Public Goods, Private Data: HIV and the History, Ethics, and Uses of Identifiable Public Health Information

Public health departments collect a vast array of identifiable information in the course of mandatory reporting efforts and other surveillance activities. These undertakings span a range of conditions from infectious threats and chronic diseases including cancer, to immunization status and birth defects. Advocates for expanded surveillance extended the practice to occupational diseases and, most ambitiously, to profiles of childhood health status. Syndromic surveillance is also increasingly undertaken in the new post-September 11 security environment. In the one Supreme Court case addressing public health surveillance, a unanimous tribunal upheld the right of the state to conduct surveillance.¹ The Health Information Portability and Accountability Act (HIPAA) regulations, as well, explicitly permit reporting of identifiable data for public health surveillance.²

Privacy advocates and policy makers have focused primarily on the privacy and security of surveillance data. Law and regulation require public health departments to provide strict measures of protection to guarantee the security of identifiable information. There has been little debate about the centrality of law to the preservation of the legitimacy of surveillance activities. But given the absence of federal rules for the privacy and security of public health data, there has been interest in the limits that might be imposed on health departments in the collection, use, and disclosure of identifiable information. This issue emerged in acute form in the 1990s, as the Centers for Disease Control and Prevention (CDC) moved to implement HIV case reporting. Opponents of such efforts feared the consequences of government collection of personal information, including discrimination and loss of privacy.³

Despite the formulation of the Model Public Health Privacy Act,⁴ key ethical questions regarding the uses of public health data remained unanswered. For example, may identifiable public health data be used for direct patient intervention? May identifiable public health data be used for traditional public health practices such as contact tracing and partner referral, isolation, and quarantine? May they be relied upon as the foundation for public health research? May these data be shared within and among health departments and agencies? Finally, may they be shared with authorities or agencies outside of public health, for example, for the purposes of immigration, welfare benefits, or criminal law enforcement?

There have been a number of recent efforts to develop an ethical framework for public health that helps inform and guide the analysis of the issues presented in this article.^5–7 Typically those efforts recognize the highly divergent ethical traditions of medicine and public health. In clinical practice and research, concern for autonomy has been preeminent.^8,9 Animating the practice of public health, however, has been a historical concern for the well-being of populations. The ethical framework for public health that is emerging reflects that orientation, providing a foundation for the affirmative duty to monitor health threats, intervene to promote the public good, engage in research activities, and promptly disseminate findings from such efforts to public health officials and other stakeholders.^10,11 At the same time, there is consensus that the pursuit of optimizing the public's health must be subject to some limits involving individual rights.^5,7,12

Against the backdrop of the public health ethos that has emerged over the course of more than a century of practice, we analyze how officials confronted with the tensions between public health and personal privacy might evaluate the ethics of public health data uses with an emphasis on HIV.

THE HISTORICAL LEGACY OF PUBLIC HEALTH DATA USES

Just as bioethics required a full appreciation of the practice of medicine and its moral justifications, so too is it necessary to make explicit the values that have motivated public health practice for more than a century and how they were challenged as the protection of individual rights became a central feature of public discourse surrounding medicine.

The tradition of direct intervention

The understanding of disease as contagious and, hence, controllable, that emerged at the end of the 19th century demanded that health officials have access to the names of the infected, through case reporting. Herman Biggs, a titanic figure in the history of public health, explained: “The notification and registration of communicable diseases always has as its object the supervision of the cases….” It was not undertaken “in order to keep clerks or adding machines busy.”¹³ In the last decade of the 19th century, when Biggs initiated the practice of notification for tuberculosis—then a highly stigmatized, chronic infectious disease—it was clear that reporting was intended as a means of allowing direct health department intervention with cases. Every effort was made to assuage the fears of physicians regarding encroachments upon their professional authority:¹⁴ no action would be taken “if the physician requests that no visits be made by Inspectors.”¹⁵

The notification and sanitary supervision system that emerged reflected an implicit set of suppositions about which classes posed a threat: middle class and wealthy patients were protected from health department supervision by their physicians. The inspection plan amounted to a system of active surveillance for tuberculosis at the city's various clinics, which served the poor and working classes.¹⁶ But surveillance did not result only in restrictive measures. It also could serve as a means of ensuring access to needed services. Such service provision characterized the tradition of data use not only in TB but also in birth defects surveillance and, much later in the century, immunization registries.³

