Health departments routinely report public health data on a variety of topics such as overdose deaths,1 respiratory diseases,2 and suicide and self harm.3 Sometimes, there are so few cases within a certain field, reporting them can lead to concerns about confidentiality and statistical reliability. To deal with this, health departments establish “small numbers” policies that set out guidelines for presenting or summarizing data with low counts. Small numbers policies are separate and distinct from legal requirements or considerations under state law or HIPAA. Small numbers policies and applicable privacy laws may or may not align in a given circumstance. It is important for attorneys advising health departments to understand small numbers policies so they can assist with their organization's compliance with such policies, while also complying with state or federal law.

1King County Fatal Overdose Dashboard, King County (Updated Jan. 27, 2026), https://kingcounty.gov/en/dept/dph/health-safety/medical-examiner/reports-dashboards/overdose-deaths-dashboard.
2Influenza Dashboard, S.D. Dep’t of Health (Updated Jan. 21, 2026), https://doh.sd.gov/health-data-reports/data-dashboards/influenza-dashboard/ [https://perma.cc/SVQ6-CT6H].
3N.Y. State Dep’t of Health (Undated), https://nyshc.health.ny.gov/web/nyapd/suicides-in-new-york [https://perma.cc/ZT94-A3QZ] (last visited Jan. 27, 2026)

  • What are small numbers policies?

    Typically, when laws and policies address privacy and confidentiality in the healthcare context—like in hospitals or clinics—the goal is to protect the patient's personal health information and maintain trust between the patient and provider. In the public health context, the goal is to promote the health of the community through surveillance and prevention interventions, while also protecting the privacy of the individuals within that community. Public health departments establish small numbers policies as part of a policy framework to achieve this goal. Small numbers policies, in a nutshell, are policies that govern situations where you have only a small number of cases in a dataset. In those situations, it might not matter if the data is deidentified or anonymous, because someone looking at the data could identify people based on demographic and basic case information alone. Small numbers policies are also known as data suppression standards, cell suppression standards, and other similar terms.

  • What specific concerns do small numbers policies address?

    Characteristics that categorize people within small demographic subgroups increase the likelihood that someone can correctly attribute information to an individual. These policies provide information on when and how to suppress or further aggregate data and typically address two main concerns:  

    1. Small numbers can be difficult to interpret because they may be statistically unreliable; therefore, to maintain statistical reliability and support informed decision-making for public health interventions and policies, small numbers may be suppressed in publicly available data sets.
    2. Small numbers may also make it difficult to protect the subject’s privacy if the data collected are sensitive. Concerns about confidentiality should be considered in the context of the type of data and the proportion of the population sampled.

    Note that while it may make sense to suppress data in publicly available datasets to protect confidentiality, the same may not be true when it comes to suppressing datasets that are only shared with other public health partners such as Tribes and Tribal Epidemiology Centers, which need access to data on their populations for public health purposes.

  • What does data suppression due to a small numbers policy look like?

    The tables below illustrate a data suppression example:

    Original Table

    County Cases by Race/Ethnicity Total
      White American Indian/ Alaska Native Middle Eastern/ North African Native Hawaiian/ Pacific Islander  
    Washington 2784 114 56 342 3296
    Jefferson 691 24 12 73 800
    Franklin 2407 85 42 255 2789
    Jackson 490 16 8 51 565
    Madison 137 4 2 14 157
    Total 6509 243 120 735 7607

    Disclosure Control Table with Censored Values 

    County Cases by Race/Ethnicity Total
      White American Indian/ Alaska Native Middle Eastern/ North African Native Hawaiian/ Pacific Islander  
    Washington 2784 114 56 342 3296
    Jefferson 691 24 12 73 800
    Franklin 2407 85 42 255 2789
    Jackson 490 16 8 51 565
    Madison 137 N/A N/A 14 >5
    Total 6509 N/A N/A 735 >5

    In the table with censored values, the number of cases is removed if it is less than 5. Also, the total number of cases for the American Indian/Alaska Native and Middle Eastern/North African subgroups as well as for Madison and the overall population are removed to  prevent users from recalculating the number of cases that have been suppressed.  

