0920-0488 2009 Supporting Statement

Restrictions on Interstate Travel of Persons

(42 CFR Part 70)

(OMB Control No. 0920-0488)

Request for Extension

February, 2009

Contact:

Anne O’Connor

Office of Policy and Planning

National Center for Preparedness, Detection, and Control of Infectious Diseases

Centers for Disease Control and Prevention

1600 Clifton Road, N.E., MS C-12

Atlanta, Georgia 30333

Phone: (404) 639-1042

Fax: (404) 639-3039

Email: [email protected]

Restriction on Travel of Persons

(42 CFR Part 70)

(OMB Control No. 0920-0488)

This is a request for extension of a currently approved Information Collection Request (ICR). This ICR is scheduled to expire February 28, 2010. This ICR does not contain any revisions to the currently approved data collection instrument. Please note that CDC is requesting an extension to this ICR to permit data collection while the regulations at 42 CFR 70 are being revised. CDC will submit a revision request for this ICR with the revised regulation.

A. Justification

1. Circumstances Making the Collection of Information Necessary

Section 361 of the Public Health Service Act (42 USC 264) (Attachment 1) authorizes the Secretary of the Department of Health and Human Services to make and enforce regulations necessary to prevent the introduction, transmission, or spread of communicable diseases from foreign countries into the United States, or from one State or possession into any other State or possession. Regulations pertaining to preventing the importation and spread of communicable diseases from foreign countries (42 CFR Part 71) are administered by the Centers for Disease Control and Prevention (CDC). Regulations pertaining to interstate control of communicable diseases (42 CFR Part 70) (Attachment 2) are also administered by CDC.

Regulations found at 42 CFR Part 70 require that a person who is in the communicable period of cholera, plague, smallpox, typhus, or yellow fever or who, having been exposed to any such disease, is in the incubation period thereof, request a permit from the Surgeon General or his/her designated representative to travel from one State to another, if that State has a requirement for such a permit. The regulations further require that the master of a vessel or a person in charge of a conveyance engaged in interstate traffic, on which a suspected case of communicable disease develops shall notify the local health authority at the next port of call, station, or stop, and take such measures to prevent the spread of the disease as the local health authority directs.

Privacy Impact Assessment

Overview of the Data Collection System: The data collection system for this information collection request consists of a one page paper form for 42 CFR 70.3, 42 CFR 70.4, and 42 CFR 70.5. The form will be completed by either the traveler (requesting a permit to travel) or master of a vessel or conveyance (reporting an ill passenger). The form and accompanying physician’s diagnosis will be sent to CDC in the most expeditious manner possible.

Items of Information to be Collected: This information collection involves information in identifiable form, including name, date of birth, Social Security Number (SSN), mailing address, phone numbers, medical information, and email address.

Identification of Website(s) and Website Content Directed at Children Under 13 Years of Age: There is no website for this data collection.

2. Purpose and Use of Information Collection

Control of disease transmission within the United States is largely considered to be the province of State and local health authorities, with Federal assistance being sought by those authorities on a cooperative basis, without application of Federal regulations. The regulations at 42 CFR Part 70 were developed to facilitate Federal action in the event of large outbreaks requiring a coordinated effort involving several States, or in the event in inadequate local control. While it is not known whether, or to what extent, situations may arise in which these regulations would be invoked, contingency planning for domestic emergency preparedness is not uncommon. If a domestic emergency occurs, the reporting and record keeping requirements contained in the regulations will be used by CDC to carry out quarantine responsibilities as required by law, specifically, to prevent the spread of communicable diseases from one State or possession into any other State or possession. The information would only be collected when it is required, and is the minimum necessary to meet statutory obligations. One form is proposed for use in collecting essential information (Attachment 4).

42 CFR Part 70 has 3 sections with reporting requirements:

• 42 CFR 70.3: Personal identifying information and medical information pertinent to obtaining a permit to travel between States and/or possessions. This information would be submitted to the Health Officer of the State, possession, or locality of destination (if such permit is required under the law applicable to the place of destination) and to CDC.

• 42 CFR 70.4: Personal identifying information and information about symptoms exhibited by a person who becomes ill while engaged in travel between states and/or possessions. This information would be submitted to the health authority at the next port of call, station, or stop and to CDC.

• 42 CFR 70.5: Personal identifying information and medical information pertinent to obtaining a permit for travel between States and/or possessions of any person who is the communicable period of cholera, plague, smallpox, typhus, or yellow fever, or who, having been exposed to any such disease, is in the incubation period thereof. This information would be submitted to the Surgeon General or the Surgeon General’s designated representative.

