What to know
- The National Center for Health Statistics (NCHS) collects detailed, often highly personal information.
- NCHS takes every possible step to protect the privacy of those who entrust us with their data, and we keep their information confidential.
- Learn about NCHS's commitment to protecting the privacy and confidentiality of information we collect.
Confidentiality and information security
The National Center for Health Statistics (NCHS) treats personal information with the upmost concern for the privacy of the people who entrust their information to us. It's the law, it's good statistical practice, and it's our ethical obligation to the American people.
Federal law prohibits NCHS from releasing personal information from the data we collect. We clearly explain any exceptions to the people and establishment representatives who provide us information (respondents) before they are asked any questions. We tell them if there are any people or organizations other than NCHS that could have access to their personal information.
All respondents can decide—with no pressure—whether they want to participate in NCHS surveys. Respondents also can agree or disagree to how their information will be used and with whom it will be shared.
When respondents choose to provide information, NCHS makes a commitment to follow detailed rules and restrictions to protect their information. In addition, specific laws and policies establish requirements for how we protect data.
Legal restrictions
Section 306 of the Public Health Service Act (42 U.S.C. 242k) is the law that created NCHS and authorized us to collect data. It includes a provision (42 U.S.C. 242m(d)) that prohibits NCHS from—
- Using any personal information for any purpose other than what was described to survey respondents
- Sharing that information with anyone not clearly mentioned to respondents
This provision ensures NCHS can promise respondents strict confidentiality.
In addition, NCHS is subject to—
- Federal regulations to protect people participating in research studies, including surveys and other data collections
- "Fair information practices" to protect against unwarranted invasions of privacy
- Legal requirements protecting confidentiality of information provided to statistical agencies and establishing penalties (stiff fines and imprisonment) for violations
- Section 3572 of the Confidential Information Protection and Statistical Efficiency Act (44 U.S.C. 3561-3583)
- Section 3572 of the Confidential Information Protection and Statistical Efficiency Act (44 U.S.C. 3561-3583)
The Fifth Circuit Court of Appeals has upheld federal laws prohibiting NCHS from releasing personal information to anyone without consent in a case called Akzo-Nobel et al, No. 00-30834 (5th Cir. May 25, 2001). NCHS cannot share personal information with anyone, no matter who they are and no matter how carefully they say they will treat the information.
The restriction on who gets to see personal information extends to even the highest levels of our government. NCHS can deny the president and members of Congress access to confidential information. We also can deny Immigration, Justice, and IRS officials access to this information. In addition, NCHS does not provide data to market research firms, insurance companies, employers, or other private groups.
Protecting data within NCHS
We provide mandatory confidentiality training for new staff and contractors. We also provide mandatory refresher training each year for staff and contractors already working at NCHS. We also fingerprint all new staff.
We require all staff and contractors to sign a legally binding nondisclosure agreement (affidavit) each year. By signing this affidavit, they agree to follow several laws that include stiff penalties for breaking those laws.
We take special security measures that block outside access to confidential information stored on NCHS servers.
We do not allow names, addresses, or any other item that could directly identify a person, organization, or facility to be left on internal files unless absolutely needed.
The NCHS Staff Manual on Confidentiality contains all regulations that NCHS staff and contractors are required to follow.
Ensuring shared data stays confidential
Before information is made public, NCHS removes any information that could lead to identification, like details about jobs, family, births, or residence. This includes information that is not identifying on its own but that could be combined with other data to identify a person, organization, or establishment. We do not release any electronic data without making sure that this information has been removed.
Even when respondents agree to us sharing their information when they give it to us, the NCHS director must approve the release of that information. The recipient also must enter into a binding legal agreement and agree to stiff penalties if they violate the agreement. Even after sharing it, NCHS keeps close tabs on this information. Authorized users of this information must destroy or return it to us within a specified time or as soon as they have finished using it.
We also require anyone who could possibly come into contact with confidential information, like contract company staff working with us, to sign the same legally binding nondisclosure affidavit that our staff sign. They are subject to the same stiff penalties if they break any of the laws protecting information that NCHS collects.
A proven record of information security
Our commitment to your privacy is not just a promise. NCHS has been collecting health statistics since 1957. In all that time, we have not released any confidential information to anyone not entitled to have it. That's not because people haven't asked for personal information. It's because NCHS takes the law and our ethical obligations seriously enough to be vigilant with the information entrusted to us.