Supporting Statement A 20 Nov Epi-X

Supporting Statement Section A

Centers for Disease Control and Prevention (CDC) Secure Communications

Network (Epi-X)

0920-0636

Date: October 28, 2010

Program Officials:

Mark Wooster, PhD

Health Scientist

Phone: 404-639-3227

Fax: 404-639-2633

[email protected]

Marinda Logan, MPH

Health Scientist

Phone: 404-639-5974

Fax: 404-639-7977

[email protected]

James Schwendinger, MPH

Health Communications Specialist

Phone: 404-639-4520

Fax: 404-639-3903

[email protected]

Charles Shepherd, MA

Policy & Planning Specialist

Phone: 404-639-4342

[email protected]

1. Justification

1. Circumstances Making the Collection of Information Necessary

Background

The classification of this Information Collection (IC) is as a revision of the State-Based Evaluation of the Alert Notification Component of CDC’s Secure Communication Network,

Epidemic Information Exchange (Epi-X) OMB Control No.0920-0636. We are requesting a title change to read -- Centers for Disease Control and Prevention (CDC) Secure Communications Network (Epi-X)

This IC is also being revised to improve the effectiveness of CDC communications with its public health partners during public health incident responses. These partners include public health officials and agencies at the state and local level.

From 2005-2009, CDC conducted incident specific, public health emergency response operations on average of four public health incidents a year with an average emergency response length of 48 days for each incident. The effectiveness and efficiency of CDC’s response to any public health incident depends on information at the agency’s disposal to characterize and monitor the incident, make timely decisions, and take appropriate actions to prevent or reduce the impact of the incident.

Available information during many public health incident responses is often incomplete, is not easily validated by state and local health authorities, and is sometimes conflicting. This lack of reliable information often creates a high level of uncertainty with potential negative impacts on public health response operations.

Secure communications with CDC’s state and local public health partners is essential to de-conflict information, validate incident status, and establish and maintain situation awareness. Reliable, secure communications are essential for the agency to gain and maintain accurate situation awareness, make informed decisions, and to respond in the most appropriate manner possible in order to minimize the impact of an incident on the public health of the United States.

The Epidemic Information Exchange (Epi-X) is CDC’s Web-based communication system for securely communicating during public health emergencies that have multi-jurisdictional impact and implications. The incidents of September 11, 2001 illustrated the need for an encrypted and secure communications system that would permit CDC to communicate urgently with partners at the state and local levels, and to notify them 24/7, when necessary. Similarly, Epi-X was specifically designed to provide public health decision-makers at the state and local levels a secure, reliable tool for communicating sensitive, unusual, or urgent public health incidents to neighboring jurisdictions as well as to CDC. The system was also designed to generate a request for epidemiologic assistance (Epi-Aid) from CDC using a secure, paperless environment.

 

Epi-X designers have developed functionalities that permit targeting of critical outbreak information to specific public health authorities who can act quickly to prevent the spread of diseases and other emergencies in multi-jurisdictional settings, such as those that could occur during an influenza pandemic, infection of food and water resources, and natural disasters.

CDC has recognized a need to expand the use of Epi-X to collect specific response related information during public health emergencies. The proposed data collection instruments (Attachments 3-9) are designed to ensure ready access to public health and disease epidemiology information based on the most common public health incident scenarios. Respondents will be informed of this data collection first through an Epi-X Facilitator, who will work closely with Epi-X program staff to ensure that Epi-X incident specific IC is understood. The survey instruments will contain specific questions relevant to the current and ongoing public health incident and response activities.

 

Authorized Officials from state and local health departments impacted by the public health incident will be surveyed only by Epi-X as a web-based communication system.

Dissemination of information during public health emergencies is an integral part of the overall mission of the CDC and is authorized by the Public Health Service Act (42 USC 241) (Attachment 1).

Privacy Impact Assessment

The most recent PIA for Epi-X was done in 2009.  

 

Overview of the Data Collection System

Data collected under the Epi-X IC will use a web-based tool. This tool already is established for the current IC and has been in use since 2003. It will be adapted as needed to accommodate the data collection instruments described in Attachments 3-9. Respondents will receive the survey instrument as an official CDC email, which is clearly labeled, “Epi-X Emergency Public Health Incident Information Request” The e-mail message would be accompanied by a link to an Epi-X Forum discussion web page. Respondents could choose to provide their answers to the survey questions by posting information within the discussion.

