| Course | HLTH 5023 Legal and Ethical Issues in Public Health |
|---|---|
| Module | Module 4 |
| Paper type | Health data privacy and surveillance analysis |
| Length | 1,150 words, about 4 pages plus title and reference pages |
| Format | APA 7 student paper |
| School | American College of Education |
| Program | Master of Public Health |
| Updated | September 2026 |
Free sample paper for HLTH 5023 Module 4
Names, Contacts and a Shelter's Sign-In Sheet: Health Data, Privacy and Surveillance in a County Tuberculosis Contact Investigation
Student Name
American College of Education
HLTH5023: Legal and Ethical Issues in Public Health
Module 4 Assignment
Instructor Name
October 26, 2026
The Data Problem
The man with infectious tuberculosis described in the earlier modules spent several weeks sleeping at a shelter and a winter warming center before he was diagnosed. To find people who may have been infected, the county health department must conduct a contact investigation, which means collecting names and locations of people exposed to him, evaluating them, and offering testing and treatment. That requires information from the hospital that diagnosed him, from the shelter and the warming center, and from the man himself. Much of it is sensitive: his diagnosis, his housing status, his alcohol use, and the identities of other people who may be living without homes, some of them without legal immigration status.
The department must obtain enough information to protect the public while protecting the privacy of everyone involved. This paper examines the law that permits the data collection, the ethical case for doing it without consent, and the safeguards that should govern it.
Legal Basis for Reporting and Disclosure
Tuberculosis is reportable by name in every state; clinicians and laboratories must notify the health department of each case. The federal HIPAA Privacy Rule, which governs covered entities such as hospitals and clinics, does not stand in the way. A hospital or clinic covered by the rule may release a patient's health information, without asking the patient, to a public health agency that the law empowers to gather such information to prevent or control disease, including for surveillance and investigations (Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required, 2024). The hospital may therefore share the man's diagnosis, test results and relevant history with the county health department without his signature.
Once the information reaches the health department, it is governed by state public health confidentiality law, which generally restricts how the department may use and share case information. The department's authority to collect is broad; its authority to disclose is narrow. That asymmetry is the core of how public health law protects privacy.
Surveillance Without Consent
The law allows surveillance without consent, but is it ethical? Lee et al. (2012) argue that public health surveillance by necessity occurs without explicit consent and set out conditions under which that is justifiable. Overriding individual autonomy must be justified by public health's obligations to improve population health, reduce inequities, attend to vulnerable and disadvantaged people, and prevent harm. The data collected without consent must also be the minimal necessary, must lead to effective public health action, and must be kept secure.
The tuberculosis investigation meets the first set of conditions clearly: finding and treating infected contacts prevents further disease and protects people in shelters, who are among the most vulnerable. The second set, minimal data, effective action and security, depends on how the department conducts the investigation, which is where most of the privacy risk lies. Consent is not required here, and that is precisely why the department's own restraint matters so much.
Conducting the Contact Investigation
National guidelines for tuberculosis contact investigations describe how to prioritize contacts according to the infectiousness of the index patient and the closeness and duration of exposure, with highest priority for those most exposed and those most likely to become seriously ill, such as very young children and people whose immune defenses are impaired (National Tuberculosis Controllers Association & Centers for Disease Control and Prevention, 2005). The guidelines also stress confidentiality: contacts are told that they may have been exposed to tuberculosis, not who the source was.
In practice, the department will interview the man to identify close contacts and places he spent time, then work with the shelter and warming center to identify people who slept near him. Staff will tell contacts only that someone who stayed at the shelter has tuberculosis and that testing is free and confidential. Testing will be offered on site, without asking for identification beyond what is needed to record results and follow up, so that fear of being identified does not keep people away.
Shelter Records and the Minimum Necessary
The shelter's sign-in logs and bed assignments are the most useful source for identifying overnight contacts, but they are also records of people's lives that were not collected for public health. Many shelters are not HIPAA covered entities, and their records may also feed a regional homeless management information system with its own rules. The department should request only what the investigation needs: names and contact details of people who slept in the same room on the relevant nights, not full shelter histories, case notes or other personal information. It should put the request in writing, citing its legal authority, and sign a short data use agreement with the shelter specifying that the information will be used only for the investigation, kept securely and destroyed when no longer needed. The department should state in the agreement, and tell shelter residents, that the information will not be shared with law enforcement or immigration authorities.
Security, Retention and Trust
Security is part of the ethical justification, not an afterthought. Contact lists should be kept in the department's secure surveillance system, not in spreadsheets on laptops or in email. Access should be limited to the tuberculosis program staff working on the case, and every access should be logged. Paper forms from field testing should be entered into the system and shredded within two working days. Records should be kept only as long as state retention rules require.
Trust is the practical reason these steps matter. People experiencing homelessness have many reasons to distrust institutions, and a single breach, such as a contact list left at a shelter desk, could make future investigations far harder. The department's reputation for keeping information confidential is a public health asset that determines whether the next person with a cough comes forward. For that reason, any breach, however small, should be reported to the program manager the same day, and affected people should be told what happened and what the department is doing about it, as state breach rules and simple fairness both require. Hiding a lapse would do more damage to trust than the lapse itself.
