2027 A Public Health Internship Data Security Checklist: A Graduate Public Health Portfolio Project
Co-Founder and Chief Data Scientist
A public health internship can produce valuable analysis - and files that should never appear in a student portfolio. Graduate students need a practical way to check permissions before accessing data, protect it during work, and show what they learned without disclosing confidential information. This guide provides an adaptable data security checklist, explains where site rules and HIPAA may apply, and shows how to turn the checklist into a credible portfolio project. Use it with your site supervisor and faculty advisor, not in place of their approval.
Key Things You Should Know
- Build the checklist around three decisions: whether you may access the data, how you must handle it, and what you may retain or show after the internship.
- HIPAA's Safe Harbor method addresses 18 categories of identifiers, but removing them does not automatically authorize sharing a dataset or project output.
- A strong portfolio artifact is an approved, redacted checklist plus evidence of your reasoning - not patient records, screenshots of restricted systems, or an unapproved claim of compliance.
What Is a Public Health Internship Data Security Checklist?
It is a site-specific control document that helps an intern confirm the rules for receiving, using, storing, sharing, and disposing of project data. Its intended users are the student, site supervisor, and, where appropriate, the school's fieldwork coordinator. A useful checklist records a decision, its approving authority, and where the relevant policy or permission can be found; it does not simply collect unchecked promises to "keep data secure."
For a graduate portfolio, the checklist itself can be the deliverable. Unlike a general example developed while planning an online public health bachelor's degree, an internship version must be adapted to an actual host site's systems, agreement, and permitted work. A template demonstrates preparation; only a site-reviewed version can document how a particular placement operates.
Why Does Data Security Matter in Public Health Internships?
Interns may encounter identifiable surveillance records, interview notes, contact information, or small-area results that could reveal a person even without a name. Unauthorized disclosure can harm participants and community trust, disrupt a partner's work, and breach agreements or applicable law. Security therefore affects whether an analysis is appropriate to undertake - not merely whether its final report looks professional.
The rules depend on the data and organization. HIPAA applies to covered entities and business associates, not automatically to every public health dataset; other confidentiality laws, agency policies, contracts, and research requirements may also govern access. A lower-cost education route, including affordable undergraduate public health study, does not change these obligations. The operational question is who controls the data and what that authority permits the intern to do.
What Should A Graduate Public Health Portfolio Project Include?
Scope the project as a usable decision tool, not proof that you audited or secured an entire organization. State its intended setting - for example, an approved internship involving restricted program-evaluation data - and name the supervisor or office that would decide each unresolved issue. Keep the sample generic until the site authorizes its use.
These components make the deliverable assessable by faculty while giving the site a chance to correct it:
- Purpose and boundaries: the project task, data categories, systems in scope, and activities the checklist does not authorize.
- Decision fields: requirement, responsible approver, evidence or policy reference, status, and date reviewed.
- Workflow: checks before access, safeguards during analysis, output review, incident escalation, and end-of-placement disposition.
- Reflection: why particular controls matter, unresolved questions, revisions requested by reviewers, and limits on what the artifact demonstrates.
An accelerated course schedule can constrain revision time; students considering intensive online public health bachelor's classes face a similar planning issue with applied assignments. For a graduate internship, schedule supervisor review before the first data-access date and another review before portfolio submission. Neither course completion nor a polished template establishes site approval.
Protected health information (PHI) is individually identifiable health information held or transmitted by a HIPAA covered entity or business associate, subject to the rule's definitions and exceptions. Ask the host organization's privacy or security contact to classify the records and specify whether the internship task requires identifiable information at all. If an approved aggregate or appropriately de-identified source will answer the question, request that instead.
When access is authorized, use only the organization's approved account, device, storage, transfer method, and minimum data needed for the assigned task. Do not email files to a personal account, paste records into an unapproved AI tool, or keep local copies for a portfolio. HIPAA's Safe Harbor de-identification method requires removal of 18 specified identifier categories and consideration of whether the holder has actual knowledge that remaining information could identify someone; the alternative expert-determination method has different requirements. Neither method overrides a data-use agreement or permission to publish.
Admission through a program with flexible public health master's entry requirements does not replace site-specific privacy training. Interns should complete that training before access, regardless of prior coursework.
CEPH-accredited MPH education includes foundational competencies relevant to responsible data work, such as using evidence, selecting quantitative or qualitative methods, interpreting results, and applying ethical principles. That foundation supports good questions about data quality, confidentiality, and communication. It is not, by itself, a guarantee that every graduate has practiced access administration, secure computing, HIPAA implementation, or incident response.
When choosing an MPH with CEPH accreditation, verify that the specific school, unit, or program and degree are within the accreditor's scope. Then inspect actual assignments and fieldwork arrangements: Can students learn to document data permissions, work in approved systems, and obtain feedback on a privacy-conscious deliverable? Ask who teaches the technical controls if they are outside the MPH curriculum. Site training and supervised practice may be more direct than an additional degree for a narrow security skill gap.
Before opening a file, separate academic approval from data authorization. A faculty advisor can approve learning objectives, while the host site determines access to its systems; a data custodian, privacy office, or review body may need to make additional decisions. Application details such as public health master's recommendation requirements concern entry to a program, not permission to use internship records.
Use this pre-access sequence with the site supervisor and academic coordinator, recording answers and approvers in the checklist:
- Define the question, deliverable, necessary fields, expected outputs, and whether less sensitive data would suffice.