The tradition of disclosure

As this tradition of direct intervention developed, health officials typically stressed the confidentiality of disease registries.¹⁶ But there were limits to confidentiality. The clinical context shaped the public health response to privacy. The American Medical Association (AMA) code of ethics had long acknowledged that “peculiar circumstances” always tempered protection of “secrecy and delicacy.”¹⁷ In response to surveillance, the AMA ethical code broadened to acknowledge a duty to the community in general.¹⁷

Just as doctors might disclose information to protect family and community, so, too, might health departments.¹³ When deemed appropriate, health officials released the names and addresses of those with contagious diseases in order to fulfill a duty to warn the public.³ In the instances of acute infectious diseases like diphtheria and smallpox, officials placarded the homes of the infected. During polio outbreaks, for example, health officials published daily lists in the local newspapers of the names and addresses of individuals afflicted with acute infections.¹⁸

The tradition of research

It was where the origins and means of spread of a disease remained unknown that a tradition of disease notification for research or statistical purposes developed. Perhaps the signature disease whose etiology was poorly understood was cancer.¹⁹ Cancer registries, which developed in the 1940s, represent the most sustained relationship between public health surveillance and research.

In the 1950s, Alexander Langmuir—a seminal figure in the conceptualization of the role of surveillance—sought to distinguish between individual-level surveillance and that which sought to use an array of data, sometimes but not always including names, to monitor the incidence and prevalence of diseases.²⁰ The immediate purpose was not always to intervene directly with individuals but was, rather, to understand the underlying dynamics of morbidity and mortality so that ultimately individual or even population-level efforts could improve the public's health.

In some instances, two traditions—surveillance for the sake of intervention and surveillance for the sake of scientific knowledge—have become highly integrated. When in the 1960s Virginia Apgar called for a national registry of birth defects, she envisioned a highly integrated registry with no limitations on access.²¹ Although Apagar's dream was never quite realized, like many of the states that developed registries in the 1980s and 1990s, the Massachusetts Department of Public Health argued that, “The goal … should be to integrate birth defects surveillance into maternal and child health programs and activities in order to create a seamless system of data collection, analysis, research, and follow-up interventions.”²²

The traditions challenged

But public health surveillance, it is important to stress, developed in a medical and public health culture that was both paternalistic and authoritarian. Little explicit consideration was given to the ethical foundations of public health decision-making for much of the 20th century. In the 1960s and 1970s, autonomy-centered values began to dominate biomedical research and the clinical relationship.²³ It was in this context that some patients demanded public health surveillance and the protections or services that might follow from it and others opposed surveillance as a threat to individual rights.²⁴ While the AIDS epidemic provided the occasion for the most sustained challenges to the collection and use of identifiable data, concerns regarding surveillance precede the AIDS epidemic and extend beyond it. Controversies have been animated by deep differences between those who believe that the mandate of public health warrants the extensive use of identifiable data and those whose conception of privacy and individual rights requires the imposition of strict limitations.

CONTEMPORARY CONTROVERSIES RELATED TO DATA USE AND DISCLOSURE

Using data for case management

In an effort to minimize opposition to HIV reporting, some public health officials have chosen to limit the use of identifiable data to epidemiological purposes only—determining the magnitude of population health problems, mapping the spread of the diseases, understanding patterns of contagion—rather than using data to support case management or partner counseling and referral.²⁵ Others argue that intervention should be a primary use and it is the failure to act that must be justified (personal communication, National HIV/AIDS Surveillance Workshop, 2004 Jun 21–25; Atlanta, GA). In 2005 and 2006, for example, the New York City Department of Health and Mental Hygiene proposed extending lab-based reporting and clinical intervention to diabetes and HIV. In the case of diabetes, the department proposed to inform both patients and physicians when lab results indicated poor control over diabetes.^26,27 In the case of HIV, concern about the clinical management of poor patients without consistent care has motivated an effort to allow health officials to extend the uses of surveillance data, which have been limited to contact tracing and partner notification.²⁸ In both instances, the health department sought to extend public health into the clinical domain.²⁹

Sharing data within and among public health agencies

Privacy advocates have challenged the prerogative of public health officials to share data even within the same agency. Some program officials also object to the sharing of highly sensitive data. Their claim is that sensitive health information demands strict privacy. For example, some HIV/AIDS surveillance programs maintain that data may only be used for epidemiological monitoring purposes. Data may never be shared outside HIV surveillance programs even within the same public health agency and they may never be used for public health interventions such as partner notification or case management. Indeed, some agencies have erected protective walls around HIV/AIDS registries and prohibit the linkage of HIV/AIDS data with tuberculosis data.³⁰

