CDC Logo Tuberculosis Information CD-ROM   Image of people
jump over main navigation bar to content area
TB Guidelines
Surveillance Reports
Slide Sets
TB-Related MMWRs and Reports
Education/Training Materials
Ordering Information


U.S. Department of Health and Human Services


Education Materials > Publications > Self-Study Modules on TB > Module 7 > TB Control and Confidentiality

Self-Study Modules on Tuberculosis

Module 7: Confidentiality in Tuberculosis Control

TB Control and Confidentiality

Goals of TB Prevention and Control

The three primary goals of TB prevention and control are to

  • Identify and treat persons who have active TB disease
  • Identify and evaluate exposed contacts, offering appropriate treatment as indicated
  • Test populations at high risk for TB infection and disease in order to detect infected persons, and provide treatment of latent TB infection (LTBI) to prevent progression to active TB

State and local health departments have the primary responsibility for preventing and controlling TB. To meet this challenge successfully, TB control programs should be able to carry out the following core components:

  • Identifying TB cases
  • Ensuring adequate therapy
  • Identifying high-priority candidates for treatment of LTBI
  • Collecting and analyzing data
  • Conducting overall planning and policy development
  • Providing laboratory and diagnostic services
  • Providing training and education

The following section highlights how confidentiality is an essential issue in several of the core components of a TB control program. Health care workers need to be aware of the confidentiality issues that are relevant to patient-health care worker encounters as well as to the collection, management, and sharing of data on TB patients.

Confidentiality in Identifying and Managing TB Cases

Most persons who have TB disease are diagnosed when they seek medical care for symptoms caused by TB or other medical conditions. Reports of suspected or confirmed TB cases are required to be submitted to public health authorities (see Module 8, Tuberculosis Surveillance and Case Management in Hospitals and Institutions).

Cases of TB are reported to federal, state, or local health authorities based upon laws governing the locality. Because TB is considered a significant threat to the public's health, the disclosure of the patient information from the health care worker to a designated public health authority is allowed for the purpose of TB control. In addition to routine case reporting, some TB control programs conduct active surveillance to identify TB cases through laboratory or pharmacy records. Health departments are required to protect the confidentiality of all TB case reports.

Once the information about a suspected or confirmed TB case is transmitted to or obtained by the health department, health care workers use this information to ensure that the necessary steps are taken to treat the patient and halt the spread of disease.

When a TB case report has been submitted, the health care worker should check the TB program database to see if the case has been reported previously. If so, he or she should obtain information about the patient's past clinic visits, chest x-ray reports, adherence history, bacteriology and susceptibility results, and medication history, including the administration of directly observed therapy (DOT). It is crucial that this information be given immediately to the health care worker managing the case to ensure appropriate medical treatment. As confidentiality laws permit, this information may also be shared with others providing direct care to the patient.

If a patient travels or moves from one health jurisdiction to another, the health department of the patient's home jurisdiction should notify the health department for the area to which the patient is moving. It is important that as much information as possible be relayed to the receiving jurisdiction, within the limitations of current laws and regulations governing the confidentiality of records. Health care workers should be aware that legal obligations of confidentiality may vary widely from state to state (see Module 8, Tuberculosis Surveillance and Case Management in Hospitals and Institutions).

Although sharing necessary information between health care workers, health departments, and health jurisdictions is encouraged to protect the health of the patient and the public, information should be shared only on a need-to-know basis. In addition, when sending or faxing information, measures should be taken to ensure confidentiality. For example, any materials sent through the mail should be sent by way of secure mail to the care of a specific person. Health care workers should never fax patient information if they are not sure if the receiving fax machine is in a secure area. Furthermore, all information sent by fax should be sent to a specific person and should be labeled confidential.

Contact investigations and targeted screening for TB are additional ways to identify TB cases. Both these activities require the health care worker to practice confidentiality.

