To provide efficient, effective public health services and to protect the public’s health, governmental public health agencies gather, analyze, and share data. State, Tribal, local and territorial agencies share data with each other, federal agencies, research institutions, and other organizations to drive community health improvement. For example, data sharing allows health departments to monitor outbreaks of diseases such as Zika and measles; ensure that hospitals meet patient safety standards; and make sure that restaurants prevent food-borne illnesses by following hygiene standards.

Frequently, public health agencies must enter into agreements to share data and, typically, the agency’s attorney prepares the agreement. This resource aims to provide public health managers with guidance on how to work with your agency’s attorney on data use agreements (DUAs).

Public health agency attorneys sit in different departments depending on the jurisdiction. At the local level, the attorney may be in a city or county counsel’s office. Attorneys that support state public health departments and territories are typically located in the state attorney general’s office or in a legal office within the health department.

As sovereign nations, the structure of Tribes’ relationships with their legal counsel vary from Tribe to Tribe. Additionally, some Tribes allow their Tribal Epidemiology Center to negotiate DUAs on behalf of the Tribe; and typically, tribal councils are involved in preparing DUAs.

In some jurisdictions, the attorney may specialize in a specific area supporting the public health agency; however, it is also common for the agency’s lawyer to be a general legal advisor who provides legal counsel on a wide range of issues for a jurisdiction and does not have specific expertise in privacy, data sharing or public health.

  • What is the attorney’s role?

    Attorneys that represent public health agencies aim to assist their clients in meeting their duties to the public, and to protect them from liability and risk. Attorneys collaborate with agency staff to draft DUAs by identifying relevant laws, providing guidance to ensure legal compliance and mitigate risk, and recommending strategies to overcome legal obstacles.

    More broadly, the attorney monitors changes in the law that impact data access and use and works with the agency to revise policies and agreements as needed to comply with the law. Additionally, the attorney may prepare agreement templates and review data requests to determine whether federal, state, and local law and regulations permit the disclosure of the data for the proposed use case.

  • Are my conversations with my attorney confidential?

    Most conversations between a client and their attorney are confidential, which means that the attorney is not allowed to reveal the content or nature of those conversations. Called “attorney-client privilege,” this prevents conversations with an attorney from being produced, for example, in response to government data practices requests or in response to a demand from an opposing party during a lawsuit. This privilege encourages frank and open communication between clients and their attorneys, enabling attorneys to give better legal advice.

    It is important to remember, however, that the attorney-client privilege can be destroyed if you voluntarily share information about your conversations or forward your attorney’s emails to anyone outside of your organization. As with most things, you should talk to your attorney about how to best preserve attorney-client privilege.

    Finally, remember that your attorney has a duty to represent their client—you and your organization—to the best of their ability. Even if they’re asking hard or critical questions, it’s so they can identify and mitigate legal risk. If you engage with your attorney as a partner, emphasizing the public health benefits of sharing data but acknowledging the importance of doing so in full compliance with the law, you and your attorney will be able to quickly move beyond identifying problems and towards finding solutions.

  • What type of information should you gather before a meeting with an attorney?

    To apply the law correctly, the agency’s attorney needs to understand the data use context. When you meet with your attorney, you should be able to answer these questions and others, with specificity:

    • What data is being shared?
    • What is the purpose of sharing the data and how will the data be used?
    • Are secondary uses of the data (i.e., beyond the original requested use) contemplated?
    • Is the data identifiable, quasi-identifiable, or de-identified?
    • Which entities will be receiving data and are those entities planning on sharing the data with other organizations?
    • What is the minimum amount of information needed to achieve the project purpose?
    • How will data be transmitted and stored?
    • Is there a data destruction plan?

    This list is not exhaustive. These resources from the Network for Public Health Law include other questions to consider: 

  • What will my attorney find helpful?

    Most importantly, bring your attorney into the process as early as possible. Legal work can be time-consuming and requires advance notice. It may also be helpful to bring, or to offer to send in advance, background information to your meeting, particularly if the attorney is not a public health law specialist. For example, you could offer to bring or send:

    • A data flow chart that explains where the relevant data comes from, how it is stored, and how it will be transmitted
    • Resources on public health data concepts such as levels of deidentification; small numbers; and aggregated and disaggregated data will be helpful
    • Information on any relevant laws that you know of, and resources on whether HIPAA does and does not apply to your situation

  • Additional Resources

    For additional resources about public health data sharing, see our Resource Round-Up Factsheet.

    Questions?

    For legal technical assistance on public health data sharing agreements reach out to Manel Kappagoda (manel.kappagoda@mitchellhamline.edu) or Tom Pryor (tom.pryor@mitchellhamline.edu) at the Public Health Law Center. This resource is part of a series of factsheets prepared by the Public Health Law Center.

     

    Logos from the Council of State and Territorial Epidemiologists and Public Health Law Center

     

    This resource is part of a series of factsheets prepared by the Public Health Law Center in partnership with the Council of State and Territorial Epidemiologists for public health managers in State, Tribal, Local, and Territorial health departments.

    The development of this resource was supported by the Centers for Disease Control and Prevention of the U.S. Department of Health and Human Services (HHS) as part of a financial assistance award totaling $949,000 with 100 percent funded by CDC/HHS. The contents are those of the authors and do not necessarily represent the official views of, nor an endorsement, by CDC/HHS, or the U.S. Government.