Although health threats are rarely confined within arbitrary geographic borders, far more controversial has been interjurisdictional data sharing—i.e., sharing identifiable information with other state or local health departments. Underscoring the fierce contests over the question of interjurisdictional exchange of health data, AIDS advocacy organizations maintained, “We have always believed that inter-agency transfers of data should be regarded as ′disclosures' of information, with a requirement of informed consent except in narrowly limited circumstances.”³¹ In contrast, the Council of State and Territorial Epidemiologists (CSTE), an association of public health professionals, supports the routine interjurisdictional sharing of HIV case data to resolve duplicate case counts across states and maintain the quality of local and national HIV surveillance data.³² Although some might argue that AIDS represents an exception rather than the norm, these concerns are not limited to those involved in AIDS-related work. Those engaged in occupational and environmental surveillance, for example, have expressed “serious reservations about a presumption that permits data sharing among agencies, even when justified by a ′legitimate public health purpose.' … Programs should not be forced to share data if they have legitimate concerns about how others would use it/protect it.”³³

Even greater concern arises at the prospect that state health departments would forward identifiable information to a centralized national disease registry. Proposals for a national immunization registry for infants and children were derailed amid a firestorm of political protest in the early 1990s. Instead there has emerged a mix of state and local registries reflective of compromises.³⁴ Likewise, in the early 1980s, an effort to require states to send full name-linked AIDS case reports to the CDC provoked intense opposition. In the end, the CDC was compelled to accept a reporting system where names are not forwarded to CDC. In the resulting system, state and local health departments retain the names of individuals reported with HIV and AIDS, which enables collection of epidemiologic information and de-duplication of data at the local level. Names are removed before encrypted data are forwarded to CDC.³⁵

Public disclosures

In the last decades of the 20th century, the tradition of disclosing the names of those with communicable diseases, at least in major newspapers, all but vanished.³ Changing patterns of morbidity as well as the emergence of strict norms of confidentiality were central to this transformation. It is within such context that controversy has arisen over when, if ever, health departments may disclose identifiable information to the public or public agencies.

Contemporary decisions about whether to reveal the identity of those with disease who posed a public health threat have turned on assessments of the risk to the community. In Texas, in response to a 1993 investigation of a case of fatal hantavirus, state health officials refused to disclose the name of an infected individual to the local media.^36,37 A 1999 case of meningitis in a Maryland school was not sufficient for the County's Director of Community and Environmental Health to identify the student by name. The official, however, suggested that had more people been at risk for contracting the disease, it may have been deemed appropriate to identify the infected student by name, even over the objections of her parents.³⁸ Such criteria were met in the case of SARS. In the 2003 outbreak in Toronto, the names of the first two cases, a mother and son, were released to the press for the purpose of identifying and advising people who might have had contact with them.³⁹

Disclosure of data on lead poisoning in children collected by state health departments could potentially affect many people in the community. In some cities and states, addresses where lead cases have occurred are considered part of the public record. The Raleigh News & Observer recently requested North Carolina's entire blood lead surveillance database. The health department, in accordance with its policy, agreed to redact the names and share the data. But other locales, concerned that such data could lead to the public identification of affected children, do not disclose this information. Still others strike a kind of balance in the interests of warning the public: for example, although the health department will not release all address data, the Rhode Island legislature now requires the state department of health to keep a public list of high-risk rental properties where multiple children have been reported with elevated blood lead levels.^40–42

In the history of the AIDS epidemic, there were efforts to use public health records in ways that could not be justified by the nature of HIV transmission. For example, Missouri sought to compare its AIDS registry with a list of public school teachers. The CDC warned that such a use was inconsistent with the cooperative agreement governing surveillance data.⁴³ More complex was the question of whether HIV/AIDS registries could be used to prevent infected health care workers from undertaking invasive procedures where there was a theoretical risk of blood-borne transmission.⁴⁴ The question of whether such risks provided a justification for limits on practice informed the debate about the registry use.