  • I am a lawyer representing a public health department. Why do I need to understand how small numbers policies apply to the release of public health data?

    A lawyer representing a public health department needs to balance making data accessible and protecting individual privacy. They should consider several different factors when advising a health department about releasing information on a single case or small number of cases. There is no right or wrong answer, but the following factors should be considered:

    • Does state or federal law have specific requirements related to the data in question? Common examples include data on immunizations, HIV, or Tuberculosis.
    • Are there federal or state guidance documents related to the data in question? State guidance documents are particularly relevant for attorneys serving state or local health departments.
    • What is the reputational risk for the health department if the information that is relied upon for publication is statistically unreliable?
    • What is the risk of reidentification if the information from public health surveillance is released publicly and it is easy to identify someone? What might the consequences of re-identification be? Potential consequences might include risk to public trust and legal or compliance risk, especially if HIPAA applies.
    • What is the risk for the health department if information is withheld that the public would expect or need to know?
    • Related to the question above, has the information already been made public to protect the public’s health? A common example is the release of information about measles cases to protect school-aged children.

    There is no single national standard for establishing when data suppression should occur in the event of a small number of cases or incidents; thus, it is important to know your jurisdiction’s policy. Additionally, a small numbers policy is not a substitute for state or federal law. Ideally, a health department’s policy will be in harmony with the law. If it is not, it will be important for the lawyer to ensure that data is released in compliance with applicable laws. There may also be instances in which state or federal law would allow the disclosure, but a small numbers policy would not.

  • How is a small numbers policy applied?

    Consider the following hypothetical situation. A 75-year-old woman of South Asian descent is hospitalized for an overdose in a predominantly white county with a population of under two thousand people. The health department maintains an Opioid Overdose Surveillance Dashboard to provide the public with information about opioid overdoses in the state. The dashboard displays opioid-related hospitalizations by age, race and ethnicity, and sex for each county. If reported without removing indirect identifiers, it may be possible to learn the identity of Jane Doe, as there may be few or no other people in the county who fit that exact demographic sub profile. In this case, using guidance from their small numbers policy, the state public health department may choose not to report her case in the dashboard.  A small numbers policy provides guidance to health department staff when they are considering publishing or suppressing data to protect residents’ confidential information in a case like this one.

  • How can lawyers learn more about small numbers policies?

    Attorneys preparing data sharing agreements should work in partnership with their health department counterparts who are experts in statistical analysis. Health department epidemiologists are trained in statistics and related concepts such as reidentification risk. As with all scientific fields, best practices evolve and health department staff will be best positioned to understand changes in the statistical methods related to data suppression. Draw on their expertise as you learn about these issues. While it is important for attorneys to be aware of these concepts to provide informed legal advice to health departments, attorneys should defer to public health experts about the specifics of statistical analysis and the risk of reidentification.

    Ultimately, the decision to release a dataset with small numbers requires weighing competing considerations. The risk of causing harm from the improper handling or public disclosure of any described health condition must be balanced against the public health benefit of sharing the information. The legal framework of the jurisdiction will also guide what data can be shared. 

  • Additional Resources

    Consult the following resources for more information:  

  • Questions?

    For legal technical assistance on public health data sharing agreements reach out to Manel Kappagoda (manel.kappagoda@mitchellhamline.edu) or Tom Pryor (tom.pryor@mitchellhamline.edu) at the Public Health Law Center. This resource is part of a series of factsheets prepared by the Public Health Law Center.

    This resource was supported by the Centers for Disease Control and Prevention of the U.S. Department of Health and Human Services (HHS) as part of a financial assistance award totaling $750,000 with 100 percent funded by CDC/HHS. The contents are those of the authors and do not necessarily represent the official views of, nor an endorsement, by CDC/HHS, or the U.S. Government.

    February 2026