(introduction...)

The scope of surveillance may extend either to persons or populations.⁶⁶ Personal surveillance systems often entail active surveillance. In the United States, New York provides an excellent example of an active AIDS surveillance system. When a case report is received by the City or State Health Department, trained surveillance investigators review the medical record at the hospital, clinic, or doctor’s office to extract pertinent demographic, risk, and medical information to complete the report form. In most cases it is not necessary to directly contact the physician or the patient to complete the report. However, surveillance staff must frequently review multiple medical records at different sites to confirm an AIDS diagnosis and to obtain complete case information. In addition, staff follow all cases over time to provide current information on vital status, primarily through periodic reviews of death certificates and computerized death files. Also, cases with no identified risk are followed-up with the health care provider (and, in rare instances, with an interview of the patient or family with the physician’s permission) to identify the source of exposure. Thus, AIDS surveillance is an active, intensive system with ongoing interaction between surveillance staff and health care providers.⁶⁷

Alexander Langmuir, former director of the CDC and widely acknowledged as a seminal figure in the history of surveillance, distinguished such personal surveillance from disease or population surveillance. Infectious disease “surveillance, when applied to a disease, means the continued watchfulness over the distribution and trends of incidence through the systematic collection, consideration and evaluation of morbidity and mortality reports and other relevant data.”⁶⁸ Whereas personal surveillance is contingent on identifying infected individuals, population or disease surveillance, with its broader scope and function, is more flexible and need not necessarily rely on tracking the infected by name. Consequently, population or disease surveillance is often passive - health officials make no efforts to draw additional information from individual reported cases. Indeed, population surveillance data need not be based on identifiable case reports.

Although the potential benefits of surveillance have largely been considered without regard to distinctions between personal and population surveillance, discussion of the potential burdens of surveillance has focused primarily on personal surveillance.

Potential Benefits of Surveillance

Although it has become a mainstay of public health practice, there is little systematic, empirical evidence regarding the benefits of surveillance.⁶⁹ Morris and colleagues argue that “Collecting such information may require substantial resources, but good information should improve the effectiveness of health services in terms of the health outcomes of the patient.” A study of HIV/AIDS surveillance in Great Britain concluded that for such surveillance to be considered cost-effective, surveillance needs contribute only to the prevention of 9.5 new cases of infection each year.⁷⁰ By that standard there was little question that Great Britain’s voluntary coded reporting system was cost-effective. But such an outcome must be understood in the context of a highly sophisticated and integrated national health care system within which an efficient and effective surveillance mechanism is capable of informing public policy functions.

There remain, nonetheless, many potential benefits of surveillance data. Some depend on named reports; others do not. They include monitoring and predicting morbidity and mortality trends in epidemics, determining routes of transmission and potential points of prevention, triggering health care and public health interventions, and guiding policy development and resource allocation.⁷¹ In the case of smallpox, for example, careful nominal surveillance beginning in the 1960s allowed health officials to identify, isolate, and vaccinate the contacts of all new cases, playing an important role in the eradication of the disease in South Asia.⁷² Surveillance has rarely resulted in the initiation of traditional public health interventions like isolation and quarantine in the case of HIV,⁷³ though Cuba provides a striking example of such intervention.⁷⁴ However, In the United States, health department staff in Arizona and South Carolina contact all new cases of HIV infection and offer counselling, referrals to care, or diagnostic services that would indicate the necessity for care.⁷⁵

Personal surveillance is also critical to both voluntary and involuntary partner notification - an important means of identifying individuals at risk of infection.⁷⁶ Yet the personal information needed to contact cases in order to elicit the names of other people who might be at risk of infection depends on infrastructure and administration. The name of the index case may not be necessary to initiate the process of partner notification. As Colfax and Bindman note, “people can identify partners without identifying themselves.”⁷⁷ In Great Britain, for example, genitourinary clinic physicians may carry out partner notification for people with HIV without forwarding the name of the infected individual to surveillance personnel.