Although health officials explicitly sought court permission, more controversial, still, was the question of when, if ever, public health records should be disclosed for public purposes unrelated to health, such as homeland security, law enforcement, immigration, or social welfare. Where public health officials become aware of a threat, they may have no alternative but to call upon the police to intervene to enforce the public health mandate, such as the prevention of an imminent threat of infectious disease. Nushawn Williams, an HIV-infected man, represents the most well known contemporary example of a health department decision to disclose the name of an individual to law enforcement officials. In this instance, county health officials sought court permission to reveal his name to the police based on evidence that he had intentionally exposed a number of teenage girls to HIV infection.⁴⁵ After the police located him in prison, health officials then asked for and received permission from the court to publish his name and picture to alert those who might have been at risk.^46,47

Far different are occasions when those charged with law enforcement, immigration control, or the social welfare system seek to obtain and use public health data to fulfill their own functions. They may argue that public security and fidelity to law are just as important as public health. For example, sharing the names of all reported cases of anthrax during a bioterrorist attack might help law enforcement identify those who disseminated the spores and bring them to justice. In the case of HIV, health officials have been ordered to release registry data in prosecutions involving sexual assault or criminal transmission. In Iowa, for example, the law allows for courts to subpoena HIV test results, though not information related to counseling. This creates a tension for public health personnel who are called upon to disclose otherwise confidential information.⁴⁸ On the one hand, such cases reach the courts because of the limits of counseling, testing, and partner notification programs in persuading some individuals to either modify their own behavior or inform sexual or needle-sharing partners of the risk. But on the other hand, such court-ordered disclosures could do irreparable damage to surveillance activities predicated on the widely held assumption that case reporting may only be used to protect the public health. Because information can often be subpoenaed from other sources, such as medical records, without risking a breach of the public health surveillance system, public health advocates have often insisted on an unbreachable wall of separation.

Research

Health departments routinely follow up on name-based case reports with investigations necessary to elucidate patterns of morbidity and mortality as a prerequisite to intervention. Such follow-up typically takes place in systematic surveillance, outbreak investigations, program evaluations, and quality assurance efforts. Such investigations are integral to the very notion of epidemiology, public health, and the management of clinical care. Yet, in a context where research has been defined by federal regulation, some of these activities have, at times, been construed to be human subjects research requiring ethical oversight. In some instances, it is clear that the activities do represent human subjects research. In many others, the boundary between research and practice has been exceedingly difficult to draw and remains hotly contested.⁴⁹

When concerns about privacy of cancer registries surfaced in the late 1990s, the central and uncontested argument for preserving tumor notification was the importance of securing the research enterprise.^50,51 In the context of HIV/AIDS, the use of registries for public health research has been challenged. For example, Maryland chose not to participate in a CDC study to use its AIDS case registry for follow-up contact designed to investigate the potential impact of name-based HIV reporting on testing behavior. In the context of drafting the Model Public Health Privacy Act, the use of registry data for even epidemiological research was questioned.⁵² Here privacy advocates wanted nothing less than what the executive director of AIDS Action described as a “firewall between the health departments and people living with AIDS,” which would apply to all uses, including research.⁵³ Lambda Legal Defense fund, for example, initially insisted that because registry data are collected without consent, “a total ban on unconsented research disclosures is appropriate.”³¹ In Philadelphia, however, although advocates questioned the use of the AIDS registry for research, local public health officials and the CDC supported the supplemental surveillance activity as an appropriate public health activity with necessary human subject approval and oversight.^49,54 But even those who argue strongly for the use of surveillance data as a foundation for further investigation acknowledge the existence of the gray borderland between research, with its demands for ethical oversight, and public health practice.⁴⁹

Data releases

Public health departments routinely distribute aggregate or population-level data drawn from individual case reports. The disclosure of such data does not violate privacy. At the national level, CDC provides aggregate HIV data through a variety of sources to the public including a public-use dataset. CDC programs follow strict policies on the sharing and release of data provided by state health departments to CDC to protect data confidentiality.^55,56 But the public sometimes feels an urgent need to have access not simply to aggregated data, but to de-identified or coded datasets in order to assess the hazards to which communities might be exposed.