 Confidentiality and Ensuring Adequate Therapy

When a suspected or confirmed TB case has been identified, a treatment plan is made for the patient and the patient's informed consent is obtained (see Module 4, Treatment of Tuberculosis Infection and Disease). The treatment plan usually includes information on

  • The prescribed regimen
  • Monitoring for adverse reactions and response to treatment
  • Ensuring adherence to the regimen, which may involve giving directly observed therapy and various incentives and enablers

It should be made clear from the beginning of treatment that confidentiality of the patient's personal information is an important priority. Health care workers should discuss confidentiality with the patient and determine who, if anyone, will be allowed to know about the patient's care or to participate in decision-making. A trusted family member or close friend can be very valuable in supporting the patient during his or her care; however, in no case should such a person be "recruited" to assist without the patient's request and prior knowledge.

In some cases, the plan for ensuring adherence to the regimen may involve self-administered therapy with occasional visits to the health care worker for monitoring. More often, however, directly observed therapy (DOT) is offered by health department staff to ensure that the patient receives adequate therapy and completes a recommended regimen. DOT involves frequent encounters between the patient and the health care worker, which may take place at sites in the community (for example, the patient's home, workplace, or other locations). Health care workers should make sure that the patient's confidentiality is protected during these encounters. This means that

  • The location chosen should allow private conversations
  • No other persons should be present without the patient's permission
  • Any documents or materials brought to such encounters should be protected from access by unauthorized persons

Occasionally, a TB patient may decide not to cooperate with the health care worker in completing an adequate regimen. When this happens, the health care worker has a responsibility to

  • Review the causes of the patient's nonadherence
  • Identify potential solutions
  • Try to meet the patient's needs to the extent possible to facilitate completion of therapy

If these measures fail, the patient may be required to continue treatment under a court order or even be confined for the duration of treatment. Because the threat to the public's health is serious, an uncooperative TB patient can be quarantined until noninfectious or, in some jurisdictions, committed to a treatment facility. This is a very rare event, which is fortunate because it involves a serious breach of the patient's right to autonomy.

In such a situation, maintaining the confidentiality of patient information is critical. Although disclosure of patient information is necessary to obtain a court order or an order for confinement, such disclosure should be strictly limited to the appropriate government authorities who need the information. Any health department or law enforcement officials who become involved in enforcing such orders should take great care to protect the patient's right to privacy. A breach of confidentiality in these circumstances can further undermine the patient-health care worker relationship and lead to continued resistance to adherence-promoting measures.

Confidentiality and Identifying High-Priority Candidates for Treatment for Latent TB Infection (LTBI)

When a reported case of TB is potentially infectious, a contact investigation is conducted to identify persons who may have TB disease, as well as those who are newly infected with M. tuberculosis. These newly infected persons are high-priority candidates for treatment for LTBI.

When a contact investigation is to be conducted for a reported TB patient, a health care worker should

  • Interview the patient
  • Explain the goals of the investigation
  • Explain why it is important to know the names of contacts
  • Tell the patient about his or her right to privacy
  • Explain the measures that will be taken to maintain confidentiality

Contact Investigations and Confidentiality. Contact investigations pose some unique challenges to maintaining patient confidentiality. Whenever possible, the health care worker should ensure that patient interviews take place under conditions that are private and maintain confidentiality. The patient should be told about his or her rights to privacy and reassured of the measures that will be taken to maintain confidentiality.

The health care worker should be aware that some patients may be reluctant to identify some or all of their contacts. For example, a patient may not want to identify people who use illegal drugs with him or her, or the patient simply may not want his or her friends to know that he or she has TB. In addition, if the patient has contacts who are in the country illegally, the patient may be reluctant to identify contacts for fear they will be reported to immigration authorities. The health care worker should

  • Be sensitive to the patient's fears
  • Explain the importance of screening the contacts
  • Assure the patient that all information, including the patient's name, will be kept confidential and will not be shared with authorities

The health care worker and the patient should decide who will notify the contacts and make appointments for them to receive TB testing at the health department. Some TB patients prefer to notify their contacts themselves, especially when the contacts are family members or close friends. Others prefer that the health worker notify the contacts to protect their privacy; in this instance, the patient should be assured that the contacts they name will not be told who identified them as a contact.

