Source: CDC.gov | Updated February 2025

Why Privacy and Confidentiality Matter in Public Health

When you share health information with public health agencies, you trust that it will be handled with care and respect. The Centers for Disease Control and Prevention (CDC) takes that trust seriously. In accordance with federal laws, CDC is committed to protecting the privacy and confidentiality of all information it collects, uses, or shares.

This commitment isn't just policy—it's a promise. Whether you're participating in a research study, receiving public health services, or your data is included in disease surveillance efforts, CDC has safeguards in place to keep your information secure.

At Crestwood General, we align with these same values of privacy and ethical data handling in all our patient care and community health initiatives. Learn more about our approach to patient privacy at https://crestwoodgeneral.com/.

Understanding Privacy: Your Rights Under Federal Law

Privacy means you have control over your personal information. CDC follows key federal laws to ensure your rights are protected.

HIPAA: Protecting Your Health Information

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule sets national standards for protecting individually identifiable health information, known as Protected Health Information (PHI).

Key protections include:
- Your right to access, review, and request corrections to your health records
- Requirements for healthcare providers and insurers to explain how your information may be used or shared
- Limits on when PHI can be disclosed without your written permission

Importantly, HIPAA includes exceptions that allow public health agencies like CDC to receive health information without individual authorization when it's needed to prevent or control disease, injury, or disability. This balance protects both individual privacy and community health.

Learn more about HIPAA from the U.S. Department of Health and Human Services: HHS: HIPAA Privacy Rule

FERPA: Safeguarding Student Records

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records, which may include health information collected by schools.

Under FERPA:
- Parents (and eligible students over 18) can inspect and request amendments to education records
- Schools generally cannot disclose personally identifiable information from these records without written consent
- Limited exceptions exist for health and safety emergencies or specific public health activities

FERPA applies to all schools receiving funds from the U.S. Department of Education. CDC works with educational partners to ensure compliance when student data supports public health efforts.

More information: U.S. Department of Education: FERPA

Understanding Confidentiality: Extra Protections for Sensitive Data

While privacy focuses on your rights to control information, confidentiality refers to how organizations handle the data they hold. CDC uses two powerful legal tools to strengthen confidentiality protections.

Certificates of Confidentiality (CoCs)

Certificates of Confidentiality protect people who participate in research by legally prohibiting the disclosure of identifiable or potentially identifiable research information.

What this means in practice:
- Researchers with a CoC cannot be forced to reveal participant identities or sensitive data in court cases, legislative hearings, or other legal proceedings
- Identifiable information cannot be shared with anyone not directly involved in the research
- Limited exceptions exist, such as when disclosure is required by law (e.g., reporting certain infectious diseases) or when the participant gives explicit consent

All CDC-funded research that collects identifiable information automatically receives CoC protection as a condition of the award—no separate application needed. This includes grants, contracts, cooperative agreements, and CDC's own intramural research.

Researchers must inform participants about these protections and their limits. This transparency helps people make informed decisions about joining studies.

Learn more: NIH: Certificates of Confidentiality

Assurances of Confidentiality (AoCs)

For non-research public health activities—like disease surveillance, outbreak investigations, or program evaluations—CDC may issue an Assurance of Confidentiality under Section 308(d) of the Public Health Service Act.

Key features of an AoC:
- Identifiable information collected under an AoC can only be used for the specific purpose described at the time of collection
- Disclosure without consent is prohibited unless required by law or explicitly authorized by the individual or institution
- This protection helps build trust with communities and encourages participation in critical public health efforts

AoCs are especially valuable when collecting sensitive data about behaviors, conditions, or experiences that people might hesitate to share without strong confidentiality guarantees.

How CDC Puts These Protections Into Practice

CDC's Privacy and Confidentiality Unit (PCU) provides expert guidance, training, and oversight to ensure compliance across all CDC programs and partnerships. Their work includes:

Consulting with CDC staff, grantees, and public health partners on privacy requirements
Issuing Assurances of Confidentiality for approved public health activities
Educating state, Tribal, and local health departments on HIPAA, FERPA, and other federal privacy laws
Supporting ethical data collection, storage, and sharing practices

These efforts help ensure that public health advances never come at the cost of individual rights.

What This Means for You

Whether you're a patient, research participant, student, or community member, these protections support your right to:

✅ Know how your information will be used
✅ Control who can access your personal data
✅ Participate in public health efforts with confidence
✅ Seek recourse if you believe your privacy rights have been violated

If you have questions about how CDC handles your information, or if you're involved in a CDC-funded project and need guidance on privacy compliance, reach out to the CDC Privacy and Confidentiality Unit: cdccoc@cdc.gov

Resources for Further Learning

CDC: Scientific Integrity and Privacy
https://www.cdc.gov/scientific-integrity/privacy-confidentiality.html
HHS Office for Civil Rights: Health Information Privacy
https://www.hhs.gov/hipaa/for-individuals/index.html
CDC and HHS: HIPAA Privacy Rule and Public Health Guidance
https://www.cdc.gov/phlp/publications/topic/hipaa.html
CDC Grants Policy: Additional Requirement 36 (Confidentiality)
https://www.cdc.gov/grants/additional-requirements/ar-36.html
National Institutes of Health: Human Subjects Protections
https://www.nih.gov/research-training/human-subjects-protections
Crestwood General: Patient Privacy and Ethical Care
https://crestwoodgeneral.com/

A Shared Commitment to Trust and Transparency

Public health depends on data—but data depends on trust. By upholding strong privacy and confidentiality standards, CDC ensures that communities can partner in health protection without fear of misuse or exposure.

At Crestwood General, we believe ethical data practices are foundational to quality care. Whether serving individual patients or supporting population health, we prioritize transparency, consent, and security in every interaction.

Your information matters. Your trust matters. And protecting both is at the heart of responsible public health.