Ethical Justification for Conducting Public Health Surveillance Without Patient Consent

Abstract

Public health surveillance by necessity occurs without explicit patient consent.

There is strong legal and scientific support for maintaining name-based reporting of infectious diseases and other types of public health surveillance.

We present conditions under which surveillance without explicit patient consent is ethically justifiable using principles of contemporary clinical and public health ethics. Overriding individual autonomy must be justified in terms of the obligation of public health to improve population health, reduce inequities, attend to the health of vulnerable and systematically disadvantaged persons, and prevent harm. In addition, data elements collected without consent must represent the minimal necessary interference, lead to effective public health action, and be maintained securely.

Public health surveillance is defined as

the ongoing, systematic collection, analysis, and interpretation of health-related data with the a priori purpose of preventing or controlling disease or injury, or of identifying unusual events of public health importance, followed by the dissemination and use of information for public health action.¹

It is distinct from other types of surveillance (e.g., security or intelligence) in that the purpose of public health surveillance is to prevent or control disease or injury and to improve the public's health.² Surveillance is a foundational tool of public health, serving as the finger on the pulse of the health of a community. Public health surveillance is used, in some cases uniquely, to quantify the magnitude of health problems, describe the natural history of disease, detect outbreaks and epidemics of known or new pathogens, document the distribution and spread of health events, facilitate epidemiological and laboratory research, generate and test hypotheses, evaluate control and prevention measures, monitor isolation activities and changes in infectious agents, detect changes in health practices, plan public health actions and use of resources, and appropriate and allocate prevention and care funds.³

Public health surveillance consists of 7 ongoing, systematic activities in 3 basic steps—system development, data collection and analysis, and data use—that provide continuous feedback for system improvement. The first step, system development, involves (1) planning and design. The second step, data collection and analysis, involves (2) data collection, (3) collation, (4) analysis, and (5) interpretation. The third step, data use, involves (6) dissemination and (7) application to public health program. These 7 activities create the infrastructure of a coherent and state-of-the-art system.⁴ Findings from such systems are fed directly to public health programs that benefit the populations and communities from which the data are collected²; this feedback into programmatic action distinguishes public health surveillance from other ways of knowing about health.⁵ Public health surveillance systems vary according to their purpose, the condition monitored, and the planned uses of the data. Some systems use non–name-based reporting mechanisms; others require names and other personal identifiers for case reporting. We examine the conditions under which it is ethically justifiable to create and maintain a public health surveillance system that, in addition to the disease or health outcome, risk factors, and demographic characteristics, requires that a name or other identifying information be reported to the local or state health official for storage and future use.

The first public health surveillance system in the United States was developed in Rhode Island in 1741, when public health law required tavern keepers to report persons with infectious diseases to health officials.³ Today, public health surveillance is legally authorized and widely implemented; every state requires health care providers to report certain health conditions to the local or state public health authority.⁶ Under police powers of the states, these reports are legally required regardless of patient consent or knowledge⁷ and are, as they have been for nearly 300 years, justified scientifically.^8–11 Scientific justification stems from the population-based nature of public health surveillance systems, in which all diagnoses or health events have an equal chance of being reported to the system, producing a highly representative set of information to describe a health condition in the populace.

In some systems, such as those for tuberculosis and HIV, laboratories and health care providers are required to report all diagnosed cases of a health event; these public health surveillance systems exemplify a reference standard for completeness, representing the accurate number and distribution of cases in the population.¹² In systems such as these in which more than 1 event is reported per case (e.g., a positive HIV antibody test followed by an HIV viral load measure) or persons can be reported in more than 1 jurisdiction (e.g., as the result of relocating or seeking care across state boundaries), identifying information is necessary to maintain a de-duplicated database both within and across states.¹³ Systems also use identifiers to complete the final step in their process—linking to public health action. Such action could mean the enrollment of a patient with tuberculosis into directly observed therapy, a strategy for improving tuberculosis control,¹⁴ or partner notification services for persons diagnosed with sexually transmitted diseases.¹⁵

However, here we did not address the scientific or legal justifications for public health surveillance. Rather, we examined the ethical justification for conducting surveillance without patient consent. Aside from “It's the law,” how can the public health system ethically defend the collection of personally identifiable, private health information without patient consent for the purposes of public health practice? What characteristics must such a public health surveillance system possess to meet ethical standards in the context of contemporary public health ethics frameworks?