Privacy Impact Assessment Information

This data is being collected to fulfill regulatory requirements under 42 CFR Part 70. The data will be used by CDC to prevent the spread of communicable disease from one State or possession to another State or possession. Use of the information collection is described on the form. Data will become part of CDC Privacy Act System 09-20-0171, “Quarantine and Traveler-Related Activities, Including Records for Contact Tracing, Investigation, and Notification under 42 CFR Parts 70 and 71”, and may be disclosed to appropriate State or local public health departments and cooperating medical authorities to deal with conditions of public health significance; to private contractors assisting CDC in analyzing and reviewing records; to investigators under certain limited circumstances to conduct further investigations; to organizations to carry out audits and reviews on behalf of HHS; to the Department of Justice for litigation purposes; and to a congressional office assisting individuals in obtaining their records. An accounting of the disclosures that have been made by CDC will be made available to the subject individual upon request. Except for these and other permissible disclosures expressly authorized by the Privacy Act, no other disclosure may be made without the subject individual’s written consent.

Highly sensitive information is being collected and would affect a respondent’s privacy if there were a breach of confidentiality. However, stringent safeguards are in place to ensure a respondent’s privacy including authorized users, physical safeguards, and procedural safeguards. Authorized users: A database security package is implemented on CDC’s computer systems to control unauthorized access to the system. Attempts to gain access by unauthorized individuals are automatically recorded and reviewed on a regular basis. Access is granted to only a limited number of physicians, scientists, statisticians, and designated support staff of CDC or its contractors as authorized by the system manager to accomplish the stated purposes for which the data in this system have been collected. Physical safeguards: Access to the CDC facility where the mainframe computer is located is controlled by a cardkey system. Access to the computer room is controlled by a cardkey and security code (numeric code) system. Access to the data entry area is also controlled by a cardkey system. Guard service in buildings provides personnel screening of visitors. The computer room is protected by an automatic sprinkler system, numerous automatic sensors are installed, and a proper mix of portable fire extinguishers is located throughout the computer room. Computer files are backed up on a routine basis. Hard copy records are stored in locked cabinets at CDC headquarters and CDC Quarantine Stations which are located in a secure area of the airport. Procedural safeguards: Protections for computerized records includes programmed verification of valid user identification code and password prior to logging on to the system, mandatory password changes, limited log-ins, virus protection, and user rights/file attribute restrictions. Password protection imposes user name and password log-in requirements to prevent unauthorized access. Each user name is assigned limited access rights to files and directories at varying levels to control file sharing. There are routine daily back-up procedures, and secure off-site storage is available. To avoid inadvertent data disclosure, measures are taken to ensure that all data are removed from electronic medical containing Privacy Act information. Finally, CDC and contractor employees who maintain records are instructed to check with the system manager prior to making disclosures of data. When individually identified data are being used in a room, admittance at either CDC or contractor sites is restricted to specifically authorized personnel. Privacy Act provisions are included in contracts and the CDC Project Director, contract officers and project officers oversee compliance with these requirements.

3. Use of Improved Information Technology and Burden Reduction

Reporting requirements imposed by the regulations have been reduced and streamlined by reliance upon State and local health departments to manage most situations occurring within their jurisdictions. If submission of information under these regulations becomes necessary, all information may be submitted in the most expeditious manner practical. At this time, there are no plans for electronic data submission.

4. Efforts to Identify Duplication and Use of Similar Information

These regulations have been in existence for many years, either under the administration of the Food and Drug Administration or the Centers for Disease Control and Prevention (since 2000). There is no duplication of data.

5. Impact on Small Businesses or Other Small Entities

Small transportation businesses (e.g., independent bus lines, limousine, and taxicab companies, ferry lines, tour operators, air taxi operators, etc) may be affected by this data collection. The information requested has been kept to the absolute minimum in order to minimize the public burden. CDC has also combined the reporting requirements for all three sections into one easy to use form.

6. Consequences of Collecting the Information Less Frequently

Information will only be collected when it is essential to protect the public’s health. Further reduction of required reporting would prevent CDC from meeting its legislative mandate, thereby endangering the public’s health.

7. Special Circumstances Relating to the Guidelines of 5 CFR 1320.5

This data collection complies with 5 CFR 1320.5.

8. Comments in Response to the Federal Register Notice and Efforts to Consult Outside the Agency

A. A 60 day Federal Register Notice was published in the Federal Register on November 30, 2009, vol. 74, pp. 62574 (Attachment 3). There were no public comments.

B. There have been no consultations with persons outside of CDC. In 1992, Drs. David Kessler (FDA) and James Mason (CDC) agreed to consolidate CDC’s and FDA’s quarantine regulations within one agency, CDC. The consolidation was not effectuated until June 20, 2000 when the Commissioner of the Food and Drug Administration signed the paperwork to transfer regulations from their existing location in 21 CFR Part 1240 into a new location next to CDC’s Foreign Quarantine regulations in 42 CFR Part 71. The transfer was a straightforward administrative process that was announced in the Federal Register.