The structure of the public health system thus helps to determine the need for named surveillance. The benefits that derive from population surveillance, such as policy formulation and resource allocation, can be achieved entirely without names, although the absence of names may produce problems and complications in the elimination of duplicate reports, the completion of inadequately detailed reports, and of record linkage. In the United States, individual states may require name reporting for various infectious diseases including AIDS and HIV and many local health departments engage in active surveillance. However, the surveillance data the CDC compiles from these state reports - the data that drive both policy and funding in the United States - are stripped of names and based on Soundex.⁷⁸

Whatever the benefits of surveillance, they cannot be cost-free. In contexts where an infrastructure for reporting exists, whether name-based or not, the marginal cost of adding AIDS and HIV will be lower than in circumstances where the public health surveillance infrastructure is weak or less sophisticated. Only when the potential expenditures of surveillance are taken into consideration can the opportunity costs of establishing an AIDS/HIV surveillance system be understood.

Potential Burdens of Named Surveillance

There are two central burdens associated with name reporting which, by definition, entails a violation of privacy: avoidance of testing and counselling by those at risk and refusal to cooperate on the part of health care providers.

Despite oft-expressed fears, evidence on the potential impact of name reporting on care-seeking behaviour is mixed.⁷⁹ Peer-reviewed and anecdotal evidence in industrialized nations suggests that any reporting system that can identify individuals, whether relying on names or unique identifiers, will deter people from seeking testing and treatment.⁸⁰ These studies suggest that anywhere from 22 % to 63 % might avoid testing. Yet this evidence is based largely on self-reported responses to hypothetical situations. Such self-reporting has apparently not translated into significant declines in testing in American states that moved to named HIV reporting.⁸¹ Individuals asserting that named reporting will alter their behaviour, often have limited knowledge of the actual reporting requirements for the states in which they live, leading Coleman and colleagues to conclude that “Any direct influence of HIV reporting policies on testing behaviour is likely to be attenuated by the low level of knowledge participants had of the actual HIV reporting policy of their state.”⁸² The availability of anonymous testing has been associated in at least one study with earlier entry into treatment.⁸³

Although studies in the United States have identified a strong preference for anonymous testing, particularly among high-risk groups,⁸⁴ such preference does not translate into a clear formula for predicting the impact of reporting options on behaviour. Although few individuals living in areas with name reporting seek HIV testing in other areas offering anonymous testing, those who did so presented a different demographic profile and were more likely to be HIV-positive.⁸⁵ The available evidence reflects the social and political capacity of particular populations affected by HIV and AIDS to pursue alternatives. Those who refrain from confidential testing or seek anonymous testing in different localities tend to be gay white men. There is only anecdotal evidence available to suggest that named reporting could have the same impact, at least in the United States, on the impoverished and minority populations in which HIV infection continues to spread.

The relevance of studies that suggest that named reporting might inhibit HIV testing in the clinical context prevailng in advanced industrialized nations is unclear. Many were undertaken in a period when there was little that medicine could offer. These studies do, however, have relevance for nations within which effective antiretroviral and prophylactic therapy is largely unavailable to individuals with HIV infection, and where the motivation to undergo testing may therefore be weaker.

Little is known about why physicians fail to report AIDS or HIV cases. Experience with the reporting of other communicable and especially sexually transmitted diseases suggests that physicians in private offices and clinics often do not report for surveillance purposes. Historically, failure to report has, in various circumstances, been related to a desire to protect patient confidentiality, preserve physician autonomy, and convenience.⁸⁶ Nevertheless, at least in the United States, in comparison to other diseases, AIDS case reporting by name has been remarkably high.

In the United States the cost of nominal AIDS surveillance alone was $35 million in 1992. Such surveillance is made possible only by a public health infrastructure that can support computer equipment, database management, and epidemiological and medical staff who devote time and energy to weeding out duplicate reports and collecting demographic, risk, and clinical profiles for each case from either the reporting hospital or physician. The public health infrastructure must also exist for acting on such information, once it is collected. In Italy, for example, infectious disease surveillance “is burdened by a considerable time-lag before publication ... This makes these data useless for rapid identification of an increase in the frequency of disease ... Moreover, the large number of notifiable diseases (not all worth notifying) overload” practitioners and health departments. “Lack of feedback and work overload” in Italy thus contributes to “a diffuse under-reporting.” ⁸⁷

Even the best name surveillance systems do not eliminate error. Such error may be compounded for HIV or AIDS. Evidence from one American state suggests that more than 10 per cent of HIV surveillance data may draw on false names.⁸⁸

Two solutions have most often been offered as a means of easing the potential and perceived burdens of named surveillance: coded reporting (either by anonymous code or unique identifier) and unlinked sentinel surveillance. Each carries its own benefits and burdens. Neither is cost-free.