THE ETHICAL DILEMMA

The ethical justification for public health surveillance without explicit patient consent presents itself as a challenge at the intersection of principles of clinical and public health ethics. The competing ethical priorities are the health care provider's responsibility to protect patient confidentiality (derived from the ethical principle to respect the patient's autonomy to have a say¹⁶ in the dissemination of her or his health information) and the public health authority's responsibility to use the information to improve population health. Specifically, the right to keep one's health data private is an exercise of one's autonomy,¹⁷ a sort of informational privacy,¹⁸ which is emphasized in clinical encounters. These conflicting ethical priorities require us to examine the underlying ethical principles influencing both clinical and public health practice.

In contemporary public health, no condition has pushed us to think about how individual rights relate to public health more than HIV/AIDS. As Bayer and Fairchild describe,¹⁹ it was the United Nations (UN) Office of the High Commissioner for Human Rights and the Joint UN Program on AIDS that concluded, “Public health interests do not conflict with human rights.”²⁰ During the debate over name-based HIV surveillance in the United States in the 1990s, however, questions were raised about whether public health surveillance was a violation of privacy that could be justified ethically for the good of the community. Systems using non–named-based identifiers were attempted in some states to assuage privacy concerns but ultimately were deemed unable to meet the performance standards set for HIV case reporting.²¹ Ultimately all 56 jurisdictions implemented name-based HIV reporting by mid-2008.²²

In this HIV/AIDS surveillance example, we are presented with the key conflict between bioethics—concerned with clinical, or provider-patient, issues—and public health ethics—concerned with public health professional-population issues.

Biomedical Ethics

Contemporary biomedical ethics operates in large part by the practical application of 4 principles considered in the relationship between the health care provider and the individual patient. These 4 principles—autonomy, beneficence, nonmaleficence (do no harm), and justice—were outlined by Beauchamp and Childress²³ in the 1970s. Although not without serious critics,^24–26 principle-based approaches remain the mainstay of clinical bioethics²⁷ and are used by hospital ethics committees worldwide. Clinical bioethicists consider these principles to have prima facie standing, which describes an obligation that is to be fulfilled unless it conflicts with an equal or stronger obligation. Clinicians must identify the relevant principles, weigh them against the concerns of a case, and justify their clinical decisions and recommendations on the basis of the totality of the weighted principles vis-à-vis the best interests of the patient.

During the latter half of the 20th century, autonomy became the supreme value in clinical care in the United States and in much of the developed world. Beneficence, or the set of actions intended to benefit others, lost its primacy, and providers were forced to open their previously unquestioned goodwill to the scrutiny (and sometimes challenge) of other interested parties.²⁸ It was no longer enough for a health care provider to provide a set of instructions—say, to take a medication and rest—on the basis of what he or she felt was best on the basis of years of training and experience. Patients wanted to know what the medication and its risks were, whether it was the only option, and what other treatment alternatives there were; and they often had suggestions of their own. The perception of autonomy as the prevailing principle rose from the convergence of numerous changes in the social and medical milieu,²⁸ but ethical theory continues to hold it in prima facie equivalence with beneficence, nonmaleficence, and justice.²³

This rise in the prominence of autonomy, and the resultant conflict for health care providers, was observed in the first ever contemporary community engagement in public health surveillance around the reporting of HIV infection cases by patient name. Patients, requesting that providers respect their privacy, did not want their identifying information along with HIV status and risk behaviors to be reported to the health department. Providers, many of whom recognized the value of infectious disease reporting, faced a conflict between the bioethics principles of autonomy and nonmaleficence, given the risk perceived by their patients of having their personal and private health information held by the state. On the other hand, some argued that providers’ duty to warn obligations²⁹ (another aspect of nonmaleficence) was fulfilled upon their reporting the case to public health.³⁰ Providers began to recognize the need for accurate public health surveillance data—in this case, accurate information on which to base the allocation of funding for public health interventions that would help persons with HIV reduce the likelihood of transmission to their sex and needle-sharing partners; allocation of funding for care and treatment of persons with HIV in their communities; and appropriation of federal, state, and local funds for communities hardest hit by HIV/AIDS. Providers faced this additional ethical dilemma that included a principle that was not outlined in what they had learned about health ethics: the need to care for the health of the population.

