Protecting Privacy and Transforming COVID-19 Case Surveillance Datasets for Public Use

Abstract

Objectives Federal open-data initiatives that promote increased sharing of federally collected data are important for transparency, data quality, trust, and relationships with the public and state, tribal, local, and territorial partners. These initiatives advance understanding of health conditions and diseases by providing data to researchers, scientists, and policymakers for analysis, collaboration, and use outside the Centers for Disease Control and Prevention (CDC), particularly for emerging conditions such as COVID-19, for which data needs are constantly evolving. Since the beginning of the pandemic, CDC has collected person-level, de-identified data from jurisdictions and currently has more than 8 million records. We describe how CDC designed and produces 2 de-identified public datasets from these collected data. Methods We included data elements based on usefulness, public request, and privacy implications; we suppressed some field values to reduce the risk of re-identification and exposure of confidential information. We created datasets and verified them for privacy and confidentiality by using data management platform analytic tools and R scripts. Results Unrestricted data are available to the public through Data.CDC.gov, and restricted data, with additional fields, are available with a data-use agreement through a private repository on GitHub.com. Practice Implications Enriched understanding of the available public data, the methods used to create these data, and the algorithms used to protect the privacy of de-identified people allow for improved data use. Automating data-generation procedures improves the volume and timeliness of sharing data.

Dynamically adjusting case reporting policy to maximize privacy and public health utility in the face of a pandemic

“… 20 , 22 In this research, we focus on this risk measure to follow the CDC’s application of k -anonymization. 51 The PK risk effectively measures the proportion of records that fail to achieve k -anonymity.…”

“…The CDC’s policy is designed to achieve 11-anonymity (ie, PK11 = 0) by generalizing the date of diagnosis to month and by nulling out quasi-identifier information for small groups. 11 , 13 , 58 Thus, the k -anonymous policy resembles a policy developed with traditional deidentification, but notably differs in its treatment of dates of events and in its assumption of no suppression. We further note this last feature is another unique factor to sharing surveillance data in near-real time.…”

“…We specifically apply the framework to illustrate how policies could be developed to share COVID-19 patient health information and compare such policies to a more traditional deidentification approach relying on retrospective risk assessment. Furthermore, to be consistent with the CDC’s current practice of using generalization and suppression for privacy, 13 we use the framework to explore a wide range of data generalization policies.…”

Public Health Reports in 2021: Impact Factor Increase and New Article Collections on Racism and COVID-19

“…This number differs from the number of articles submitted in 2021 (1166), because decisions made in early 2021 may include late 2020 submissions, and conversely, articles submitted late in 2021 may have received their first decision in 2022. The time to first decision was a mean (range) of 24 (1-180) days, and a median (interquartile range [IQR]) of 14 (8)(9)(10)(11)(12)(13)(14)(15)(16)(17)(18)(19)(20)(21)(22)(23)(24) days. These values represent a 31.4% improvement from the mean time to first decision in 2020 (35 days) and a 34.3% improvement from the maximum time to first decision in 2020 (274 days).…”

Empowering Equitable Data Use Partnerships and Indigenous Data Sovereignties Amid Pandemic Genomics

“…For federally-funded data collection, often DUAs favor deposition of data into a central repository under the ethic of open or communal research use which can incongruent with Indigenous data sovereignties ( 14 ). Since federal data repositories are outside the governance and oversight of tribes, there have been tensions in negotiating the need to protect and recognize Indigenous data sovereignties while still supporting research collaborations ( 32 ). DUAs drafted by private organizations or commercial entities may also have corporate liability protections and intellectual property terms that favor those organizations.…”