9. Explanation of Any Payment or Gift to Respondents

No payment is made to any respondent.

10. Assurance of Confidentiality Provided to Respondents

This information collection request has been reviewed by the CDC Information Collection Review Office (ICRO). The ICRO has determined that the Privacy Act does apply to this information collection request. The applicable System of Records Notice is 09-20-0171.

Information submitted will be entered into a computer system for analysis and later retrieval if necessary. Data containing personal identifiers and source documents will be retained until the event prompting the collection of data has concluded. Data not containing personal identifiers will be retained indefinitely for statistical and historical documentation purposes. Electronic media will be protected by adequate physical, administrative, and procedural safeguards to ensure the security of the data. Access will be restricted to agency employees with a bona fide “need to know” in order to carry out the duties of their positions or to accomplish the purposes for which the data were collected. When information is deleted, a special “certified” process will be used to completely overwrite tapes on the mainframe or overwriting (not merely deleting) microcomputer files. Source documents, printouts and thumb drives will be safeguarded by storing them in locked cabinets in locked offices when not in use.

Privacy Impact Assessment Information

A. This data collection is subject to the Privacy Act. The applicable Systems of Records Notice is 09-20-0171.

B. Electronic media will be protected by adequate physical, administrative, and procedural safeguards to ensure the security of the data. Access will be restricted to agency employees with a bona fide “need to know” in order to carry out the duties of their positions or to accomplish the purposes for which the data were collected. When information is deleted, a special “certified” process will be used to completely overwrite tapes on the mainframe or overwriting (not merely deleting) microcomputer files. Source documents, printouts and thumb drives will be safeguarded by storing them in locked cabinets in locked offices when not in use.

C. Respondent’s indicate their consent by their signature on the form. Use of the information collection is described on the form. The data will be used to track disease patterns. Data will become part of CDC Privacy Act System 09-20-0171, “Quarantine and Traveler-Related Activities, Including Records for Contact Tracing, Investigation, and Notification under 42 CFR Parts 70 and 71”, and may be disclosed to appropriate State or local public health departments and cooperating medical authorities to deal with conditions of public health significance; to private contractors assisting CDC in analyzing and reviewing records; to investigators under certain limited circumstances to conduct further investigations; to organizations to carry out audits and reviews on behalf of HHS; to the Department of Justice for litigation purposes; and to a congressional office assisting individuals in obtaining their records. An accounting of the disclosures that have been made by CDC will be made available to the subject individual upon request. Except for these and other permissible disclosures expressly authorized by the Privacy Act, no other disclosure may be made without the subject individual’s written consent.

D. The response to the data collection is mandatory if the traveler wishes to obtain a special permit to travel. The permit will not be issued without a completed form. The master of a vessel/conveyance is required by regulation to inform the local health authority.

11. Justification for Sensitive Questions

The form used in these data collections requests the traveler’s social security number (SSN), date of birth, mailing address, phone number, and email address. If a domestic emergency occurs, the reporting and record keeping requirements contained in the regulations will be used by CDC to carry out quarantine responsibilities as required by law, specifically, to prevent the spread of communicable diseases from one State or possession into any other State or possession. The purpose of obtaining this unique identifier is to enable CDC to accurately identify and track the traveler in the event of a public health emergency. The information would only be collected when it is required, and is the minimum necessary to meet statutory obligations. Completion of these fields is mandatory on the form.

12. Estimates of Annualized Burden Hours and Costs

A. Because of the uncertainty about whether a situation will ever arise precipitating CDC’s enforcement of these regulations, the following data collection burden estimate was prepared using the article Smallpox: An Attack Scenario, Tara O’Toole; Emerging Infectious Diseases, Vol. 5, No. 4, Jul-Aug 1999 (Attachment 4). This article describes the aftermath of a hypothetical bioterrorist attach using smallpox virus. Of the potentially 15,000 persons infected with smallpox, the data collection assumes that one-fourth of these would apply for a permit to move from one State to another while in the communicable period of or having been exposed to smallpox, under the requirements set forth in 42 CFR 70.5. During such an event, it is assumed that an additional 2,000 persons not infected with smallpox may, as a precautionary measure, be required to obtain a State permit in order to move from one State to another, and that 8 States would be involved, under the requirements set forth in 42 CFR 70.3. Further, it is assumed that during such an event, the master of a vessel or person in charge of a conveyance may be required to notify a local health authority of as many as 1,500 suspected cases of communicable disease developed and/or observed during transit, involving as many as 20 State or local jurisdictions, under the requirements set forth in 42 CFR 70.4.

In such a scenario, it would be likely that CDC would obtain for follow-up and analysis any information it requires to be delivered to a State or local health authority. Accordingly, an additional burden may be imposed upon this authority to copy and transmit that information. We assume that the burden would apply to 100% of the information submitted under both 42 CFR 70.3 and 42 CFR 70.4.