In New York, a citizen's group sought disaggregated individual data that, while stripped of names and street addresses, included patients' age, zip code, diagnosis, and date of death from the state's cancer registry because of concerns of a cluster of cases in a distinct geographic area. The health department denied the request because, using the Social Security death index available via the Internet, the information could be used to identify individuals in the registry.⁵⁷ Such a refusal was subject to adjudication in Illinois. An appellate court addressed the conflict between the obligation to inform the public through de-identified data releases and privacy. The court acceded to a newspaper's Freedom of Information Act request for cancer registry incidence data by zip code, type of cancer, and date of diagnosis. The court, over the objection of the state health department, held that the request was consistent with the purpose of surveillance under the Cancer Registry Act, “to monitor incidence trends of cancer and to inform citizens about the risks, early detection, and treatment of cancers whose incidence is known to be elevated in their communities.”⁵⁸ The court agreed to the release of data, despite the fact that a computer expert had been able to identify individuals from the dataset.^59,60

A CODE OF RESTRAINT FOR AFFIRMATIVE DUTIES

Unlike the field of bioethics, which, over the past three decades, has reached consensus on the principles that ought to guide clinical practice and human subjects research, there is no broadly accepted ethical framework for public health at this juncture. What exists, however, is a recognition that the priority of protecting communal well-being must be subject to some limits involving the rights of individuals and the fair distribution of burdens. Nancy Kass, for example, has argued that an ethical framework for public health might best be viewed “as a code of restraint, a code to preserve fairly and appropriately the negative rights of citizens to noninterference” against an affirmative duty to protect and improve the public's health.¹² Precisely how to strike the balance among competing claims remains a matter of disagreement. But asserting that there is no inherent tension between the claims of individual privacy and the requirements of public health practice does more to obfuscate than to illuminate difficult choices that public health officials must make.

Data uses

There may be ethical justifications for challenging the acquisition of identifiable data in a given situation. Further, there may well be political and pragmatic reasons for observing some limits on data uses. But once the data are in hand it is the failure to use those data for public health purposes that must be justified. As Childress and colleagues argue, “general moral considerations … provide a prima facie warrant for many activities in pursuit of the goal of public health.”⁵

Such uses may encompass not only inclusion in research but also direct interventions such as partner notification; isolation and quarantine, where appropriate given the nature of the threat and the existence of adequate procedural protections; triggering occupational or environmental health investigations; notifying parents or physicians about lapses in childhood immunization; or even more comprehensive care management. In the specific case of human subjects research, investigations involving identifiable public health data require compliance with the Common Rule—the federal regulations for protecting human research subjects that have been commonly codified by 15 federal agencies—and review by an institutional review board (IRB).⁹

Data sharing within and among public health agencies and the conduct of research.

Both the history of, and moral justifications for, public health practice provide a strong basis for data sharing within and among health departments. Moral considerations, which include respect for privacy, as well as historical and legal standards demand that strict norms of privacy must govern the sharing of data. But because extensive sharing always involves a theoretical risk of breaches of privacy, shared data should be de-identified or anonymized unless such efforts will compromise public health practice. When names are sought, it is imperative to ensure that they are justified by a strong public health purpose and that privacy is safeguarded. Thus, those receiving identifiable data should have equivalent confidentiality and security standards in place.

Data releases.

Very different are the instances of data releases, which most fundamentally involve balancing the ethical principles of privacy, out of respect for persons, against either beneficence, the charge to do more good than harm, or social justice, which requires the fair distribution of burdens and benefits. In the instances of releasing data to the public or agencies outside of public health, whether it is identified or de-identified, resolving the tension between these different principles rides heavily on the specifics of each case. Thus, the effort to subject public health practice to ethical analysis does not rest on establishing a hierarchy of ethical principles. It requires that we “assign weight” to the relevant ethical principles “in the context of particular policies, practices, and actions, in order to provide concrete moral guidance.”⁵ The process of making such assignments is not mechanical but rather will involve systematic, careful, and reflective deliberation that considers but is not straight-jacketed by the history of decision-making in similar cases.

Although the specifics of each individual case must still weigh heavily in these determinations, one way to begin to parse the issues is to consider different kinds of data releases: the release of aggregate data to the public; the release of de-identified data regarding a group of individuals where there remains some risk of individual reidentification; the release of data related to specific individuals to the public; and the release of individual-level data to agencies outside public health such as law enforcement.

Aggregate data releases.

The mandate to use and make available surveillance data to ensure that it will in fact serve the interests of the public in securing and maintaining the well-being of populations are obligations grounded in both beneficence and justice. But just as beneficence and justice may require the use of data to limit threats to the public's health, they also demand the minimization and fair distribution of the burdens that may emerge when vulnerable populations are identified as being at increased risk. Such burdens may include “suffering, stigmatization, prejudice, loss of prestige or self-esteem, or economic loss.”⁶¹ Nonetheless, it is those very populations that may potentially benefit as a result of being identified as bearing a disproportionate burden of disease.