Contemporary bioethics describes an approach to resolve a conflict in which infringement on patient confidentiality is at odds with required release of information or when a third party faces grave danger.³⁰ A provider must make a judgment about disclosure on the basis of the prima facie standing of autonomy with the probability and magnitude of harm. In the case of legally mandated case reporting, even without explicit patient consent, the probability and the magnitude of harm (resulting from not reporting) must be moderate to major on a population scale for reporting to be ethically justified. In the case of HIV reporting, the consequences of the absence of unbiased information about the incidence and distribution of cases could include numerous harms, including underappropriation of funds needed to treat and prevent infections, misallocated funds that are distributed to the most organized subgroup, and ultimately an increase in new infections and deaths.

Public Health Ethics

The field of public health ethics began in earnest in the early 2000s with the recognition that the conceptual resources for clinical ethics are inadequate for dealing with issues in public health practice. In clinical ethics, the focus is on resolving moral dilemmas involving health care providers and their individual patients. In public health, where the focus is population and community well-being, the community rather than the individual is the patient. The dominance of individual autonomy despite prima facie equivalence in clinical ethics is incompatible with the population-centered focus of public health.

Contemporary public health ethicists have developed numerous approaches to considering the ethical dimensions of public health problems. Most applied theories have offered principle-based approaches consisting of 2 steps: first, an outline of fundamental principles on which action should be based, similar to the way principles have been outlined for bioethics; second, some have proposed various filters³¹ or “justificatory conditions”³² through which to run public health ethics challenges. Other approaches, opposing the limits of the principled approach, have argued for broader, theory-based approaches that rely on many of the established ethical theories, including utilitarianism, deontology, virtue ethics, communitarianism, feminist ethics, human rights, and others.

Early efforts to outline applied frameworks for public health ethics by Kass³¹ and Childress et al.³² were derived from foundational values that required obligations on the part of the public health enterprise (e.g., the obligation to improve the public's health, promote social justice, produce benefits, remove harms, distribute burdens and benefits, keep commitments, and disclose information truthfully^31,32) and rights and protections to individuals in the community (e.g., the negative right to noninterference,³¹ ensure participation, respect autonomy, and protect confidentiality³²). Upshur,³³ Thompson et al.,³⁴ and Baum et al.³⁵ complemented these foundational values by explicitly adding social duty, or the obligation to respond to suffering; equity; proportionality, which requires that any restrictions to liberty not exceed what is necessary to address the needs of the community; reciprocity, or the obligation to support those who face a disproportionate burden in responding to public health measures; solidarity, which requires connectivity among public and private systems to meet public health goals; stewardship, or the obligation to govern scarce resources to maximize benefits and minimize collateral damage; trust between communities and public health professionals; evidence-based actions; justice; accountability; costs and efficiencies; and political feasibility. Furthermore, as preparedness gained footing in public health in the mid-2000s, Swain et al.³⁶ added values related to anticipating—not only responding to—public health events. Additional foundational values included interdependence, or the recognition that the health of some can depend on others; community trust, which embodies other values, including transparency, confidentiality, and community consent; fundamentality, or remaining focused on the underlying and primary causes of disease in both the physical and social environment; and justice, or ensuring that conditions for health are available to all, especially those who are vulnerable and disenfranchised.

Broader, theory-based approaches to public health ethics have borrowed from a variety of philosophical underpinnings, including human rights³⁷; ethics of care and feminism³⁸; civic republicanism³⁹; personalism, utilitarianism, Kantian theory and communitarianism²⁵; political liberalism, Mill's harm principle, collectivism, and libertarian paternalism⁴⁰; and relational ethics.⁴¹ Distilled from these philosophical theories are foundational values that complement those outlined from the principle-based frameworks. In addition to autonomy, confidentiality, equity, and equal opportunity for health resources, the theory-based frameworks add broad foundational values such as human rights as critical determinants of health; the role of governments in ensuring minimum standards for the health of all persons and attending to the needs of the vulnerable and systematically disadvantaged; recognition of persons as social and relational beings who deserve fair access to social capital, including rights, opportunities, power, and self-respect; recognition of the need to limit liberty when necessary to prevent harm to others; and agreement of a social contract that state power may be used to advance the welfare of citizens.

