A public agency funding a health program should see aggregate data: whether the program reaches the people it was meant to reach, whether its components are delivered, whether agreed outcomes are moving, whether results differ by race, insurance or geography, and what population-level drug supply warnings and overdose patterns show. It should not see anyone’s individual screening, toxicology, monitoring or social determinants results.
A recurring design failure in public-health programs is that the funder ends up with a view built for a clinician, because that view already existed and building a second one is work. The result is an agency holding individual clinical detail it has no decision to make with.
What health data should a public agency see?
- Whether the program is reaching the population it was supposed to reach, and who it is missing.
- Whether components are actually being delivered — screening completed, naloxone in homes, deliveries on schedule.
- Whether the outcomes agreed in advance are moving, including the safety measures that would show it failing.
- Whether outcomes differ by race, insurance status or geography within the enrolled population — which has to be looked for deliberately.
- Population-level drug supply warnings and overdose patterns, at a resolution a response can act on.
Every one of those is aggregate. None requires a name.
What health data should an agency not receive?
- Individual behavioral health screening results.
- Individual social determinants assessments.
- Individual monitoring data.
- Individual toxicology results.
- A list of participants and their clinical status.
An agency that receives these acquires risk without acquiring capability: it now holds sensitive information, is exposed to records requests and breach obligations over it, and has no decision that the information improves. And the population learns what the agency holds, which starts the process described in why trust is load-bearing.
The two edge cases worth naming
Evaluation. A real evaluation may need individual-level data. The answer is not to route it to the agency’s operational functions but to an evaluator under an appropriate agreement, with the analysis plan agreed in advance — see pilot design.
Safety. A specific, immediate risk to a specific person is a clinical event with a clinical response, and it goes to a clinician. It is not a reporting flow.
More: data governance.
Frequently asked questions
Can anyone access my medical records without my permission in this program?
The funding agency does not get individual records at all. It receives totals on reach, delivery, outcomes and disparities, and none of those needs a name. When a real evaluation needs individual-level data, that data goes to an evaluator under an appropriate agreement, with the analysis plan agreed in advance. It is not routed to the agency’s day-to-day operations.
Is health data confidential from the agency that pays for the program?
Yes. Individual behavioral health screening results, social determinants assessments, monitoring data, toxicology results and any list of participants with their clinical status stay out of the agency’s hands. Holding them would expose the agency to records requests and breach duties while giving it no better decision to make, and once people learned what the agency held, the trust the program depends on would start to break down.
What happens if someone in the program is in immediate danger?
A specific, immediate risk to a specific person is treated as a clinical event with a clinical response. It goes to a clinician, not into a report for the agency. Safety for one person is handled by the people caring for that person, which keeps the reporting flow to the funder aggregate.