Attachment 6. Restrictions on Data Release

Attachment 6. Agreement to Abide by the Restrictions on Release of Surveillance Data

Agreement to abide by restrictions on release of surveillance data collected and maintained by the Division of HIV/AIDS Prevention - Surveillance and Epidemiology

I, ___________________________, understand that data collected by CDC through the HIV/AIDS surveillance system and related surveillance activities, projects, and case investigations under Section 306 of the Public Health Service Act (42 U.S.C. 242k) is protected at the national level by an Assurance of Confidentiality (Section 308(d) of the Public Health Service Act, 42 U.S.C. 242m(d)), which prohibits disclosure of any information that could be used to directly or indirectly identify any individual on whom a record is maintained by CDC. This prohibition has led to the formulation of the following guidelines for release of HIV/AIDS case reports and supplemental data collected on such persons to which, in accepting access to data not considered public-use, I agree to adhere. These guidelines represent a balance between potential for inadvertent disclosure and the need for the CDC/DHAP-SE to be responsive to information requests having legitimate public health application. In particular, variables that identify geographic units or facilities have the potential to indirectly identify individuals.

Therefore, I will not release, either inside or outside CDC, State/Territorial, MSA, city or county specific data in any format (e.g., publications, presentations, slides, interviews) without the consent of the appropriate State or local agency, except as consistent with the format described below and presented in detail in the written documentation for the AIDS Public Information Data Set (AIDS PIDS). Specifically, in accordance with the terms of written agreements between CDC, the Council of State and Territorial Epidemiologists (CSTE), and individual State/Territorial health departments AND in accordance with the principles of the Assurance of Confidentiality for HIV/AIDS surveillance and related data authorized under Section 308d of the U.S. Public Health Service Act:

• I am permitted to release national and regional tabulations, from the HIV/AIDS surveillance database in either narrative or tabular format.

• For cases in adults/adolescents > 13 years of age, for MSA’s with greater than 500,000 population, I may release multiple-way cross tabulations of 14 variables using the categories and conditions listed in the current AIDS PIDS for the rectangular data file.

• For any State, the District of Columbia, or MSA with greater than 500,000 population, I may release 2-way cross tabulations of 8 variables using the categories listed in the current AIDS PIDS if cell sizes are all greater than 3. If cells containing information on 3 or fewer cases are produced, I agree to either delete those cells and all summaries using those cells from the table, or insert in any cell of 3 or less, the notation “less than or equal to 3."

• For any MSA with greater than 100,000 population in selected States designated in the current AIDS PIDS, I may release 2-way cross tabulations of 8 variables using the categories and conditions listed in the current AIDS PIDS if cell sizes are all greater than 3. If cells containing information on 3 or fewer cases are produced, I agree to either delete those cells and all summaries using those cells from the table, or insert in any cell of 3 or less, the notation “less than or equal to 3."

• For individual counties or health districts in selected States designated in the current AIDS PIDS, I may release one-way frequencies of 3 variables ( age, race/ethnicity, and sex) subject to the small cell size restriction described above.

• I understand that release of data not specifically permitted by this agreement is prohibited unless written permission is first obtained from the appropriate Branch Chief (HICSB or BCSB), Division of HIV/AIDS Prevention - Surveillance and Epidemiology.

• When presenting or publishing state, city, county, or MSA-specific data in accordance with the restrictions outlined above, I will inform the appropriate state and local health departments in advance of the release of state or local data, so as to afford them the opportunity to anticipate local queries and prepare their response.

• When presenting or publishing data from surveillance-related studies, investigations, or evaluations, I will adhere to the principles and guidelines outlined in this agreement.

I also agree to the following:

I will not give my access password to any person.

I will treat all data at my desk site confidentially and maintain records that could directly or indirectly identify any individual on whom CDC maintains a record in a locked file cabinet. Sensitive identifying information from special case investigations will only be maintained in a locked file cabinet in a locked room which has restricted access.

I will keep all hard copies of data runs containing small cells locked in a file cabinet when not in use, shredding them when they are no longer necessary to my analysis.

I will not produce a “back-up” data file of HIV/AIDS case surveillance data or related databases maintained by DHAP-SE.

I will not remove electronic files, records or databases from the worksite.

I will not remove hard copies of case reports, survey instruments, laboratory reports, confidential communications, or any records containing sensitive data and information or the like from the worksite.

I will not remove from the worksite tabulations or data in any format that could directly or indirectly identify any individual.

I will maintain confidentiality of records on individuals in all discussions, communications, e-mails, tabulations, presentations, and publications (and the like) by using only the minimum information necessary to describe the individual case.

I will not release data to the press or media without pre-screening of the request by the Office of Communications, NCHSTP.

I am responsible for obtaining IRB review of projects when appropriate.

User ID: __________________

Purpose of investigation (provide a brief statement):

Database(s) to be accessed:

Estimated time needed for data access/analysis:

I have read this document, “Agreement to abide by restrictions on release of data...” and the attached document “Release of CDC HIV/AIDS Surveillance and Related Data,” and I agree to abide by them. Failure to comply with this agreement may result in disciplinary action, including possible termination of employment.