If beneficence demands that we do more good than harm, it also demands a kind of risk management: that we maximize potential benefits and attempt to minimize both the potential harms of surveillance and the burden of disease by acting on those data. Thus, when the communication of surveillance data may injure the vulnerable population it is intended to serve, every effort must be made to minimize such risks. There may be no way of avoiding the fact that some communication may be experienced by vulnerable populations as injurious. That does not mean, however, that aggregate data should not be released or that it may be censored. Direct communication with the groups involved and the utilization of transparent procedures could play a crucial, ameliorative role in this regard. It is only the commitment to utilizing public health data to benefit such vulnerable groups that permits its release even if there may be short-term harms. Thus, both beneficence and justice require that sensitive information be interpreted and explained in a manner protective of those at risk and communicated with discretion.

Release of de-identified datasets.

Health officials must take care that when distributing aggregate or population-level data that it is not possible to identify individuals. But data release can never be risk free. Risks, however, vary, and while considerable in some cases they can be more remote in others. Thus, beneficence and justice must be balanced by the right of individuals to control or limit access to their personal information—their right to privacy. Therefore, health officials must consider the circumstances attendant to each request and weigh the magnitude of the risk to individuals against the public's interest in having access to data to identify health risks or advocate for resources or policy initiatives. Where de-identified data release is deemed unacceptable because of the threat to privacy, health departments bear the burden of undertaking the analysis that would assist local communities in understanding the extent to which they are at increased risk.

Disclosures to the public.

In some instances, individual identification is, in fact, either the goal or the inevitable consequence of data release, as in the cases of meningitis, hantavirus, and lead contamination discussed here. If alternative warnings or approaches can accomplish the public health goal, the right to privacy makes the release of identifiable information ethically unjustifiable. Respect for persons, then, requires that health officials use the least intrusive measures available to accomplish the goal of protecting the public. Although not inconceivable, a scenario in which the confluence of particular circumstances and the clinical aspects of a disease would warrant the public identification of individuals would be rare, as we have noted in the case of SARS. How contested such disclosures can be is underscored by the Williams case in New York.

Disclosures to non-public health agencies.

The principles of respect for persons and justice, which have at their core both the notion of procedural and substantive fairness, limit the uses of data collected under the auspices of public health. Public health data acquired without consent pursuant to public health goals represent information that in other social domains might be provided under far more restrictive circumstances—e.g., where there exists a right to remain silent or an obligation to obtain an explicit court order to compel disclosure. To use data collected under the auspices of public health for non-health ends would short-circuit the limitations imposed in other domains.

The principle of beneficence dictates extreme caution when attempts are made to use identifiable public health data for non-public health purposes. Yet it does not preclude all such efforts. It suggests, rather, that the prohibition against data sharing with non-public health agencies such as law enforcement can only be overcome in compelling circumstances involving significant risks of harm to others or to the public's health more generally. Further, such disclosure should only occur when the public health agency itself cannot address or eliminate the threat. Very rarely will such criteria be met. Narrowly defined legal guidelines and strict judicial oversight should govern any such disclosures. But, as the Iowa example underscores, neither juridical oversight nor the crafting of legal guidelines obviate the need for continued ethical scrutiny.

The Figure summarizes a code of restraint for using identifiable public health data.

Figure.

Code of restraint for using identifiable data to achieve affirmative public health duties

CONCLUSION

For much of the 20th century, as public health agencies made use of identifiable data to control morbidity and mortality, the ethical balances struck were rarely the subject of public discussion beyond those of public health officials or outside the development of public health laws or sanitation codes. We now acknowledge that professional and political decisions about data uses must pay heed to ethical considerations and involve a broad range of stakeholders. The mission of public health to safeguard the common good needs to be recognized but subjected to some limits by the right of individuals to a sphere of privacy. Judging the acceptability of public health means and ends is a complex matter at the intersection of ethics, law, and policy. Pragmatic and political considerations may play a defining role. Negotiation and compromise may produce outcomes that reflect the interests of different groups. But these compromises must also be the subjects of ethical scrutiny. Finding the appropriate mechanisms to assure explicit, systematic evaluation based on ethical principles as we make and review decisions regarding the uses of identifiable public health data remains the challenge ahead.