Scenario Analysis
This item tests whether you can protect
sensitive personal information collected during a
public health investigation. The outbreak described is consistent with a foodborne illness investigation, likely involving a pathogen such as
Shiga toxin-producing Escherichia coli (STEC), given the acute bloody diarrhea presentation. When a municipality experiences cases across many barangays with no single identified exposure source, the health unit conducts a
case-control study by comparing what ill residents ate with what well residents ate. The completed questionnaires contain not only food histories but also
names and addresses, which are direct identifiers.
Data collected under public health authority for outbreak investigation are not automatically available for secondary research purposes. Under the Philippine legal framework referenced in the scenario,
RA 11332 (Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act) restricts the use of surveillance data to public health purposes. Separately, the
Data Privacy Act of 2012 (RA 10173) classifies health information as
sensitive personal information, which carries a higher threshold for lawful processing and disclosure than ordinary personal data.
Watch out! A common distractor is the belief that removing names and addresses makes the data safe to share. However, even de-identified data from a public health investigation may still be linkable, and the act of releasing the underlying records for a new purpose requires a formal decision by the data controller, not a bedside or field nurse acting alone.
Why the Other Options Are Incorrect
| Option | Why It Fails |
|---|
| 2. Give her copies, since research for public benefit is an allowed use | Public benefit alone does not override the legal requirement for ethics review and authorization from the data holder. The nurse cannot independently determine that the graduate student's thesis qualifies as a permitted use under RA 11332 or RA 10173. |
| 3. Give her copies with the names blacked out | Redaction by the nurse is insufficient. The decision to release data, even in de-identified form, must come from the surveillance unit and an ethics committee. The nurse lacks authority to decide what level of anonymization is acceptable for a separate research project. |
| 4. Let her read the forms in the office, but do not allow copies | Allowing access to identifiable health records, even without copying, still constitutes a disclosure of sensitive personal information. Reading the forms would expose names and addresses to a person without authorized access, violating data privacy principles. |
Applying the Principles to Clinical and Public Health Practice
In field epidemiology, the
case-control study is a standard design when no complete list of exposed persons exists. Investigators interview confirmed or probable cases and compare their exposures with those of controls who did not become ill. The resulting questionnaires are
investigational records, not ordinary research data. They were created under the legal mandate of the public health authority to control an outbreak, not to answer a student's research question.
The nurse's correct action is to refer the student to the unit head, because release of these records requires both authorization from the data-holding surveillance unit and prior review by a research ethics committee. The ethics committee evaluates whether the proposed research purpose justifies the privacy intrusion, what data elements are truly necessary, and whether identifiers can be removed or minimized. This process protects both the residents whose data were collected and the integrity of the public health system.
Key point! In outbreak investigations, the nurse's role is to collect and safeguard data, not to decide who may access it for secondary purposes. Referral to the appropriate authority is the only legally and ethically defensible action.
The surveillance context reinforces this principle. Public health surveillance systems rely on public trust. If residents fear that their personal information will be handed over to students or researchers without proper authorization, they may be less willing to cooperate with future outbreak investigations.
Protecting the confidentiality of surveillance data is therefore not merely a legal formality but a core component of maintaining effective disease detection and response. The nurse safeguards that trust by following the chain of authority and not releasing records independently.