- Confirm placement approval, supervision, required training, data classification, and the authority granting access.
- Check agreements, consent or use restrictions, community or partner permissions, and whether institutional review or an official determination is needed.
- Identify approved accounts, devices, storage, remote-access arrangements, collaborators, and the process for requesting or removing permissions.
- Agree on output review, incident-reporting contacts, retention or deletion rules, and what - if anything - may be shown in a portfolio.
If a decision is pending, mark it pending and do not treat silence as approval. Ask the coordinator whether an alternative, nonrestricted assignment can meet the same learning objectives while access is resolved.
Security must follow the workflow, including temporary files and outputs - not just the original dataset. Analyze within the approved environment; limit access to assigned collaborators; keep identifying keys separate where the site requires it; and document transformations without copying sensitive values into notes. Before exporting a chart or table, check for small cells, revealing labels, geographic detail, or combinations that might identify individuals under the site's release rules.
Reproducible analysis does not require publicly posting restricted data. A student can document methods with a field dictionary that omits sensitive values, a permitted code template, and synthetic test inputs clearly labeled as synthetic. Ask the supervisor to review any proposed export. If data appear in the wrong location or are sent to the wrong recipient, stop further sharing and use the site's incident channel promptly rather than trying to resolve the event alone.
The same access principle applies to doctoral research: comparing public health PhD program costs says nothing about whether a student can obtain a dataset. Access depends on the data holder's approvals and the project's oversight.
Ask for permission to present the artifact before uploading it to a portfolio or sending it to employers. The shareable version might contain a blank checklist, a redacted example of its decision fields, a workflow diagram without system details, and a short account of feedback incorporated. Describe your contribution precisely: "drafted a checklist for supervisor review" is different from "implemented an organization-wide security policy."
Remove names, identifiers, credentials, screenshots of restricted systems, internal contact details, and confidential policy text unless expressly cleared for release. Replacing a name with "Participant A" is not necessarily sufficient if context could identify the person. If the partner cannot approve an excerpt, create a separate generic demonstration and label it as such. This portfolio standard applies whether a student pursued graduate training or low-cost fast-track public health study: demonstrate judgment without claiming access or results you cannot substantiate.
Data security is a supporting skill in epidemiology, program evaluation, surveillance, research coordination, and health-department analysis. Entry-level staff may follow approved access and reporting procedures; experienced analysts may help design reproducible workflows and review outputs. Privacy officers and security specialists have more specialized responsibilities that an MPH internship alone does not establish.
For a job search, translate the portfolio into specific, supervised tasks: identifying an appropriate data classification, documenting approvals, using an approved analytic environment, or preparing an output for review. Job titles and degree expectations vary by employer, so compare postings against the work you have actually performed. Broad earnings outlook for public health master's holders should not be read as the expected pay for a data-security internship or for a particular graduate.
How Should Students Choose A Public Health Program For Data Security?
Choose for the learning opportunity you need, not for a vague promise of "data skills." If your goal is a defensible internship checklist, ask whether the program permits a tool-based portfolio deliverable, how placements are approved, who reviews data-governance questions, and whether students can complete comparable work without access to identifiable records. Confirm these answers for the specific degree and placement rather than assuming every public health program uses the same requirements.
Also compare the practical cost of placements: scheduling, travel, unpaid hours, and any required training or software access. A targeted privacy course, employer training, or supervised project may be a better next step than another degree if you already have the public health preparation you need. Even when exploring online public health doctoral costs and professional opportunities, do not treat advanced enrollment as a substitute for authorization to handle a partner's data.
For the immediate project, take a draft checklist to the prospective site supervisor and faculty advisor. Confirm the fieldwork requirements, assign an owner to each unresolved decision, and obtain explicit approval before accessing data or publishing any site-specific artifact.
Other Things You Should Know About Public Health
Possibly. Check whether your program accepts the proposed deliverable and whether the dataset's license and documentation permit your intended use. A public dataset can reduce access barriers, but it does not demonstrate that you handled restricted records.
Ownership and reuse depend on the placement agreement, employer policies, and any applicable school rules. Ask the site and program before posting or adapting a site-specific version.
No universal answer applies. The activity's purpose and design matter, and a school or host organization may require an official determination even when a student expects the work to be outside human-subjects research.
Respect that decision. Describe your skills without disclosing protected details, or build a clearly labeled generic template using no restricted information.
- Business Associates Frequently Asked Questions (FAQs) | hhs.gov https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
- Data Breach Response: A Guide for Business | Federal Trade Commission https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business
- More than a Password | cisa.gov https://www.cisa.gov/MFA
- Information Security and Privacy Incident Response | utsa.edu https://security.utsa.edu/information-security-incident-response/
- Best Practices: Handling Sensitive Data - UB Libraries https://library.buffalo.edu/research/rds/education/sensitive-data.html
- Practicum Examples | UW School of Public Health https://sph.washington.edu/mph-practicum/examples
- Privacy Incidents | unc.edu https://privacy.unc.edu/incidents/
- Data Encryption on Removable Media Guideline | Information Security Office https://security.berkeley.edu/data-encryption-removable-media-guideline
- De-Identification of Protected Health Information: Methods and Validation Requirements - UW-Madison Policy Library https://policy.wisc.edu/library/UW-114
- Project Close Out | Research Data | Case Western Reserve University https://case.edu/researchdata/research-data-lifecycle-guide/project-close-out
