2027 Public Health BS Community Projects: Permission to Use Employer Data
Co-Founder and Chief Data Scientist
Your employer's program records could make a public health BS community project more useful - but access at work is not permission to use those records for a class. A student may need separate approval to receive data, analyze it, submit findings, or show the work in a portfolio.
This guide is for students hoping to build a project around their current job or a community partner. It explains the approvals and privacy checks to complete before choosing a dataset, plus safer ways to meet a course deadline if access is restricted.
Key Things You Should Know
- Get written employer authorization for the specific data, purpose, recipients, and deliverables; a supervisor's support alone may not be enough.
- Ask the university's designated review office whether the proposed activity needs an IRB determination before collecting or analyzing information about people.
- HIPAA recognizes two de-identification methods - Safe Harbor and Expert Determination - but de-identification does not itself grant permission to use employer data.
What permission is needed to use employer data in public health community projects?
Start with permission from whoever controls the data and the proposed use. A site supervisor may approve your project topic but lack authority to release patient records, client files, employee information, or unpublished program results. The employer's privacy, compliance, legal, data-governance, or program office may need to authorize access. The university must separately approve the project as coursework or fieldwork where its policies require it.
Describe the records you want, why they are needed, who will see them, and whether your instructor will receive data or only a summary. Ask whether the employer permits a classroom submission, a public presentation, and a portfolio sample; these are different disclosures.
Existing job access should be used only within your assigned work duties until the additional use is authorized. A publicly available dataset or a partner-approved aggregate report may be a better fallback if permission cannot arrive before the course deadline.
When planning an accelerated public health bachelor's workload, allow time for employer review before promising a data-based deliverable. A short course can end before a routine approval process does.
When do public health student projects require IRB review or approval?
IRB review depends on what the project does, not simply on its label as a class assignment. Under the federal Common Rule, a project may be human-subjects research when it is a systematic investigation designed to develop or contribute to generalizable knowledge and involves interaction with living people or identifiable private information about them.
Some evaluations, quality-improvement activities, and classroom exercises do not meet that definition; institutional rules can still require a formal determination or other ethics review.
Before surveying clients, interviewing staff, extracting identifiable records, or changing services for a study, send a brief protocol to the university's designated IRB or research-compliance office. State the question, intended audience, data source, identifiers, recruitment or access method, and proposed dissemination. Ask whether the employer has its own review process and which institution coordinates review.
Do not make your own exemption determination or assume that removing names after collection cures an earlier approval problem. Plans to publish are relevant context, but publication alone does not determine whether an activity is research.
These approvals remain separate even in advanced study: reducing epidemiology doctorate costs through assistance would not, for example, establish IRB clearance or a right to an employer's records. For a BS project, settle review status and data access before spending time on an analysis plan.
How do HIPAA and FERPA affect employer data used in public health projects?
HIPAA applies to protected health information held by covered entities and their business associates, subject to the applicable rule and circumstances. Working at a clinic does not make every workplace spreadsheet HIPAA-regulated, and being an employee does not authorize a new classroom use of protected health information.
A covered entity's privacy office should determine whether a proposed disclosure is permitted, whether an authorization or waiver is needed, and whether a limited data set with a required agreement is appropriate.
FERPA generally protects education records maintained by an educational agency or institution receiving applicable federal funding. It may matter if a community project uses identifiable student records from a school; it does not automatically govern every record about a college student or every dataset used in a university course.
Schools can also impose contractual and privacy restrictions beyond FERPA. Ask the records custodian which rules apply rather than relying on the dataset's informal name.
Privacy obligations also follow the data into analysis tools. The flexibility discussed in an online biostatistics master's flexibility guide, for instance, says nothing about whether an employer permits uploads to a personal device, cloud service, or course platform. Use only approved storage and software, regardless of your degree level.
A written agreement or approval record should be specific enough that the student, employer, and instructor understand the same project. It may be a formal contract, a site-approved project form, or another document the relevant offices accept. A HIPAA limited data set has particular data-use agreement requirements; an ordinary classroom permission form is not a substitute for them.
Before requesting access, draft these terms for the authorized decision-makers to review:
- Scope: project purpose, permitted records and date range, minimum necessary fields, and whether new data collection is allowed.
- People and systems: approved users, faculty access, storage location, software, transfer method, and restrictions on copying or reidentification.
- Outputs: who reviews drafts, which results may be submitted or presented, rules for small groups, and whether any portfolio use is permitted.
- Closeout: access expiration, retention or deletion requirements, incident reporting contacts, and the process for changing the project.
If an employer will authorize analysis but not let records leave its systems, ask whether the instructor can assess a methods memo and an employer-cleared summary instead. Permission to analyze is not automatically permission to publish. The same access question belongs in any larger applied-project plan, including comparisons of online public health doctoral costs and professional opportunities; tuition and project feasibility are different decisions.
First ask whether individual-level data is necessary. For many BS projects, an employer-produced table of approved counts or rates can answer a program question without giving the student source records. If record-level analysis is necessary, have the data custodian and privacy office specify the permitted method and perform or oversee the transformation before data is shared.
For HIPAA-regulated information, Safe Harbor requires removal of specified identifier categories and no actual knowledge that remaining information could identify someone; Expert Determination requires a qualified expert's documented assessment of very small reidentification risk. Merely deleting names is not either method. For other sensitive data, employer policy and applicable law may require different safeguards.