Signed: __________________________________ Date: ______________________

(Requestor)

CIO, Division, Branch _______________________________

Approved: ________________________________ Date: ______________________

Chief, (HICSB/BCSB), DHAP-SE, NCHSTP or designee

Revised December, 2003

Attachment 7. Assurance of Confidentiality

ASSURANCE OF CONFIDENTIALITY FOR SURVEILLANCE OF ACQUIRED IMMUNODEFICIENCY SYNDROME (AIDS) AND INFECTION WITH HUMAN IMMUNODEFICIENCY VIRUS (HIV) AND SURVEILLANCE-RELATED DATA (INCLUDING SURVEILLANCE INFORMATION, CASE INVESTIGATIONS AND SUPPLEMENTAL SURVEILLANCE PROJECTS, RESEARCH ACTIVITIES, AND EVALUATIONS)

The national surveillance program for HIV/AIDS is being coordinated by the HIV Incidence and Case Surveillance Branch (HICSB) and the Behavioral and Clinical Surveillance Branch (BCSB) of the Division of HIV/AIDS Prevention - Surveillance and Epidemiology (DHAP - SE), the National Center for HIV/STD/TB Prevention, a component of the Centers for Disease Control and Prevention (CDC), an agency of the United States Department of Health and Human Services. The surveillance information requested by CDC consists of reports of persons with suspected or confirmed AIDS or HIV infection, including children born to mothers infected with HIV, and reports of persons enrolled in studies designed to evaluate the surveillance program. The information collected by CDC is abstracted from laboratory, clinical, and other medical or public health records of suspected or confirmed HIV/AIDS cases; and from surveys that interview persons in recognized HIV risk groups or known to have a diagnosis of HIV/AIDS.

Surveillance data collection is conducted by State and Territorial health departments which forward information to CDC after deleting patient and physician names and other identifying or locating information. Records maintained by CDC are identified by computer-generated codes, patient date of birth, and a state/city assigned patient identification number. The data are used for statistical summaries and research by CDC scientists and cooperating state and local health officials to understand and control the spread of HIV/AIDS. In rare instances, expert CDC staff, at the invitation of state or local health departments, may participate in research or case investigations of unusual transmission circumstances or cases of potential threat to the public health. In these instances, CDC staff may collect and maintain information that could directly identify individuals.

Information collected by CDC under Section 306 of the Public Health Service Act (42 U.S.C. 242k) as part of the HIV/AIDS surveillance system that would permit direct or indirect identification of any individual or institution on whom a record is maintained, and any identifiable information collected during the course of an investigation on either persons supplying the information or persons described in it, is collected with a guarantee that it will be held in confidence, will be used only for the purposes stated in this Assurance, and will not otherwise be disclosed or released without the consent of the individual or institution in accordance with Section 308 (d) of the Public Health Service Act (42 U.S.C. 242m(d)). This protection lasts forever, even after death.

Information that could be used to identify any individual or institution on whom a record is maintained by CDC will be kept confidential. Full names, addresses, social security numbers, and telephone numbers will not be reported to this national HIV/AIDS surveillance system. Medical, personal, and lifestyle information about the individual, and a computer-generated patient code will be collected.

Surveillance information reported to CDC will be used without identifiers primarily for statistical and analytic summaries and for evaluations of the surveillance program in which no individual or institution on whom a record is maintained can be identified, and secondarily, for special research investigations of the characteristics of populations suspected or confirmed to be at increased risk for infection with HIV and of the natural history and epidemiology of HIV/AIDS. When necessary for confirming surveillance information or in the interest of public health and disease prevention, CDC may confirm information contained in case reports or may notify other medical personnel or health officials of such information; in each instance, only the minimum information necessary will be disclosed.

No CDC HIV/AIDS surveillance or research information that could be used to identify any individual or institution on whom a record is maintained, either directly or indirectly, will be made available to anyone for non-public health purposes. In particular, such information will not be disclosed to the public; to family members; to parties involved in civil, criminal, or administrative litigation, or for commercial purposes; to agencies of the federal, state, or local government. Data will only be released to the public, to other components of CDC, or to agencies of the federal, state, or local government for public health purposes in accordance with the policies for data release established by the Council of State and Territorial Epidemiologists.

Information in this surveillance system will be kept confidential. Only authorized employees of DHAP - SE in HICSB, BCSB, and in the Statistics and Data Management Branch (SDMB), their contractors, guest researchers, fellows, visiting scientists, research interns and graduate students who participate in activities jointly approved by CDC and the sponsoring academic institution, and the like, will have access to the information. Authorized individuals are required to handle the information in accordance with procedures outlined in the Confidentiality Security Statement for Surveillance of Acquired Immunodeficiency Syndrome (AIDS) and Infection with Human Immunodeficiency Virus (HIV) and Surveillance-Related Data (Including Surveillance Information, Case Investigations and Supplemental Surveillance Projects, Research Activities, and Evaluations.

Page 8 of 8