The information collected will be maintained indefinitely. Issues related to data security, confidentiality and informed consent are described below.

Items of Information to be Collected

This IC covers organizational or jurisdictional level data elements (i.e. data elements collected from state, local, tribal, and territorial levels of government and non-governmental organizations) that may be qualitative or quantitative. These data elements may be collected during the emergency (data elements related to response phase of the emergency) and after the emergency (data elements related to the recovery phase of the emergency) for intentional and non-intentional public health threats.

Categories of data elements that may be collected under this revised IC may include, but are not limited to: data elements pertaining to infectious diseases, natural or manmade mass casualty incidents, environmental health, informatics, biosurveillance, evaluation of health communication messaging, and Strategic National Stockpile materiel. Example of data elements categories includes:

Communicable Diseases: signs and symptoms questions (e.g. signs and symptoms of influenza-like illness or other signs and symptoms of the disease of interest, symptom onset), exposure history, travel history (including commercial conveyance information), vaccination status, medical history, plans for further travel during infectious period, travel companion information including vaccination status, plans for further travel during the incubation period; flight or vessel information; tracking of treatment or prophylactic measures and adverse incidents to vaccination or medications; laboratory results; disease outcomes.

Manmade Mass Casualty Incidents: circumstances of incident (e.g., explosion, structural collapse, fire, plane crash and train crash); mechanisms of injury (e.g., inhaled: toxic gas/fumes, particulate matter; burned by: explosion, secondary fire, chemical, unknown; and struck by fixed object: pushed or knocked against object).

Environmental Health: shelters (e.g., security/law enforcement availability, hot water availability, safety of food source, availability of hand-washing facilities, adequacy of water supply, safety of water source, reported outbreaks, unusual illness/injuries, adequate number of toilets, sewage system type, adequate number of collection receptacles, adequate child/caregiver ratio, adequate number of cots/beds/mats, adequate spacing, presence of companion animals, and handicap accessibility); chemical exposures (e.g., proximity to the site of release, personal exposure description, medical history, occupational history, description of acute health effects immediately after release, personal protection equipment worn by responders or hospital workers); radiological exposures (e.g., exposure location, potential routes of contamination, radiation assessment, prodromal symptoms, radiation countermeasures; rapid response registry: (e.g., registrant information, proxy or close friend/relative information, exposure information); exacerbation of chronic medical conditions; availability of routine pharmaceutical supplies (e.g., medications for chronic medical conditions).

Informatics: demographics (e.g. location, size, geographic coverage) of healthcare entities (e.g. hospitals, emergency departments, laboratories, pharmacies); healthcare entity information/data transfer resources and capabilities; types and volume of data available.

Biosurveillance: syndrome definitions and algorithms, number of outpatient and emergency department visits; demographic information of cases, including geocoded data; patient disposition; hospitalization rates, ICU utilization, medical supplies availability, hospital census reports; mortality rates; laboratory test orders and results; treatment protocols, types of surveillance systems, surveillance methods (e.g., telephone) and tools (e.g., secured data network (SDN) used.

Evaluation of Health Communication Messaging: receipt of CDC communications (including messages and guidance) by partners during emergency incidents, helpfulness of messages and guidance, clarity of messages and guidance, how and if messages and guidance were used.

Strategic National Stockpile¹ Materiel: types of adverse reactions to countermeasures, number of adverse reactions in the affected area, number of cases, types of symptoms, Investigational New Drug (IND) patient information for hospitalized patients (e.g. laboratory results and medical history), medical countermeasure dashboard activity (e.g., pharmaceutical and medical supply manufacturers, distributors and retailers), current inventory on hand, disposition of the inventory, how inventory was stored, sub recipients of the materiel (e.g., Indian Health Service, community health centers, local public health departments, other health facilities), which sites were delivered to, and how many people received the materiel.