Coded Reporting Systems

Encoding is a process where a surrogate identifier (typically, a string of numbers or numbers and letters) is constructed from data elements that describe an individual. In its simplest form, encoding might be based upon all or part of a person’s name, some unique identification number such as social security number or national health system identification number, date of birth, or other elements describing that person. In its most complex form, encoding may be based on the application of a sophisticated algorithm or rule to encrypt the identifying information into a form that is unrecognizable to the observer.⁸⁹ Yet an encoding system to identify individuals does not necessarily produce unique or consistent codes.⁹⁰

Encoding systems typically discussed by American states and used by many western European countries for surveillance purposes are “unique identifier systems”. In Sweden, for instance, the code for HIV reporting is identical to the “prefix for each citizen’s personal identity number. In the case of those with HIV infection, the county of residence and risk group to which the individual belongs are added... The Swedish agency responsible for data control has classified the HIV file as listing ‘identified individuals.’”⁹¹

Anonymous coding systems are also used for HIV and AIDS reporting. In Denmark, for example, physicians submit HIV tests to laboratories on forms with a preprinted serial number. Laboratories then forward the report to the national surveillance unit. Because physicians are required to keep two copies of the report, surveillance officials can call back to gather any data missing from the original report, particularly information related to whether the case is a first-time report. Every time an individual tests for HIV in Denmark, results are reported with a new, unrelated code.

The goal of a unique identifier system, however, is to produce systematically a single, unique code for an individual that can be accurately reproduced each time that person has an HIV test. A system allowing accurate linkage of individual records is essential for an active surveillance system in which individuals are followed over time. Nonetheless, just as no individual’s name is unique, a unique identifier system does not always produce unique codes.⁹²

Unique identifier systems must seek to minimize error resulting from either over-reporting (e.g. counting the same individual more than once, because at different times s/he was assigned different identifiers) or under-reporting (resulting from duplication, assigning the same identifier to two different individuals). The more information that is used to generate the identifiers, the greater the chances that the identifiers will be unique. The drawbacks, however, are that added information increases the burden of creating a unique identifier and may make it easier to identify individuals, thus compromising confidentiality.⁹³

Unique identifier systems, ironically, raise further confidentiality concerns. Gostin and Hodge argue that:

“Because [unique identifier] systems...rely on physicians and laboratories to keep individual logs of reported cases to crosscheck for duplicates, private information about HIV-infected individuals is kept centrally by thousands of private health care providers. Each of these locations must separately maintain adequate security protection to prevent breaches. Security violations, even on a limited basis, can result in the dissemination of intensely private information within local communities where affected individuals may reside.” ⁹⁴

In contrast, almost without exception, AIDS surveillance offices across the United States take measures to secure confidential data.⁹⁵ Advocates of name surveillance also note that “The most stringent legal protections of privacy apply to government-held health information (including records maintained by state and local health departments) and particularly to HIV data.”⁹⁶ It would be difficult to extend effectively such legal protections to data maintained by clinicians and hospitals.

Evaluation of Coded Reporting Systems

Evaluations of coded reporting systems have varied depending on the level of accuracy a nation demands and on the goals of surveillance. Denmark relies on a non-unique coded reporting system that achieves a 95 per cent response rate from physicians, but does not allow record linkage with the AIDS registry containing patient names. From the perspective of the consensus statement issued by European epidemiologists in 1998, the Danish system thus fails to meet an essential criterion for effective surveillance. Nonetheless, this system fulfils the demands of Danish surveillance for the epidemic. Officials report that the new system did place new burdens on laboratory staff, physicians, and hospitals. The estimated cost of this system ($10 000 per year) included only the costs of surveillance staff labour and of printing and mailing the reporting forms.⁹⁷

As noted above, European epidemiologists have voiced satisfaction with the functioning of unique identifier systems and believe they are able to reduce duplicate reports to acceptable levels, permit the linkage of AIDS and HIV records, and provide the kinds of data needed to monitor the epidemic.

