2027 A Public Health Data Sharing Agreement Checklist: A Graduate Public Health Portfolio Project

Imed Bouchrika, PhD

by Imed Bouchrika, PhD

Co-Founder and Chief Data Scientist

What is a public health data sharing agreement checklist project?

It is an adaptable set of questions that a health department, research team, health system, or community partner could use before drafting or approving a data-sharing agreement. Its intended decision-maker might be a data steward deciding whether a proposed transfer is sufficiently defined to send to privacy counsel. The checklist is not the agreement itself, legal advice, or permission to access data.

Choose one plausible use case - such as a proposed transfer of clinic records to a health department for an authorized surveillance activity - and state that it is illustrative. Identify who would supply the data, who would receive it, and what decision the data would support. This narrow scope makes omissions easier to detect than a template that claims to cover every public health exchange.

A student does not need a graduate degree merely to draft a practice template. If you are still choosing your education level, affordable shorter online public health degrees may be worth comparing with targeted privacy training and supervised experience; the right route depends on the role you want, not the checklist alone.

Table of contents

What should a graduate public health data sharing agreement checklist include?

Organize the checklist around the decisions reviewers must make before any transfer. Each question should have space for an answer, an evidence source, a named reviewer, and a status such as confirmed or unresolved. These fields prevent an unanswered question from looking like an approval.

  • Parties and authority: Who owns or stewards the data, who will receive them, who may sign, and what legal or organizational authority supports the exchange?
  • Purpose and data: What public health question will be addressed, which population and period are covered, and what fields are necessary rather than merely convenient?
  • Data classification: Are the records public, identifiable, de-identified, a HIPAA limited data set, or otherwise restricted, and who made that determination?
  • Permitted use: May the recipient analyze, link, redisclose, publish, or share results with subcontractors? What uses are prohibited?
  • Security and incident response: How will data be transferred, stored, accessed, logged, and protected, and whom must the recipient notify if an incident occurs?
  • Lifecycle and accountability: When does access end, what happens to copies and derived files, who handles corrections or disputes, and which approvals remain pending?

Add a short data dictionary as an appendix: proposed field name, definition, source, sensitivity, and reason it is needed. If you need more training in defining and checking analytic fields, online graduate biostatistics options for professionals offer one route, although a focused data-management course may be enough for this deliverable.

How do HIPAA and IRB rules affect public health data sharing agreements?

HIPAA and IRB review answer different questions. HIPAA governs certain uses and disclosures of protected health information by covered entities and business associates. The Common Rule governs covered human-subjects research; an institution's IRB or designated office determines how its review requirements apply. Neither an IRB determination nor a signed agreement, by itself, authorizes every proposed disclosure.

For a HIPAA limited data set, the Privacy Rule requires a data-use agreement with specified permitted uses, recipients, and safeguards.

Other disclosures to public health authorities may follow different HIPAA provisions; a business associate agreement is not automatically the right document for every recipient. Ask the organization's privacy officer or counsel to identify the applicable pathway, along with any state law or contractual restrictions. Do not label data "de-identified" solely because names were removed.

Likewise, do not assume a class project is automatically exempt research - or that every authorized public health surveillance activity is research. Send the proposed activity through the school's required determination process, particularly if it involves identifiable information, systematic investigation, or publication plans.

A doctorate is not needed to make these distinctions; students considering one solely for this skill should weigh public health doctorate affordability and completion time against supervised compliance experience.

What salary and job outlook can public health data professionals expect?

There is no reliable single salary or growth rate for "public health data-sharing professional." That label spans analysts, epidemiologists, data stewards, and privacy staff with different duties and entry requirements. To evaluate an offer, match its actual tasks to an occupation in the U.S. Bureau of Labor Statistics Occupational Outlook Handbook, then check the stated wage year and projection period. An occupation-wide median is not a starting salary or a predicted outcome for a graduate.

For broader context on MPH education and long-term earnings, keep degree-level discussions separate from the pay range of a specific opening. Your location, sector, prior experience, and responsibility for approvals will matter when comparing jobs. The portfolio checklist is strongest as evidence of an applicable skill, not as a salary credential.

Before submitting it, have your instructor confirm the academic requirements and the appropriate privacy or research office confirm any real-world use. Revise the checklist to show which decisions remain with authorized reviewers.

Other Things You Should Know About Public Health

Can I include a completed agreement in my portfolio?

Only with the organization's explicit permission and any required redaction. A blank educational template is usually safer than publishing a signed or partner-specific agreement.

Should the checklist include a signature block?

A template may note which roles would approve an agreement, but avoid a signature block that makes student work look executed or legally effective.

How do I show that my checklist is useful?

Test it against a fictional scenario and document the unclear questions it reveals. Describe that as a walkthrough, not as proof that an organization adopted or validated the tool.

Who should review community-related data uses?

Ask the partner which community representatives or governance bodies should inform the proposed use and communication of results. Legal permission alone does not settle questions of trust or appropriate representation.