9.2 Confidentiality, Privacy, and Data Protection

Protecting people while using information well

Health education work uses survey responses, attendance logs, screening referrals, interview notes, coalition minutes, evaluation datasets and sometimes school or clinical records. Article I.4 of the 2020 Code requires respect for privacy, confidentiality and dignity; Article II section 4 applies those values to delivery of health education. Identify the program's actual authority to collect and use information before releasing it.

A sign-in sheet with names and phone numbers left in a public hallway creates an exposure risk. Retrieve it and use the organization's incident process. Whether the event triggers an external legal breach notice depends on the information, setting, law and assessment by authorized staff; it is not automatic from the word “hallway.”

Design data use before collection

Before a CHES gathers information, clarify what is needed, why, who is authorized to see it, where it will be stored, how long it must be retained and how results will be reported. Collecting extra identifiers “just in case” increases risk without a defined benefit. Explain purpose, voluntary participation where applicable, uses and confidentiality limits in language people can understand.

Ethical data minimization is a general practice: limit collection, access and sharing to what the authorized work reasonably needs. The HIPAA minimum necessary standard is a specific legal requirement for covered entities and their business associates when it applies to protected health information; it is not a universal rule for every community program or every disclosure. HHS lists exceptions to that standard, including provider treatment disclosures or requests, disclosures to the person, uses or disclosures under a valid authorization and disclosures required by law. The exception removes that particular minimum-necessary test, not the need for a lawful disclosure and other safeguards.

• A reminder caller may need contact details, not each participant's survey responses.
• A newsletter partner may need approved aggregate outcomes, not the raw response file.
• A program evaluator may need individual data, but only through authorized role-based access and an approved storage and use arrangement.

Reporting without exposing identities

Aggregate reports usually reduce exposure, yet small cells or detailed quotations may permit re-identification when combined with place, age, dates or other released information. A one-person subgroup in a small rural school is especially sensitive. Combine or suppress cells under the organization's disclosure standards, inspect complementary cells and linked releases, and remove or paraphrase identifying context where appropriate. Suppression reduces risk; it cannot promise anonymity by itself.

Exposure response

1. Secure the record and stop further unauthorized access where feasible.
2. Notify the supervisor or privacy/security office promptly under policy.
3. Preserve and document the facts without broadcasting the data.
4. Let authorized staff evaluate applicable law, risk and any required notice to people or regulators.

NCHEC also treats candidate score information as confidential under its candidate policies. An employer's interest in an official score is not, by itself, permission for casual release. Across settings, convenience never supplies disclosure authority.

Apply the rule for the actual setting

A sound privacy answer starts with who holds the record, what law or agreement governs it, and what purpose is authorized. A community health program does not become a HIPAA covered entity merely because it discusses health; a clinical partner's records may be governed by HIPAA and a business-associate arrangement. Sharing must have a permitted basis before deciding how much to share.

• Schools and FERPA: education-record rights generally belong to parents until they transfer to the student at age 18 or when the student attends a postsecondary institution at any age. Consent from the rights holder is generally required unless a FERPA exception applies. A school official with a legitimate educational interest is one exception, not the only permitted disclosure. Follow institution policy and the scope of the record.
• Clinical records and HIPAA: covered entities and business associates follow applicable Privacy and Security Rules. A grant partnership alone does not allow a patient diagnosis roster to be handed to an educator. Check the permitted use or authorization and agreements; then apply the relevant access and disclosure limits, including any minimum-necessary exception.
• Research and evaluation: the authorized IRB, research office and privacy office determine whether an activity is human-subject research, exempt, subject to review, or a program evaluation with other controls, and what consent or privacy authorization is required. The educator should follow approved protocols and cannot decide alone that an existing dataset is free for a new study or marketing use.

Secure handling means using organizationally authorized systems and devices, role-based permissions, strong authentication and secure transmission or encryption as policy and risk require. A password is not equivalent to encryption. An unapproved personal account or unprotected transfer on a public network is a clear risk; approved, protected mobile use is judged by safeguards and policy, not by the device's label alone.

Secondary use requires a fresh authority check, not an automatic answer. Existing consent or authorization may already cover a use; a lawful waiver, exemption, properly de-identified data or another permitted basis may also apply. If a partner asks to reuse a roster for outreach, return to the documented permission and consult the responsible office before releasing anything.