Fed HIV Privacy Concerns

Fed HIV Privacy Concerns

AIDS groups charge intensive report effort could compromise confidentiality

Some AIDS groups are objecting to a new HIV data reporting system implemented by the federal Centers for Disease Control and Prevention (CDC) that they charge is burdensome and intrudes into the personal lives of clients.

The CDC is requiring the 65 state or local health departments and roughly 130 community-based AIDS groups that are directly funded by the federal health agency to use its Program Evaluation and Monitoring System (PEMS), a Web browser-based software application, to report on how they are fulfilling their contracts.

For instance, staff at an agency that is funded by the CDC to deliver HIV prevention services would use the software when they interview clients. Each client would be assigned a unique identifier in PEMS and as the clients are counseled over time their answers to questions about their sex lives and drug use would also be input into PEMS. The aggregate data will allow for an assessment of the agency’s performance.

Because all the agencies will be asking the same questions and reporting the data to the CDC in the same format, it will allow the federal agency to compare the effectiveness of the agencies as well as the results of particular prevention methods.

“We can better monitor clients in an agency over time and look at behavioral changes over time, but we can also look at service utilization outcomes,” said Dr. Craig Thomas, the PEMS team lead at CDC. “Because of the standards, we can make comparisons by agency type, we can make comparisons among target populations served by program type, we can look at our counseling and testing programs and identify those that are performing at a high level.”

PEMS could also result in an agency that is performing badly, in comparison to others, losing its CDC funding.

“Down the road that could be something that CDC may pursue,” Thomas said. “It helps identify poor performers. However, we would go in and try to help things, build things back up… If they still aren’t performing after several attempts, they may have to defund.”

PEMS resulted from Congressional Republicans charging that HIV prevention efforts were ineffective and AIDS groups were wasting taxpayer dollars.

“This system will allow us to lay out a very strong argument about how those dollars are being spent,” Thomas said.

Some AIDS groups charge PEMS will not work.

“This program is not going to give us the answers we need,” said Sean Barry, director of prevention policy at the Community HIV/AIDS Mobilization Project (CHAMP), in a press statement. “Data collection that is too hard to do and that conflicts with good and ethical prevention education will not happen in a thorough way. We need to simplify monitoring, and then support real research to track the outcomes of prevention programs.”

CHAMP also objected to the detailed questions in PEMS about the sex lives and drug use of clients.

“We are eager to collect necessary information that will help us continue to improve our prevention efforts, but we share widespread public concern about government monitoring,” said Julie Davids, CHAMP’s executive director, in a press statement. “PEMS prioritizes invasive data collection above the actual work of HIV prevention itself, threatening to turn educators into interrogators and overwhelm already understaffed HIV prevention agencies with paperwork.”

Thomas said that only some clients would be asked those questions and they or the agency can opt out. Failing to provide complete data, however, could have an impact on an agency’s funding. The data will be held on a secure computer and the CDC will be unable to see client names and other identifying information.

But in a Privacy Impact Assessment, dated August 2004 and filed with the U.S. Department of Health and Human Services, the CDC noted, “This phase will not contain client level information in identifiable form. The first phase will not include sensitive information. Sensitive information will be added in the second phase, as identified in the system security plan, and a new PIA will be created during Phase 2 of the project.”

Gay City News found the assessment after its January 17 interview with Thomas.

In response to a follow-up question to Thomas about the second phase of his efforts, an assistant sent an e-mail saying that even at that stage, “No client name or locating information will ever be submitted to CDC, and the client-level data that are submitted to CDC are not in an identifiable form.”

Another issue with PEMS is that 12 of the 65 state or local health departments, including New York, have implemented their own reporting systems. Some agencies, such as the Gay Men’s Health Crisis (GMHC), are faced with the prospect of having to report the same data twice to two agencies, the CDC and the state health department.

Eric Altman, GMHC’s director of program management and quality assurance, said his agency did not object to using PEMS, but it has just trained its counselors and other frontline staff to use New York’s Uniform Reporting System (URS).

“We already collect all the data that PEMS is asking for,” Altman said.

GMHC wants CDC to “extract” its PEMS data from URS. It does not want to have its staff enter the same data into two systems or pay to retrain staff to use a new system.

“It’s not an efficient use of their time and any database conversion involves a lot of training,” Altman said. “If PEMS is the database the state wants to use then that is fine with us as long as we are supported in our conversion.”

All state-funded AIDS groups that use URS and are also getting CDC dollars would be in the same position as GMHC. While the CDC clearly wants all its grantees using PEMS, Thomas said the agency was working with the 12 departments to resolve the issue.

“We don’t want them to have to do this twice,” he said. “We are working very closely with New York and other states so we can insure that we don’t have our community-based organizations entering data into two systems.”