Estimated Annualized Burden Hours

Regulation	Respondent	Number of respondents	Number of responses per respondent	Average burden per response (in hours)	Total burden (in hours)
42 CFR 70.3 Application to the State of destination for a permit	Traveler	2,000	1	15/60	500
42 CFR 70.3 Copy of material submitted by applicant and permit issued by State health authority	Attending physician State health authority	2,000 8	1 250	15/60 6/60	500 200
42 CFR 70.4 Report by the master of a vessel or person in charge of conveyance of the incidence of a communicable disease occurring while in interstate travel	Master of a vessel or person in charge of a conveyance	1,500	1	15/60	375
42 CFR 70.4 Copy of material submitted to state or local health authority under this provision	State health authority	20	75	6/60	150
42 CFR 70.5 Application for a permit to move from State to State while in the communicable period	Traveler Attending physician	3,750 3,750	1 1	15/60 15/60	938 938
Total					3,601

B. The cost to respondents was calculated using the May 2006 National Industry-Specific Occupational Employment and Wage Estimates data from the Bureau of Labor Statistics (www.bls.gov), the most recent data available. In 2006, the average hourly wage was $18.84. We used this value to calculate the cost for travelers. State/local health authority respondents were considered to have an average hourly wage of $47.60 (50% of physicians at $80.70 and 50% medical records technicians or equivalent at $14.49). The master of a vessel or person in charge of a conveyance is considered to have an average hourly wage of $44.52, based on an estimate that 50% of travelers will use air transportation (pilot = $67.49); 10% will use a water vessel (captain = $27.36); 10% will use rail transportation (engineer = $29.74); 20% will use bus transportation (bus driver = $15.89); and 10% will use private transportation (average wage = $18.84). The average hourly wage for an Internal Medicine physician was $80.70.

Estimated Annualized Burden Costs

Regulation	Respondent	Total Burden Hours	Hourly Wage Rate	Total Respondent Cost
42 CFR 70.3 Application to the State of destination for a permit	Traveler	500	$18.84	$9,420
42 CFR 70.3 Copy of material submitted by applicant and permit issued by State health authority	Attending physician State/local health authority	500 200	$80.70 $47.60	$40,400 $9,520
42 CFR 70.4 Report by the master of a vessel or person in charge of conveyance of the incidence of a communicable disease occurring while in interstate travel	Master of vessel or person in charge of conveyance	375	$44.52	$16,695
42 CFR 70.4 Copy of material submitted to state or local health authority under this provision	State/local health authority	150	$47.60	$7,140
42 CFR 70.5 Application for a permit to move from State to State while in the communicable period	Traveler Attending physician	937.5 937.5	$18.84 $80.70	$17,662.50 $75,656.25
Total				$176,493.75

13. Estimates of Other Total Annual Cost Burden to Respondents or Record Keepers

None

14. Annualized Cost to the Government

Each report results in action taken by Quarantine staff to respond to the report. Their action is determined by the statutory and regulatory requirements for each report. The action taken varies, depending on the specifics of the report, from filing and/or data entry to conducting an investigation involving multiple staff. CDC estimates the yearly cost for this information collection request to be $100,000.

15. Explanation of Program Changes or Adjustments

This is a request for extension with no changes to burden or respondents.

16. Plans for Tabulation and Publication and Project Time Schedule

Data are not collected for statistical purposes, but only to meet the legislative mandate as implemented in 42 CFR Part 70.

17. Reason(s) Display of OMB Expiration Date is Inappropriate

Not applicable

18. Exceptions to Certification for Paperwork Reduction Act Submissions

There are no exceptions to the certification.

B. Collections of Information Employing Statistical Methods

Data in the information collection request are not collected using statistical methods.

Regulations at 42 CFR 70 require that a person who is in the communicable period of cholera, plague, smallpox, typhus or yellow fever or who, having been exposed to any such disease, is in the incubation period thereof, request a permit from the Surgeon General or his/her designated representative to travel from one State to another. Supporting medical information is also required when requesting this permit.

The regulations also require that a person who has a communicable disease request a permit from the State of destination to travel from one State to another, if that State has a requirement for such a permit. Supporting medical information is also required when requesting this permit.

The regulations further require that the master of a vessel or person in charge of a conveyance engaged in interstate traffic, on which a case or suspected case of a communicable disease develops, shall notify the local health authority at the next port of call, station, or stop, and take such measures to prevent the spread of the disease as the local health authority directs.

Submission is by paper form or by alternative means (telephone, fax) of conveying data that has been entered onto a paper form. A copy will be sent to CDC for use in analyzing, coordinating, and maintaining control over the situation that caused imposition of the regulatory requirements.

Attachments

Attachment 1: 42 USC 264: Public Health Service Act

Attachment 2: 42 CFR 70

Attachment 3: 60 day Federal Register Notice

12