On the basis of the foundational values, framers of public health ethics approaches began to outline principles that served as a way to operationalize the foundational values into behavior and practitioner decision-making. Although there is no common set of operating principles on which the field has agreed completely, there is substantial consistency in principles across frameworks. Many of the operating principles are reflected in the Public Health Leadership Institute's code of ethics for public health in the American Journal of Public Health in 2002.⁴² This code used the ethical concepts of community, justice, duty, interdependence, autonomy, and human rights to develop 12 operating principles of ethical public health practice. All principles are related to the ethical practice of public health surveillance, and 4 principles deal directly with surveillance, including seeking information necessary for implementing effective programs to protect and promote health, obtaining community consent, acting in a timely manner on information, and protecting confidentiality to avoid bringing harm to individuals or communities.⁴² Operating principles from other frameworks that drive ethical public health surveillance include imposing minimal interference or least infringement, ensuring that intervention is necessary and effective, evaluating and providing evidence of benefits being outweighed by infringements, reducing inequities and responding to systemic inequalities, and ensuring transparency, inclusiveness, and openness.

Similar to the case in clinical ethics, in the public health ethics frameworks presented, foundational values and operating principles must be weighed and considered against what is best for the patient—in this case, the population. In the case of surveillance without patient consent, the question is, when is collecting individual-level, identifiable data without an individual patient's consent—that is, overriding autonomy—justified in terms of the obligation of public health to improve population health, reduce inequities, attend to the health of vulnerable and systematically disadvantaged persons, and prevent harms? Additional requirements include whether the data elements collected without consent represent the minimal necessary interference, will lead to effective public health action, and are maintained securely and confidentially.

ETHICAL JUSTIFICATION FOR PUBLIC HEALTH SURVEILLANCE

When public health surveillance practices meet the affirmative and refrain from violating negative operating principles, such practices can be considered ethically permissible and systems ethically justified. Current best practices for the 7 activities within the 3 basic steps of a public health surveillance system begin with system development,⁴³ which includes beginning with a clear understanding of the public health purpose of the system to ensure that the applicable data are collected to answer the key questions. A clear understanding of what public health question to answer often involves prioritizing among health outcomes on the basis of the magnitude of the effect, measured by frequency, severity, cost, or preventability. This prioritization meets the operating principles of seeking the right information and acting in a timely manner to a population's health need. When planning what data fields are to be collected, consideration must be given to the tension between a need for adequate data to inform public health practice and the ability to protect the confidentiality of individuals’ health information.⁴⁴ Current recommended practice is to collect the minimum number and simplest data elements necessary to meet the goals of the system to minimize risk to individuals,⁴⁴ thus meeting the operating principle of imposing the least possible infringement. Early engagement of partners and affected communities is recommended in the development of public health surveillance systems,^45,46 especially when the data are sensitive or populations particularly vulnerable. It is often with the input from affected communities that decisions are made about what type of data should be collected in a surveillance system. Community engagement was used effectively during the 1990s to gain support for name-based HIV reporting,⁴⁷ including in areas where initial opposition was vociferous, such as New York City and San Francisco, California. Operating principles of transparency, inclusiveness, and openness are addressed here.

Current best practices for the data steps, including collection,⁴⁴ collation,^44,48 analysis,^49,50 and interpretation,^49,51 cascade directly from a well-planned system. Collecting the minimum number and least sensitive data elements necessary given the public health purpose of the system coincides with the operating principles of imposing minimal interference or least infringement, reasonableness, and focus on the fundamental causes of disease. Collecting information from all affected cases (or, alternatively, a representative sample) is the hallmark of population-based public health surveillance, leaving no subgroup excluded either from data collection or, perhaps more importantly, from identification of the need for intervention. This lack of exclusion based on demographic, behavioral, or social characteristics operationalizes the principles of reducing inequities and responding to systemic inequalities and inclusiveness. In an evidence-based field like public health, it is critical to collect data to support just and equitable distribution of care and prevention resources. If a group is systematically excluded from public health surveillance, perhaps as the result of seeking care at a certain type of provider that is less accountable for reporting, this group will be less represented in the data and subject to systemic inequalities in the benefits gained from being counted in the system. Acquiring accurate data during collection and collation⁴⁴ is considered a minimal requirement of a public health surveillance system, and ongoing monitoring and periodic evaluation to ensure data accuracy are recommended for all systems.⁵² This practice helps meet the expectations of 2 operating principles: ensuring the usefulness of the information collected and providing evidence that the benefits of collecting the data outweigh the infringements. Using appropriate analytic techniques and accurately interpreting findings require full knowledge of the surveillance system. Responsible interpretation aligns with operating principles of ensuring that the intervention (in this case, surveillance) is effective and ensuring that benefits outweigh infringements. Finally, best practices for data security include requirements regarding physical and technological security protections of data and written procedures for how data are obtained, transferred, accessed, stored, and used or shared. Limiting the number of printed and digital copies of case data, anonymizing and encrypting data during transport, limiting the number of users to the smallest possible, annual security training, and incorporating specific sanctions into annual confidentiality agreements signed by personnel working with surveillance data are some of the recommended best practices for maintaining confidentiality and data security.⁴⁶ These practices exemplify the operating principles of protecting confidentiality and avoiding harm to individuals; they also contribute to minimal interference by keeping data safe and reducing the opportunity for harm.

