For local and state health departments
A health department succeeds invisibly and is judged on the week it does not. What can be carried is the administrative weight underneath the mission — inspections falling due, follow-ups outstanding, vital records requests on a statutory clock, registry records that disagree. The judgement stays with your sanitarians, investigators and registrars, and identification of individuals never exceeds the purpose their information was collected for.
Inspection frequencies are set in regulation by facility category, and the department is accountable for meeting them whether or not it is staffed to. A missed frequency is a finding, and the arithmetic between the number of facilities and the number of sanitarians rarely works.
Communicable disease follow-up is time-critical and human. An interview has to happen quickly, with somebody who may be frightened, unwell, undocumented, or simply unwilling — and the quality of that conversation determines whether the next case is prevented. It is the least automatable work in government and it is surrounded by an enormous amount of the most automatable.
Vital records run on a statutory clock and on a counter. A death certificate is needed for a funeral, a birth certificate for a school enrolment, and the person at the window is usually having one of the worse weeks of their life.
The registries never fully agree. An immunisation record exists in a provider system, in the state registry, in a school record and in a parent’s memory, and reconciling them is manual work that consumes staff who were hired to do outreach.
And then an outbreak arrives and every one of these becomes secondary to something that consumes the entire department for weeks, after which all of them are further behind than before.
Inspection frequencies, follow-up windows and records deadlines each live in a different system with a different clock, so nobody can produce a single list of what is about to fall out of compliance — and the department finds out from an audit rather than in advance.
That is the failure mode a health department fears most, and it is not a failure of diligence. It is that the obligations are not visible in one place, so prioritisation happens by whoever is loudest or whatever was noticed.
The first act needs no authority: assemble the obligation picture. Every facility with its category, its statutory frequency, its last inspection and its next due date. Every open follow-up with its window and its age. Every records request against its statutory clock. Every grant report against its calendar. One list, sorted by how close each is to failing.
Departments are usually startled by that list, and by how much of it was never at risk of being noticed until it was late.
What can then be carried is the administrative band: scheduling field visits against real availability, chasing a facility that has not returned a corrective action, confirming a records request is complete, reconciling two registry records and reporting the difference, assembling a grant report from data the department already holds.
What never moves: any clinical decision, any case investigation judgement, any determination that a facility passes or fails, any enforcement action, any communicable disease determination, and any identification of an individual beyond the purpose their information was collected for. Those are your professionals’ work and, in several cases, their licence.
Statutory obligations approaching a deadline unnoticed — measured by count of obligations inside a stated window of their due date that were not on anybody’s list before.
Inspection frequency compliance by facility category — measured by share of facilities inspected inside their statutory frequency, computed per category rather than in aggregate.
Field time spent in facilities rather than on logistics — measured by time-on-task sampling for sanitarians, before and after.
Corrective actions outstanding past their own date — measured by count and age of open corrective actions, which is generally unmeasured.
Vital records requests against the statutory clock — measured by elapsed days to fulfilment, and the count approaching or exceeding the deadline.
Registry disagreements surfaced — measured by count of records where two of your own sources differ, reported rather than merged.
Grant report assembly time — measured by elapsed hours from a report becoming due to submission, per funded programme.
any clinical decision, case investigation judgement, communicable disease determination, inspection finding, pass-or-fail determination, enforcement action, or licensure decision. Nothing here identifies an individual beyond the purpose their information was collected for, and nothing contacts a case, a contact, or a patient. Those are your professionals’ work and in several cases their licence.
Facility, inspection, records and registry systems are read through documented interfaces. Nothing becomes a second record of a facility or a person, because a second record in a regulated programme is a finding waiting to happen.
Contact is with facilities and with records requesters — businesses and members of the public transacting with the department. It is never with a case, a contact, or a patient. Communicable disease follow-up contact is your investigators’ work and the logistics around it stop at their door.
Purpose limitation is enforced rather than promised. Information collected for one programme is not reachable for another purpose, and where a proposed use would exceed the purpose the information was collected under, that is refused and reported rather than resolved with a broader interpretation.
And every public-facing surface is built for an old phone with a screen reader, in the languages the department already supports.
A health department holds information people gave under a specific and narrow expectation — often while frightened, often about something they would not otherwise disclose. The single most damaging thing that can happen to public health practice is that people stop being candid, and that follows from information being used for a purpose they did not agree to.
So purpose limitation is architectural rather than a policy line. Information collected under one programme is not reachable for another purpose, and a proposed use exceeding the collection purpose is refused and reported rather than accommodated.
Where HIPAA obligations apply through a Business Associate Agreement, they apply; no certification is claimed and none exists to hold, because HHS does not certify business associates. Where a state communicable disease statute attaches stricter handling, that governs and is agreed in writing.
Department data stays inside your tenancy, on your retention schedule, exportable by you, and is not used to train anything serving another organisation.
And on assurance: an independent SOC 2 Type II attestation is in progress and no report exists yet.
The health officer’s question is whether anything touches clinical or investigative judgement. Nothing does, and the boundary is enumerated with anything unclassifiable routing to a professional by default.
The privacy officer should test purpose limitation directly rather than accept it: ask whether information collected under one programme can be reached for another, and confirm the refusal is structural rather than a configuration somebody could change.
Counsel’s question is the state communicable disease statute, which is frequently stricter than the federal floor and which governs where it applies. That is established in writing during scoping rather than assumed.
The registrar’s concern is the statutory clock on vital records and the handling of records that are restricted by law. Both follow your existing practice.
One programme’s statutory obligations assembled into a single list with a single clock — facilities and frequencies, or records requests, or corrective actions — read-only, with no contact with anybody.
The assembly needs no authority and touches no case. It produces the list sorted by proximity to a statutory date, which most departments have never had in one place.
That list is frequently the whole value and stopping there is legitimate. A department that discovers eleven facilities past their frequency has a staffing and scheduling conversation it can have internally, with no vendor at all.
If it continues, the first grant is one administrative act — usually scheduling or corrective-action chasing — with every professional determination outside it and purpose limitation tested by your privacy officer before anything runs.
Deliberately, and it is the right exclusion. A case interview is a conversation with a frightened person whose candour determines whether the next case is prevented, and it is the least appropriate thing in government to hand to a system. What surrounds it is enormous — scheduling, chasing, records, reconciliation, reporting — and moving that band is what gives an investigator more of the day for the conversation that actually matters.
It can, and that is the risk to weigh most heavily here. Two things bound it: nothing contacts a case, a contact or a patient at any tier, and information is not reachable beyond the purpose it was collected under — structurally rather than by policy. Ask your privacy officer to test the second one rather than accept it. If it cannot be demonstrated, that is a reason to stop.
Correct, and the assembly phase is how you find out whether that is the whole story. If the list shows frequencies missed evenly across categories, it is arithmetic and no arrangement helps. If it shows field staff spending a large share of the day on scheduling, routing and paperwork, some of that is recoverable — and if it shows neither, you have a defensible number for a staffing request, which is worth having on its own.
It would consume the department, and the honest position is that the obligation list is worth most in the period afterwards, when every programme is behind and nobody can say by how much. Nothing here participates in an outbreak response, and nothing should — a response is run by your health officer under emergency authority. What survives an outbreak is knowing exactly which statutory obligations slipped and by how far.