Identification of Website(s) and Website Content Directed at Children Under 13 Years of Age

Epi-X as a secure web-based communication has limited access to only authorized federal, state, and local public health officials. Epi-X doesn’t use cookies to store any user info. The Secure Data Network (SDN) uses SM cookies for authentication persistence, which are destroyed immediately after a user logs out or times out. The Epi-X privacy policy and user agreement are on the Epi-X webpage (Attachment 10).

2. Purpose and Use of the Information Collection

The purpose of the IC will be to create an accurate, reliable knowledge base related to an ongoing public health emergency incident, to ensure situation awareness by CDC, other federal agencies, and state and local public health officials, to facilitate communication that will inform appropriate decision making, and to execute effective and efficient response activities. Ultimately, information acquired from this process will strengthen the public health communications infrastructure and the nation’s ability to respond to multi-jurisdictional disease outbreaks, natural disasters, and bioterrorism threats. There are positive benefits of collecting the data:

1) The public health emergency involves one jurisdiction or more than one jurisdiction and uniform data are needed to drive response (e.g., which and how many resources were deployed after a hurricane affected multiple states, clinical symptoms of patients with a novel virus, etc.?)

2) Data collected may be of benefit to other Agencies (e.g., Food and Drug Administration).

There are negative public health consequences of not having the data:

1) A delay in data collection may result in the loss of information that could potentially a) compromise CDC’s ability to effectively respond to the emergency, and b) be used to assist with the response or answer research questions (e.g., how many and which staff were deployed, what duties were performed, by whom, and when during the response, and what was the impact of their involvement in the response?).

2) A delay in data collection may significantly inhibit data sharing and coordination across Federal, State and local agencies, causing a delay in an emergent response.

Privacy Impact Assessment Information

The information is being collected to provide CDC with information for all-hazards public health emergencies. The information may be used to provide answers to the following questions:

• How are public health emergencies coordinated and handled by the state, local government, tribal and territorial governments?

• Are the Strategic National Stockpile assets being deployed in a reasonable period of time following a public health emergency?

• From a public health systems perspective, how are the entities involved working together to improve recovery and response during a public health emergency?

• During a public health incident, how are data being integrated and exchanged to provide accurate information?

• How are unstructured data being implemented and validated during a public health emergency?

• How are multiple forms of data and information resources being used to inform health intelligence?

Respondents will be advised of the nature of the activity, the length of time required for participation and that their participation is voluntary. The purpose is to organize the information collected and use this information during and after (including a possible follow-up) a public health emergency.

No IIF is being collected.

3. Use of Improved Information Technology and Burden Reduction

In past years, land-line telephone conversations were viewed as the only “secure” means of communication between epidemiologists, health officers, and the CDC. Epi-X is CDC’s first and only secure, encrypted network being used to convey urgent public health information between key state health officials, CDC, and HHS. The prospect of bioterrorism has heightened the importance and necessity of this network, as has the multi-jurisdictional public health impact of natural disasters and infectious disease outbreaks.

 

Epi-X was designed as a web-based network to communicate urgent public health information securely, in a paperless environment. All authorized public health officials must apply for, and be granted a digital certificate through CDC’s Secure Data Network to access Epi-X.

Epi-X will enable state and local respondents to communicate clearly, securely, and specifically the information CDC requires to respond effectively to public health emergency incidents.

3. Efforts to Identify Duplication and Use of Similar Information

Every effort will be made to avoid duplication by other Federal Agencies and partner organizations (not limited to the following examples: Council of State and Territorial Epidemiologists (CSTE), National Association of City and County Health Officials (NACCHO), and Association of State and Territorial Health Officials (ASTHO).

An Epi-X incident specific survey instrument will only be used during a specific public health incident where secure and time sensitive communications are needed. Information from the survey instrument would be for that incident.

3. Impact on Small Businesses or Other Small Entities

There will be no impact to the business sector or other small entities during the collection of information. Information will be collected only from authorized Epi-X public health officials.

3. Consequences of Collecting the Information Less Frequently

Data collection covered under this IC will be related to a specific all-hazards public health emergency. The frequency of data collection as it relates to consequences to the federal government or policy activities will depend on the public health incident.

The information to be collected will be for specific public health emergency incidents. The information may serve as a baseline for future public health incidents response surveys. Data collection instruments (Attachments 3-9) would enhance the acceptance and use of Epi-X as a tool for the collection and dissemination of critical and ongoing emergency response public health information. There are no legal obstacles to reduce the burden.

