Frequently Asked Questions | HIV Cluster and Outbreak Detection and Response | Guidance | Program Resources | HIV

CDC understands the importance of protecting individuals’ privacy and has put strong security measures in place to ensure that HIV data are protected at CDC and in health departments. HIV data held at CDC are strongly protected by an Assurance of Confidentiality [PDF – 137 KB] under Section 308(d) of the Public Health Service Act. The Assurance of Confidentiality guarantees that all information is held in strict confidence; used only for the purposes stated in the Assurance of Confidentiality; will not otherwise be disclosed or released without the consent of the individual or institution; and that this protection lasts forever, including after death.

As a condition of receiving CDC HIV prevention funding, state and local health departments must comply with strict standards for data security. Those standards require that before any HIV data are sent to CDC, personally identifiable information such as names must be removed, and all data must be encrypted during transfer and when stored.

CDC also provides guidance to state and local health departments on the collection and use of HIV sequence data. To ensure this guidance is followed, CDC requires states to specifically assess protections in place to prevent the release of public health data for any non-public health purpose (including for use in criminal cases), while also requiring states to develop action plans to address any gaps in data protection.

To proactively ensure the privacy of people with HIV, CDC has provided guidance about HIV sequences collected in health departments and CDC. Laboratories conducting genotyping have traditionally used a method called Sanger sequencing. Many labs are now moving to what is called “Next Generation Sequencing” also called “Next-Gen” or NGS.

“Raw” NGS sequences contain more information than Sanger sequences or consensus NGS sequences – like a high-definition version compared with a low-definition version – and could potentially provide more information on direction of transmission compared to Sanger sequences. In the case of HIV surveillance, CDC has decided that this level of detail is not needed for public health purposes, and that Sanger or consensus sequences (which contain the most common base pairs in a given position on a sequence) provide an adequate level of detail for public health purposes without increasing risks of these data being used inappropriately to try and determine direction of transmission. Current HIV data systems only allow for submission of Sanger or consensus sequences; the guidance is intended to address potential future changes in HIV reporting systems.

Furthermore, CDC has provided guidance to health departments that HIV sequence data reported to HIV surveillance programs should not be released to GenBank or other public repositories by health departments or other academic partners without individual consent.