Current best practices for data use—including dissemination and communication^53,54 of the information to those who need to know and application of the information to public health programs and interventions to improve health outcomes⁵⁵—are derived from the tenet that the collection of data must not be an end, but a means, to the improvement of the health of the community from which the data were collected. Communicating information from a surveillance system requires the knowledge of persons and entities that can use the data for public health action and effective communication methods. Effective communication models require the assessment of quality of data, definition of purpose of the communication and the audience, development of the message, selection of the channel, marketing of the information, implementation of the plan, and evaluation of the process and outcome. Operating principles brought to bear in this step of the public health surveillance activity include acting on the information to benefit the community, providing evidence of benefits outweighing infringements, and reducing inequities (often by highlighting disparities and proposing programs to mitigate them). Care must be taken to ensure minimal harm is done upon dissemination of negative information about subgroups with limited social capital. Consultation with community leaders and affected populations about the best communication messages and audiences can reduce harm and further stigmatization that might ensue from simple mass media messages.⁴⁶

RISKS AND RESPONSIBILITIES OF PUBLIC HEALTH ETHICS

Once a reportable condition has been diagnosed and reported per the legal obligations required of the health care provider, the reported data become the responsibility of the public health authority. This responsibility of collecting and holding identifiable private data is serious, and treating patients with respect is critical for the ongoing functioning of public health practice because public trust is foundational to public health surveillance.

The public health community recognizes that there are risks to both individuals and communities when name-based reporting of private health-related information is collected, held, and used by public health officials. Ethical guidance has been suggested to safeguard potential harms.^45,46 These include the following: collection of individual identifiers only when absolutely necessary to achieve the public health goals of the system, acquisition of the minimum amount of information necessary to meet the public health objective, and engagement of affected communities and stakeholders to consult regarding the most effective way to disclose and disseminate the findings of public health surveillance data, especially when they might substantially add to the stigmatization of an already marginalized group. Many categorical programs with the biggest social risks (e.g., HIV and other sexually transmitted diseases) have their own programmatic requirements for the collection, storage, and use of surveillance data.⁵⁶

A major part of the public health enterprise's agreement with the public is the use of surveillance data for improving health. The fundamental ethical consideration that remains for all public health data collections is that the risk of collecting and holding data must be worth the expected outcome of the use of the data.⁵⁷ Herman Biggs, a New York physician who pioneered surveillance in the nineteenth century, firmly held that data were collected to be used, not to keep adding machines busy.⁵⁸ This sentiment was carried through the twentieth century when William Foege, the Centers for Disease Control and Prevention director from 1977 to 1983, stated that the reason for collecting data was to control disease and that collection should not be allowed to consume resources if action does not follow.⁵⁹ Indeed, it remains our ethical obligation to use the data we collect for public health benefit; not using the data for improving health must be justified. In some public health surveillance systems that started as anonymous, ethical justifications were given as reasons to change to name-based identifier reporting to make better use of the data to improve health. The United States, for example, abandoned its domestic anonymous HIV surveillance among pregnant women in 1995 in favor of routine testing of pregnant women and newborns and reporting to their existing name-based surveillance system. This allowed results to be disclosed to pregnant women and new mothers so that they could make choices about chemoprophylaxis and early treatment.⁶⁰

To date, the US public health enterprise has had an excellent track record of handling private information confidentially. Still, as increasing electronic storage enables ease of access, matching, and sharing, it becomes increasingly important for us to adopt enterprise-wide standards for the ethical collection, storage, and use of public health information. There are challenges presented by the various authorities for public health action at the local, state, and federal levels; however, these obstacles are not too great to overcome.

CONCLUSIONS

In addition to sound extant scientific and legal rationale for public health surveillance without explicit patient consent, contemporary public health ethical frameworks and their operating principles can support a well-designed surveillance system that engages affected communities, collects the minimum data necessary, stores data securely, and uses data for public health action.