3. Special Circumstances Relating to the Guidelines of 5 CFR 1320.5

Because public health emergency response incidents are unpredictable, there may be circumstances that would require the respondents to collect information as soon as possible to assist CDC and other public health agencies to mitigate the impact of an incident and report information more than quarterly. Such situations would include for example, a hurricane disaster response incident and an on-going foodborne outbreak response in the same state at the same time.

3. Comments in Response to the Federal Register Notice and Efforts to Consult Outside the Agency

A. A 60-Day Federal Register Notice was published in the Federal Register on , July 8, 2010, Vol. 75, No. 130, pp. 39259- 39261 (Attachment 2). There were no public comments.

The program at times may consult with individuals outside of the agency on this data collection instrument for a specific public health incident. Within CDC, design architects, medical epidemiologists, program analysts, and health communicators are consulted regarding the design of the survey instruments. When necessary other Federal agencies will be consulted (e.g., Department of Homeland Security, Environmental Protection Agency, Federal Bureau of Investigation, United States Department of Agriculture and Food and Drug Administration).

3. Explanation of Any Payment or Gift to Respondents

Respondents will not receive gifts for their responses or participation in the Epi-X system.

3. Assurance of Confidentiality Provided to Respondents

The survey will collect information from public health officials of the CDC Secure Communications Network (Epi-X) on incident specific information related to public health emergency response. The purpose of the information will be to gain and maintain accurate situation awareness, make informed decisions, and respond in the most appropriate manner possible to minimize the impact of an incident on the public health of the United States. The information gathering process will occur through web-based technology that connect authorized state and local public health officials, which is deemed to be secure and adheres to standard security protocols.

IRB Approval

IRB approval is not required.

Privacy Impact Assessment Information

A. This submission has been reviewed by ICRO, who determined that the Privacy Act is not applicable.

B. Data will be treated in a secure manner and will not be disclosed. Epi-X is a secure, electronic communication system that enables local, state, and federal public health officials to share information about recent outbreaks and other health events in a rapid manner. Advisement information for Epi-X users in the form of a Privacy Policy Notice is located in Attachment 10. The current proposed data collection instruments (Attachments 3-9) do not involve collecting sensitive and/or personal identifiable information. Data collected through use of the instruments will be stored as all information in Epi-X is stored: in an SQL database that resides behind the CDC firewall. The physical security where the servers reside requires special CDC Security clearance to enter the room. Cleared individuals must pass through a double door system that is electronically controlled by a pass key. The servers are locked in separate locked cages that only the system administrators (SA) can access. The servers require server-side strong security passwords to enter the server. Written rules of behavior for SAs are enforced by recording and monitoring access logs and through training. A designated Security Steward monitors and enforces all security concerns. ITSO scans computers regularly to ensure that adequate protection is maintained on the servers.

“Least privilege” rule (need to know access) is enforced for all authorized users. Only authorized users with a valid VeriSign digital certificate have access to data collected through Epi-X. Users of Epi-X are authorized by a state public health department official (usually the State Epidemiologist), through their affiliation with a partner organization (e.g., CSTE, APHL, NACCHO, ASTHO), or through their affiliation with a government agency (e.g., CDC, HHS, DHS, DoD, DoS). Authorized users are required to read and abide by the Epi-X User Agreement, which delineates their roles and responsibilities with regard to the use of Epi-X information. Authorized users are subject to the terms of the privacy policy (Attachment 10).

All information collected through Epi-X is retained in perpetuity. Data collected through use of the instruments (Attachments 3-9) will be available on the secure website as an Epi-X report, Epi-X Forum discussion posting, or as an attachment to a report or discussion posting. Data added as attachments are not searchable, but data added to an Epi-X report or Epi-X Forum discussion posting are searchable. None of the data collection instruments ask for names of individuals so these would not be available as parameters for searching Epi-X reports or Epi-X Forum postings.

