Why trust is load-bearing, not decorative

There is a version of this argument that sounds like sentiment, and a version that is a design constraint. This is the second one.

The mechanism

Consider what the program needs in order to function:

• Behavioral health screening only works if people answer honestly. Someone who believes a positive depression screen will cost them their medication will not report depression.
• Social determinants assessment only works if people describe their actual circumstances. Someone who believes the answers go to a benefits or housing enforcement function will describe different circumstances.
• Toxicology only informs care if an unexpected result leads to a conversation. If it leads to dismissal, the rational patient response is to avoid testing, avoid the clinic, or both.
• Monitoring only helps if people report deterioration. If reporting deterioration produces a dose reduction, nobody reports deterioration.

In every case the failure mode is the same: the program stops receiving accurate inputs, and then produces confident outputs from bad data. That is worse than not running it.

The documented version

This is not hypothetical. Qualitative work with clinicians and pharmacists across three states documented under-prescribing and the “dumping” of long-term opioid patients as responses to monitoring pressure. A cohort study found tapering associated with subsequent termination of care at an adjusted odds ratio of 4.3. Once patients learn that engagement carries risk, they disengage — and they take their information with them.

CDC’s 2022 guideline reflects this in its own reasoning about dismissal: doing so “could have adverse consequences for patient safety, potentially including the patient obtaining opioids from alternative sources and the clinician missing opportunities to facilitate treatment for a substance use disorder.” That is a description of information loss with a body count.

What follows for design

1. Nothing collected for care may be routed to enforcement or eligibility functions. Not as policy — as architecture, so that it cannot happen quietly.
2. Refusing any component must have no consequence for treatment. This is stated on every component page for the same reason.
3. An unexpected result must trigger support, not sanction. If the program cannot commit to that, it should not collect the result.
4. Participants need a route to raise a problem and have it heard, which is one of the things we ask agencies for in engagement.

The uncomfortable implication

An agency that wants both this program and an enforcement pipeline from it cannot have both. Not because we object — though we do — but because the first stops working the moment the second exists, and it stops working in a way that is invisible until the data has already gone bad.

More: principles · data governance.