Health care workers should conduct contact investigations without jeopardizing the TB patient's confidentiality. The health care worker should be careful not to inadvertently reveal clues about the TB patient (index case) during contact follow-up. Health care workers can use the following strategies to protect the confidentiality of the patient when conducting a contact follow-up during contact investigations:

  • Gender-neutral language should be used (even if it requires using bad grammar). For example, "Somebody was diagnosed with TB and they were [or "that person was"] concerned about you" instead of "A woman was diagnosed with TB and she was concerned about you."
  • The index case's health care worker, place and dates of diagnosis, or hospitalization should not be mentioned
  • The environment in which the exposure occurred should not be mentioned. For example, "You have been around somebody who has TB" instead of "You have been around somebody at work who has TB."
  • The dates of exposure should not be specified
  • When following-up on interjurisdictional referrals, the county or state that initiated the referral should not be mentioned
  • Confidentiality should not be violated even if contacts refuse to be evaluated until they have been told the index patient's identity

In addition, HIV/AIDS programs conduct partner notification to identify and counsel the sexual and needle-sharing contacts of HIV-infected persons; this notification is confidential and depends on the voluntary cooperation of the patient. When an HIV-infected person is diagnosed with TB disease, health care workers should explain what a contact is for the purpose of TB investigations and assure the patient that his or her name and HIV status will be kept confidential.

In a situation where an outbreak of TB has occurred or when a contact investigation is conducted in a work site or institutional setting in which numerous contacts may have been infected, maintaining confidentiality is challenging. Sometimes, a contact guesses the identity of the source case and it becomes difficult to contain rumors. In addition, a friend, family member, or co-worker of the patient may divulge information about the patient to others. Patients should be counseled that despite the health care worker's best efforts, sometimes confidentiality is not preserved. The patient and the health care worker should discuss this possibility and be prepared to address this issue in the event that patient confidentiality is not maintained. To prevent breaches in confidentiality, patients should be counseled to inform only persons they trust about their diagnosis and to ask these persons to safeguard that information.

Testing and Confidentiality. Testing for TB infection may be mandatory for specific groups of people. In health-care facilities or other institutional settings (for example, homeless shelters, correctional facilities, drug-treatment centers, AIDS clinics or hospices, homes for the mentally ill), residents and employees may be required to participate in an ongoing tuberculin skin-testing program. In such situations, testing procedures should be designed and records maintained in such a way that confidentiality is protected. It should not be obvious to other residents or patients that a person is being evaluated because of a positive skin-test reaction.

Confidentiality measures are not only important in testing high-priority candidates for LTBI, but are also relevant in providing and monitoring treatment for LTBI. Treatment for LTBI should be offered to persons with a positive skin-test reaction or a high likelihood of infection with M. tuberculosis according to current guidelines and recommendations.

Confidentiality and Conducting Other Core Activities

In addition to identifying TB cases, ensuring adequate therapy, and identifying high-priority candidates for treatment for LTBI, TB programs are responsible for

  • Collecting and analyzing data
  • Conducting overall planning and policy development
  • Providing laboratory and diagnostic services
  • Providing training and education

Confidentiality is important in several of these core activities, including collecting and analyzing data with patient-identifiable information. TB control programs develop specific policies to ensure the security and confidentiality of TB records and should train staff members in procedures for maintaining and carrying out these policies. Policies and procedures should be in place to protect all TB reports, records, and files containing patient names or other identifying information. An example of a form used for the protection of persons with reported cases of TB, used at the federal level, is included in Figure 7.2.

