster and more complete than manual reporting, but it carries two caveats worth knowing:
- It reports laboratory results only — it does not transmit the clinical and epidemiologic context (symptoms, travel, exposure) that a case report requires.
- It does not discharge the clinician's or facility's separate reporting obligation, particularly for clinically diagnosed conditions with no confirmatory laboratory test.
Syndromic surveillance
Syndromic surveillance analyzes pre-diagnostic data — emergency department chief complaints, triage notes, over-the-counter medication sales, school and staff absenteeism — in near real time. CDC's National Syndromic Surveillance Program (NSSP) BioSense Platform aggregates participating facility data. Its value is timeliness: a rise in "vomiting and diarrhea" chief complaints appears days before stool cultures confirm norovirus. Its weakness is specificity: it detects patterns, not diagnoses, so every signal requires verification.
The Line List
The line list is the single most important document an IP builds during an investigation: one row per case, columns for the variables you will analyze.
| Element | Why it is there |
|---|---|
| Identifier / medical record number | Links to the chart |
| Age, sex | Person characteristics |
| Unit, room, bed | Place — reveals geographic clustering |
| Admission date, onset date, culture date | Time — builds the epidemic curve |
| Organism, specimen type, susceptibility pattern | Confirms it is one organism, not several |
| Symptoms, outcome | Distinguishes infection from colonization |
| Devices, procedures, operating room, surgeon | Candidate exposures |
| Shared staff, equipment, medication lots | Candidate vehicles |
| Precautions in place, dates | Control measure evaluation |
Build it in a spreadsheet from the first suspected case, not after the outbreak is declared — retrospectively reconstructing exposure detail is far harder than capturing it as you go.
Communicating Across Transitions
Reporting is not only upward to public health. The blueprint also requires following established processes to communicate notifiable conditions to receiving facilities and across transitions of care. When a colonized or infected patient transfers, the sending facility should transmit organism, precaution status, pending results, and current therapy. Many states now require a standardized inter-facility transfer form for exactly this purpose.
A hospital's legal counsel advises that HIPAA prohibits releasing a patient's name to the county health department for a reportable disease investigation. How should the infection preventionist respond?
Which body has the legal authority to determine which diseases must be reported by a hospital, and within what timeframe?
An emergency department notices a sharp rise in chief complaints of vomiting and diarrhea over 48 hours, before any stool cultures have resulted. What type of surveillance detected this, and what is its principal limitation?
A facility has implemented electronic laboratory reporting to the state health department. What obligation remains?