Recommendations
The department should adopt five practices for this and future investigations. Request clinical data from the hospital under the public health disclosure provision, limited to what is needed for treatment and investigation. Obtain shelter data through a written request and data use agreement limited to the relevant nights and rooms. Tell contacts about exposure without naming the source, and offer testing without unnecessary identification. Store all data in the secure surveillance system with access logging and scheduled destruction. And publish a short plain-language notice, in the languages spoken at the shelters, explaining what information the department collects during tuberculosis investigations, why, and what it will never do with it.
References
Lee, L. M., Heilig, C. M., & White, A. (2012). Ethical justification for conducting public health surveillance without patient consent. American Journal of Public Health, 102(1), 38-44. https://doi.org/10.2105/AJPH.2011.300297
National Tuberculosis Controllers Association & Centers for Disease Control and Prevention. (2005). Guidelines for the investigation of contacts of persons with infectious tuberculosis: Recommendations from the National Tuberculosis Controllers Association and CDC. MMWR Recommendations and Reports, 54(RR-15), 1-47.
Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required, 45 C.F.R. ยง 164.512 (2024).
The HLTH 5023 Module 4 assignment instructions
In many sections, the HLTH 5023 Module 4 prompt turns to how public health agencies collect, use and protect health information. Prompts typically ask you to describe a data practice, such as disease reporting, contact tracing, a registry or data sharing between agencies, identify the laws that permit and limit it, analyze the ethical issues, and recommend safeguards. Expect to address the HIPAA Privacy Rule's public health provisions and state confidentiality law, and often an ethical framework for surveillance. Graders reward precise statements of what the law permits and practical safeguards over general statements about privacy. Choose a data practice you can describe step by step, and look in Canvas for any required ethical framework or legal sources.
Inside the HLTH 5023 Module 4 example
The example begins with the concrete data problem: what information the investigation needs, from whom, and why each item is sensitive. It explains the legal pathway from the regulation itself and identifies the asymmetry between broad collection and narrow disclosure. A published ethical framework for surveillance without consent is applied, separating what the case clearly meets from what depends on practice. National guidelines shape the investigation steps, including confidentiality toward contacts. The minimum necessary principle is applied to shelter records through a data use agreement. Security and retention rules follow, and recommendations translate each point into a practice.
HLTH 5023 Module 4 rubric: what full marks look like
Privacy and surveillance rubrics usually weigh accurate legal analysis, ethical reasoning, attention to vulnerable populations and practical safeguards. The legal criterion rewards citing the specific provisions that permit or limit the data practice rather than stating that HIPAA applies. Graders credit ethical reasoning that works through the facts with a named framework. Graders look for recognition of who could be harmed by disclosure and how. Safeguards score best when specific, such as data use agreements, access logging and destruction schedules. Transparency toward the public is often rewarded. Proper citation of regulations and guidelines in APA 7 completes the scoring, and a simple diagram of data flows can help graders follow the analysis.
Common HLTH 5023 Module 4 mistakes, and how to avoid them
Privacy papers in public health often lose points by claiming HIPAA forbids sharing with the health department, which is not correct for disease control. Another common gap is treating all data sources alike, ignoring that shelters, schools or employers may not be covered entities. Students also recommend security in general terms. Cite the specific provision. Trace each data flow. Apply the minimum necessary idea to each source. Name who could be harmed and how you will prevent it. An immunization registry, a syndromic surveillance feed or school health records make good subjects too; explain how the data move and share your instructions, and a Module 4 privacy analysis can be built around them.
Write yours, or have the desk draft it
This paper is an original model document written by our desk, not a submitted student paper and not an official American College of Education document. Read it for the moves, then write your own to the instructions in your classroom. If you want one built to your exact prompt and rubric, the first custom sample is free and arrives in 24 to 48 hours.
More HLTH 5023 and Master of Public Health sample papers
- HLTH 5023 Module 1: Legal Authority Analysis
- HLTH 5023 Module 2: Court Case Analysis
- HLTH 5023 Module 3: Public Health Ethics Analysis
- HLTH 5023 Module 5: Policy Recommendation
- HLTH 5063 Module 2: Disease Risk Factor Analysis
- HLTH 5053 Module 4: Risk Communication Plan
- HLTH 5063 Module 1: Disease Biology and Transmission
- HLTH 5043 Module 5: Program Evaluation Plan
HLTH 5023 Module 4 questions, answered
What does HLTH5023 Module 4 usually ask for?
In many sections, the fourth HLTH5023 module centers on one public health data practice, such as disease reporting, surveillance or data sharing, under privacy law and ethics, and to recommend safeguards. Your own section decides which data practice to examine.
Can a hospital share patient information with the health department without consent?
Yes. The HIPAA Privacy Rule permits covered entities to disclose protected health information to a public health authority authorized by law to collect it for disease prevention and control.
Is public health surveillance without consent ethical?
It can be justified when it serves population health and vulnerable groups, uses the minimum necessary data, leads to effective action and keeps data secure.
Where can I find a free HLTH 5023 Module 4 sample paper?
This page carries the full Module 4 analysis of health data, privacy and surveillance in a county tuberculosis contact investigation involving a homeless shelter, with legal basis, ethics, safeguards and recommendations.
Are contacts told who exposed them to tuberculosis?
No. National guidelines emphasize confidentiality; contacts are told they may have been exposed, not the identity of the person with tuberculosis.