Figure 7.2 This is an Assurance of Confidentiality Patient-Identifiable Information by the CDC.

Local policies regarding the security and confidentiality of such information, especially HIV test results, must adhere to all laws applicable in state and local jurisdictions. These protections should include the use of TB surveillance databases such as CDC's Tuberculosis Information Management System (TIMS). These databases are encrypted to protect information during transfers of data for reporting purposes. Although such databases allow for the collection and storage of personal identifiers such as names and street addresses for local and state TB surveillance purposes, these identifiers are not transmitted to CDC. In general, any surveillance information sent through the mail should be stamped "confidential," addressed to a specific person (or sent to that person's attention), and sent by secure mail. These precautions will help to limit unauthorized access to surveillance information.

Because HIV infection and AIDS can have serious implications for TB control, some health jurisdictions have specific rules and regulations for the sharing of information between TB and HIV/AIDS programs. AIDS is a reportable disease in every state. The requirements for reporting HIV infection differ from state to state, and health care workers should be familiar with local reporting requirements. HIV reports are held in strictest confidence and in many jurisdictions are protected by statute from subpoena. For clinical care purposes, HIV-related information should be shared between TB health care workers and other health care workers in accordance with state and local laws.

The sharing of surveillance information between HIV/AIDS programs and TB programs within the same health department is necessary to conduct both TB and HIV/AIDS surveillance programs and to allow for adequate investigation of TB and HIV/AIDS cases. In general, TB surveillance programs and staff should adhere to the same confidentiality standards as HIV/AIDS surveillance programs and should work with local HIV/AIDS programs to establish equivalent data confidentiality systems. Sharing information on HIV serostatus with persons outside the HIV/AIDS and TB surveillance programs of the same health department should only be done with the informed consent of the patient.

Program evaluation reports serve as a basis for policy development and are often shared with appropriate public, private, and community groups. TB programs collect and analyze

  • Morbidity rates
  • Trends
  • Demographic characteristics of the TB patient population in the area
They also assess program performance by determining the rates for
  • Completion of therapy
  • Contact identification
  • Initiation and completion of treatment for LTBI

Program evaluation reports should never include patient-identifiable information, such as names, addresses, or even detailed demographic information if such information allows the determination of a patient's identity.

Study Questions 7.13-7.17

7.13. Why is disclosure of patient information allowed for case reporting that is required by law?

7.14. How should health care workers protect confidentiality during DOT encounters?

7.15. What information should the health care worker explain to a patient regarding the protection of confidentiality during a contact investigation?

7.16. What are some strategies that a health care worker can use to protect the TB case's (index case's) identity when conducting a contact follow-up during contact investigations?

7.17. Explain how other program activities, especially those involving data collection and analysis, require adequate measures to provide data security and protect confidentiality.


Case Study 7.3
Ms. Rita Ramirez, a young mother of two children, has been diagnosed with infectious TB. She is also infected with HIV, which she contracted through sexual contact with her current partner, an HIV-infected injection drug user. Ms. Ramirez works in a factory that assembles small parts for electronic appliances; there are over 250 workers at the plant. She is very concerned about her job security, having only recently begun work on a temporary basis. Ms. Ramirez has consented to a treatment plan including a DOT regimen and is willing to cooperate with the contact investigation. She will inform her household contacts, but does not want anyone at work to know she has TB disease.
  • Why is it important to protect the confidentiality of Ms. Ramirez' information?
  • What steps should be taken to ensure that confidentiality is maintained?



Released October 2008
Centers for Disease Control and Prevention
National Center for HIV/AIDS, Viral Hepatitis, STD, and TB Prevention
Division of Tuberculosis Elimination -

Please send comments/suggestions/requests to:, or to
CDC/Division of Tuberculosis Elimination
Communications, Education, and Behavioral Studies Branch
1600 Clifton Rd., NE - Mailstop E-10, Atlanta, GA 30333