Check combinations as well as columns: a rare condition, small neighborhood, precise date, or tiny subgroup can make a person recognizable in a community report. Suppress or combine small cells where appropriate, keep the linkage key with the authorized custodian, and review charts and narrative examples for disclosure risk. Even a deidentified extract may remain restricted by an agreement or community expectations.
If safe access is unavailable, compare the project timeline with affordable public health programs with faster schedules only after confirming that the course accepts a public-data or simulated-data alternative; a faster schedule does not remove privacy obligations.
The most relevant preparation combines introductory epidemiology, statistics, research or evaluation methods, community health, and public health ethics. Epidemiology helps students define the population and denominator; statistics supports accurate summaries and uncertainty; evaluation coursework connects measures to a program decision. Community-engagement training helps students ask whether the question and presentation are useful and respectful to the people represented.
Look for assignments that require a data dictionary, a defensible analysis plan, a limitations statement, and a plain-language report - not just software demonstrations.
If you need substantially deeper modeling than a BS course offers, a targeted methods course may be more direct than another full degree. When comparing that route with choosing a budget-friendly online MPH, check the actual methods courses and supervised project requirements rather than assuming the MPH supplies specialized statistical training.
They can, but online delivery does not guarantee that your job qualifies as a project site or that workplace data can enter a learning platform. Ask the program whether it permits employer-based assignments, requires an approved site and supervisor, accepts aggregate-only deliverables, and offers an alternative if employer permission is denied. Confirm deadlines for proposals, synchronous meetings, group work, and any site visits before committing to a project.
While reviewing online public health BS programs, request the current project rubric and data-security policy. A workable arrangement gives the faculty member assessable evidence of your methods without requiring your employer to release restricted records. For example, a documented workflow and approved summary may be feasible when a raw-data appendix is not.
Accreditation is a starting point for checking educational expectations, not proof that every student may use employer data. Verify the institution's accreditation and, if a program cites Council on Education for Public Health (CEPH) accreditation, check the accreditor's current listing for the exact school, unit, or program and the degree covered. An institution's accreditation and CEPH's public health-specific scope are distinct.
Then examine what students actually practice: consent and confidentiality scenarios, secure data handling, community review of findings, limitations reporting, and procedures for consulting an IRB or privacy office. Ask how faculty assess those skills in a project. Resources on checking CEPH accreditation before MPH enrollment can clarify why scope matters, but an accredited MPH listing does not establish the status or project rules of a particular BS.
A carefully documented project can support applications for entry-level program assistant, community health, outreach, or evaluation-support roles. Employers may value evidence that you defined a useful measure, handled data appropriately, checked an interpretation with a supervisor, and communicated findings without exposing participants. Describe your own contribution and its limits; do not imply that a class project made you the organization's lead evaluator.
Some analyst, epidemiologist, or management positions require more advanced methods training, graduate education, or experience. When considering those paths, keep occupation-wide pay figures separate from individual prospects: a public health master's salary outlook is not a salary forecast for a BS graduate or a particular project.
For an entry-level application, an approved, redacted project summary and a supervisor who can verify your work are more persuasive than a claim of unrestricted data access.
What certifications strengthen a public health graduate's data and project skills?
Choose training for a demonstrated gap rather than collecting credentials indiscriminately. Short courses or certificates in spreadsheet analysis, data visualization, evaluation, privacy practices, or project coordination may help a graduate perform specific entry-level tasks. Public health credentials such as CPH or health education credentials such as CHES have separate eligibility rules and exams; a BS or a community project does not automatically award them.
Before paying, check the credentialing body's current eligibility rules and compare the cost with supervised work or a focused course. If your goal is advanced analysis rather than a general credential, compare a short methods sequence against the time and expense described in guides to online public health master's tuition and job prospects. Neither option substitutes for employer authorization to use data.
Other Things You Should Know About Public Health
Only if the employer permits that use. Get approval for the exact version you plan to share, including charts and organization names. If approval is unavailable, describe your methods and skills without reproducing restricted material.
Ask your instructor promptly for a public-data, simulated-data, or literature-based alternative that meets the same learning objectives. Do not copy records first and seek permission afterward.
Follow the employer's written retention terms and the university's applicable rules. Course completion or graduation does not create a personal right to retain workplace records.
Stop further sharing and immediately follow your employer's and university's incident-reporting instructions. Do not assume deleting the message resolves the disclosure; the responsible offices need to assess it.
- Employers and Health Information in the Workplace | hhs.gov https://www.hhs.gov/hipaa/for-individuals/employers-health-information-workplace/index.html
- IRBs | ORI https://ori.hhs.gov/content/chapter-3-The-Protection-of-Human-Subjects-IRBs
- FERPA | Protecting Student Privacy - Department of Education https://studentprivacy.ed.gov/ferpa
- Does My Research Need IRB Review | Rhode Island Small Business Development Center https://web.uri.edu/research-admin/integrity-security/human-subjects/does-my-research-need-irb-review/
- FERPA and Compliance - EVPAA https://www.vpaa.uillinois.edu/resources/policies/ferpa_and_compliance
- Human Subjects Research (IRB) - Master's Projects Handbook https://sites.nicholas.duke.edu/mastersprojectshandbook/resources/client-information/
- Do I Need IRB Review? | Texas A&M University-Corpus Christi https://www.tamucc.edu/research/compliance/irb/review.php
- 3 Model Data Use Agreements: A Practical Guide | mit.edu https://admindatahandbook.mit.edu/book/v1.0-rc2/dua.html
