Disease Surveillance & Privacy

Disease reporting is required by law, not patient choice. 

Disease surveillance is the ongoing collection and analysis of health data to stop the spread of disease before it becomes an outbreak (Lee 2014). MO law requires doctors, hospitals, laboratories, and school administrators to report specific diseases to the Department of Health and Senior Services (DHSS) (19 CSR 20-20.020, RSMo 192.020). Reportable diseases include those that spread from person to person, like measles, and those spread by insects, like Lyme disease.  

Informed consent requires providers to explain to patients how their medical data will be used and obtain their written agreement before proceeding (Klingler et al. 2017). Patients retain the right to refuse. Federal law requires informed consent for personal doctor visits or participation in medical research but specifically excludes public health surveillance by health officials (Department of Health and Human Services 2024, Beach et al. 2020). If individuals were to withhold their data, official case counts would be incomplete, disease detection would fail, and health officials could not detect outbreaks in time to respond (Lee 2014, Fairchild & Bayer 2016).  

MO limits mandatory health data collection to a defined list of diseases, organized by urgency.  

Providers report only the minimum information needed to detect and respond to a specific list of about 130 diseases grouped across five reporting timelines (19 CSR 20-20.020, Table 1). For each case, this includes the affected person’s name, age, sex, address, and specific diagnosis. How fast a provider responds depends upon how dangerous the disease is and how quickly it spreads. Immediately reportable diseases spread easily, have high death rates, or pose a national security risk. Within one to three days, providers must report serious diseases that spread more slowly or require rapid but not immediate health responses. Weekly and quarterly reporting applies to diseases tracked for trend analysis rather than immediate outbreak response. MO law requires reporting of any newly identified diseases if it spreads easily, causes high death rates, or threatens economic stability, even if it is not on the defined list. 

MO laws protect individual privacy and data security.  

MO uses strict confidentiality laws to protect health data collected through disease reporting (19 CSR 20-20.075, RSMo 192.067). These records are not available to the public. Health officials may only use this data for specific public health purposes (19 CSR 20-20.075): 

• Finding the source of an outbreak.  
• Monitoring how a disease spreads and analyzing trends. 
• Counseling patients and providing vaccines. 
• Restricting public activities when necessary to stop a disease from spreading. 

MO may also share data with medical researchers or release it to the public as general health statistics, but only after it has been processed so no individual person, provider, or medical facility can be identified (19 CSR 20-20.075, RSMo 192.067). 

Local health agencies and independent contractors must maintain data security systems as strong as the state's, train and monitor their workers on privacy rules, and immediately report any security breaches to DHSS (19 CSR 20-20.075).  

Table 1. MO Disease Surveillance Reporting Timelines and Categories. The MO Code of State Regulations (CSR) sets reporting deadlines for communicable diseases depending on how quickly they can spread. For all reported cases, mandated reporters submit only the affected person’s name, age, sex, address or county, and specific diagnosis. Health data are confidential, protected under state privacy regulations, and restricted to authorized public health operations. Based on 19 CSR 20-20.020 and 19 CSR 20-20.075.

References 

Beach MC, Lederman HM, Singleton M, Brower RG, Carrese J, et al (2020) Desperate Times: Protecting the Public from Research Without Consent or Oversight During Public Health Emergencies. Annals of Internal Medicine 173(11). https://doi.org/10.7326/M20-4631  

Confidentiality of Information Obtained for Reporting of Communicable, Environmental and Occupational Diseases and Conditions (2026) MO Code of State Regulations (CSR) 19 § 20-20.075. https://www.sos.mo.gov/adrules/csr/current/19csr/19csr#19-20 

Department of Health and Human Services (DHHS) (2024) Protection of Human Subjects. 45 C.F.R. § 46. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46  

Fairchild AL, Bayer R (2016) In the Name of Population Well-Being: The Case for Public Health Surveillance. Journal of Health Political Policy Law 41(1): 119 – 28. https://doi.org/10.1215/03616878-3445650  

Klingler C, Silva DS, Schuermann C, Reis AA, Abha S, et al. (2017) Ethical Issues in Public Health Surveillance: A Systematic Qualitative Review. BMC Public Health 17(1): 295. https://doi.org/10.1186/s12889-017-4200-4  

Lee L (2014) Health Information in the Background: Justifying Public Health Surveillance Without Patient Consent. In: Pimple KD, editor. Emerging Pervasive Information and Communication Technologies: Ethical Challenges, Opportunities, and Safeguards. Series 11. Springer Science. P 39 - 53. https://doi.org/10.1007/978-94-007-6833-8_3 

Reporting Infectious, Contagious, Communicable, or Dangerous Diseases (2026) MO Code of State Regulations (CSR) 19 § 20-20.020. https://www.sos.mo.gov/adrules/csr/current/19csr/19csr#19-20  

Revisor of Missouri § 192.020 (2016). https://revisor.mo.gov/main/OneSection.aspx?section=192.020&bid=33362&hl=  

Revisor of Missouri § 192.067 (2019). https://revisor.mo.gov/main/OneSection.aspx?section=192.067&bid=47908&hl=