In contrast, the United States CDC evaluation of the coded reporting systems in both Texas and Maryland has not produced results which encourage the use of unique identifiers in an active surveillance system. Both states implemented unique identifier systems for HIV reporting in 1994, using an identical 12-digit code created by health care providers before submitting patient blood samples to laboratories for testing. Maryland additionally required providers to maintain a surveillance log to allow easy matching of patient records to unique identifiers during active surveillance. Results were disappointing on three counts: only 44 per cent of providers in Maryland maintained surveillance logs; the match rate with the AIDS registries was 50 per cent in Maryland and between 26 per cent and 60 per cent in Texas; and complete unique identifiers (that is, identifiers missing no elements required to complete the code, such as a portion of the social security number) were available in 94 per cent of cases in Maryland and 62 per cent in Texas.⁹⁸ Because neither AIDS nor HIV surveillance alone provide a complete picture of the HIV epidemic,⁹⁹ the CDC - wishing to link HIV and AIDS registries - commented that these evaluations “indicated that the use of [unique identifiers] limits the performance of an HIV surveillance system and complicates efforts to collect risk behaviour information.”¹⁰⁰

Significantly, however, while Texas accepted the CDC evaluation and adopted HIV name reporting, Maryland rejected the CDC’s position. For Maryland officials, their unique identifier system met the needs at hand even with its limitations, underscoring the importance of political context and the role of competing conceptions of the demands of public health in the creation of standards of judgement.

Unlinked Sentinel Surveillance Systems

In 1989 a report from the United States National Research Council stated:

“Counts of AIDS are out-of-date indicators of the present state of the epidemic. There is a long, asymptomatic latency period between HIV infection and the development of AIDS (in most persons). Consequently the statistics on new cases reflect old cases of HIV infection... The future magnitude of the AIDS epidemic will be determined by the current extent and future spread of HIV infection in the population.” ¹⁰¹

Because mandatory HIV screening was rejected for both ethical and practical reasons, and because studies based on volunteer subjects would inevitably be affected by selection and participation bias, an alternative strategy was necessary. The strategy adopted by the United States CDC, other national public health agencies, and endorsed by the WHO Global Programme on AIDS, involved the use of unlinked anonymous seroprevalence studies - studies in which blood samples drawn for one purpose were stripped of personal identifiers before they were subject to testing. These studies were undertaken in sentinel hospitals, STD clinics, and other clinical settings in an attempt to determine the prevalence of HIV infection in the general population.

The results of such serosurveillance have provided a unique vantage point on national epidemics and as a consequence have been viewed by those opposed to nominal HIV notification as a superior epidemiological tool. While such studies provide clear epidemiological and human rights advantages, they have not been without their problems and limitations. When first initiated, critics asked: Was it acceptable to test blood samples without the consent or even the knowledge of those from whom they were drawn? Was it ethical to so construct surveillance that those who were infected with HIV could not be informed of the fact? Was there a public health obligation to notify those who were infected so that they might modify their behaviour in order to reduce the risk of transmission?

These questions were initially addressed at a time of relative therapeutic impotence, when the treatment of asymptomatic HIV infection in the advanced industrialized nations was primitive at best. As the prospects of early clinical intervention surfaced in wealthy nations and as the treatment of HIV has been moved back to the earliest stages of infection, these questions have taken on new significance for those concerned about the rights of vulnerable populations. Here it becomes clear how therapeutic prospects that prevail in a given nation may have a fundamental impact on the ethics of differing strategies of surveillance.

On methodological grounds, blinded seroprevalence studies are not easy to design and interpret. Surveillance sites must be carefully selected to ensure that the populations that come into contact with them are representative of the larger population. In nations where significant proportions of the population are treated in the “traditional” sector, this requirement may pose insuperable obstacles. Finally, without an epidemiological model of local epidemics, the significance of prevalence at any given moment is not easily interpretable. For example, unchanged prevalence may reflect a dramatic decline in incidence or may simply reflect continued high incidence combined with high mortality. Consequently, accurate AIDS morbidity and mortality figures remain key to interpreting sentinel surveillance data.

B. Human Rights Considerations Raised by Nominal Reporting of HIV/AIDS

Reporting cases of AIDS and HIV infections by name to public health registries raises human rights concerns. At stake is the core issue of whether the goals of public health that are to be served by requiring clinicians to breach confidentiality in making such reports - even to registries that are secured against unwarranted disclosure - justify overriding the claims of medical privacy. The issues are not new to AIDS; they have been raised repeatedly in the context of other disease reporting requirements, especially when the conditions involved were stigmatized.

The broad principles to guide consideration of this issue have been provided by the Office of the United Nations High Commission for Human Rights and the Joint United Nations Programme on HIV/AIDS, in HIV/AIDS and Human Rights: International Guidelines. The guidelines reflecting the Syracusa principles acknowledge that states “may impose restrictions on some rights, in narrowly defined circumstances, if such restrictions are necessary to achieve overriding goods, such as public health [or to protect] the rights of others ... [and] the general welfare...”¹⁰² But for such restrictions to be justified they must be “proportional to [the] interest and constitute the least intrusive and least restrictive measure available...”, be carried out in accordance with the law, and be imposed in a way that is not arbitrary.¹⁰³ Unfortunately, the extremely limited reference to the issues raised by reporting in the Guidelines merely states: “Public health legislation should ensure that HIV and AIDS cases reported to public health authorities for epidemiological purposes are subject to strict rules of data protection and confidentiality.”¹⁰⁴ The reference is thus permissive with regard to reporting, stipulating the necessity of only the most limited and basic of protective conditions. Not confronted is the question of whether the use of names is justifiable or how trade-offs between epidemiological requirements and privacy concerns should be addressed.

More helpful is the observation of Gostin and colleagues in laying out the general principles that should guide the acquisition of data by public health authorities:

“Public health authorities must substantiate the need for a named identifier when collecting information. If they could achieve the public health good as well, or better, without personal identifiers, the collection of non-identifiable or aggregate data is preferable. These data collection principles recognize that government authority to acquire sensitive personal information ought to be justified by substantial public health good that cannot be achieved by means that are less invasive of individual privacy.” ¹⁰⁵

But even these guidelines simply make clear the factors that must be considered in coming to human rights-sensitive conclusions. They do not determine whether, under given circumstances, name-based reporting for AIDS/HIV can be justified.

Implicit in the International Guidelines, and more directly in Gostin’s discussion, is the necessity of answering a series of complex empirical questions as a precondition for human rights analyses: Does effective surveillance require the reporting of AIDS cases or instances of HIV infections? Can the goals of surveillance be achieved only by collection of names? What consequences will follow for the willingness of individuals to be tested for HIV, and to undergo counselling to enter care, if named rather than anonymous reporting is adopted? Do other public health functions such as voluntary partner notification, the assurance of adequate counselling and the provision of care, require the use of names? What level of inaccuracy will be produced by the use of coded versus named reports and how would that level of inaccuracy affect the purposes for which reporting was initiated? What mechanism exists for the protection of the confidentiality of reported names, if they are used, and what is known about its effectiveness? To these critical questions there are no definitive answers that are universally applicable. The answers appropriate in one nation at a given moment may not be appropriate in the same nation at a different time, or in other nations. Much depends on the state of the epidemic, the infrastructural capacity of the public health and medical systems, and the general political culture. In the face of uncertainty, dispute thrives.

How those committed to a human rights perspective can come to different conclusions about whether health care professionals should report the names of their patients to confidential public health registries is demonstrated by the following references to Canada, the United States, and South Africa.

A study prepared for the Canadian HIV/AIDS Legal Network and the Canadian AIDS Society by Ralf Jurgens, HIV Testing and Confidentiality: Final Report, was firm in its conviction that nominal reporting was not necessary for public health, and hence represented an unacceptable restriction on human rights: “To achieve the epidemiological objective of reporting, there are good reasons at this point in the epidemic to require reporting of cases of HIV seropositivity. HIV surveillance can allow us to develop a more accurate picture of the current epidemic and craft a more finely tuned response... However, neither the epidemiological objective of reporting nor the objective of public health measures such as partner notification require nominal reporting.”¹⁰⁶

In radical contrast, Gostin, who has played so central a role in the discussion of the human rights dimensions of the AIDS epidemic globally, has concluded that in the United States, given the state of the epidemic and the record of public health departments in protecting the names of those reported with communicable diseases generally, and AIDS more specifically, name reporting is crucial to public health.

Finally, as noted above, South African human rights advocates have found even in proposals for non-nominal reporting of AIDS an unacceptable intrusion on the rights of privacy.

It is useful to underline that no notification requirement would be justified from a human rights perspective if the registries to which individuals were reported were not protected by confidentiality regimes and were not secured against disclosure for purposes unrelated to public health, e.g. for purposes of unwarranted discrimination or deprivation of liberty. Public health registries must, from this perspective, be governed by “strict rules of data protection and confidentiality.”