C. Respondents will be notified of the voluntary nature of their response and asked if there are any limitations or time embargoes as to how the information should be shared or disseminated. The Epidemic Information Exchange’s (Epi-X) purpose is to create an accurate, reliable knowledge base related to an ongoing public health emergency incident, to ensure situation awareness by CDC and state and local public health officials, to facilitate communication that will inform appropriate decision making, and to execute effective and efficient response activities. As many public health emergency incidents are multi-jurisdictional, information acquired from this process will be shared with appropriate, federal, state, and local partners to strengthen the public health communications infrastructure and the nation’s ability to respond to multi-jurisdictional disease outbreaks, natural disasters, and bioterrorism threats.

Based on a respondent’s limitations on the data collected, it may be shared with other appropriate Federal Agencies (e.g., Food and Drug Administration) and local or state jurisdictions who are Epi-X subscribers.

4. No IIF is being collected.

3. Justification for Sensitive Questions

The information collections instruments (Attachments 3-9) do not contain questions of a sensitive nature.

3. Estimates of Annualized Burden Hours and Costs

A. Because most public health emergency responses are multistate and multijurisdictional, each incident specific survey instrument would be sent to appropriate public health officials/offices that are responsible for a specific incident response in each jurisdiction affected.

State Epidemiologist: The number of respondents and the number of responses per respondent reflects an upper limit and the uncertainty of predicting public health emergencies. A population based estimate was used that would reflect a states epidemiologist whose jurisdiction covered a large population over a large geographic area and would receiving a maximum of 2 surveys per week. This rate was used for all states regardless of their population or geographic size.

County Health Officials: The number of respondents and the number of responses per respondent again reflects an upper limit and the uncertainty of predicting public health emergencies. Some county health officials may receive more than one survey, some may receive none. However, as subdivision of the states, the maximum estimated was set at 1 survey per month.

50 states x 104 questionnaires (52 weeks x 2) / year x 1 hour/questionnaire = 5200 burden hours for state health officials

12 questionnaires /year x 1 hour questionnaire x 1600 county health officials (approximately half of US counties) = 19,200 burden hours for health officials

Total = 24,400 burden hours

Exhibit 1. Estimated Annualized Burden Hours

Type of Respondent		No. of Respondents	No. Responses per Respondent	Average Burden per Response (in hours)	Total Burden Hours
State Epidemiologists		50	104	1	5, 200
County Health Officials		1600	12	1	19,200
Total					24,400

• The mean hourly wage is based on the United States national average for 2009 taken from the Bureau of Labor Statistics website (www.bls.gov).

Exhibit 2. Estimated Annualized Burden Costs

Total Burden Hours	Hourly Wage Rate	Total Respondent Costs
24,400	$20.90	$509,960

*May 2009 National Occupational Employment and Wage Estimates for All Occupations

3. Estimate of Other Total Annual Cost Burden to Respondents or Record Keepers.

There are no capital or maintenance costs to the respondents.

14. Annualized Cost to the Government

The government costs include personal costs for federal staff and contrator staff involved in operating and mainitaining the Epi-X web system, the staff involved in project oversight and development of this IC, and project staff engaged in the deployment of an information collection tool during a specific public health response. IC development involves input from across the agency and equals approximatley 10% of a GS-13 public helath analyst, 10% of a GS-14 scientist, and 10% of a GS-15 scientist. Project oversight, survey intiation, data analysis, results compilation, and report writing during one 48 day incident response involves approximatley: 10% of 2 GS-14 Scientist and 10% of one GS-15 scientist during an average 48 day response period, times 4 response per year. (48 days is 13% of 365 days x 10% of time during that 48 days). Calculation based on a GS grade Step 5 base + locality pay 5 x 25% for benefits) . The total cost to the Federal government is $503,246.00. Annualized Cost to the Federal Government is $283,623.00.

Exhibit 3. Annualized Cost to the Federal Government

Labor:
CDC personnel for Epi-X system management 100% GS-13	$121, 123.00
Contractor labor for Epi-X system management	$96,500.00
CDC personnel for ICR development including contribution from programs for survey tool development	$42,000.00
CDC personnel for response incident project oversight base 2.6% of GS-14 scientist (2.6% is 1.3% x 2 GS-14) and 1.3% of a GS-15 scientist is approximately $6000.00 x 4 responses per year	$24,000.00
Annualized cost to the Federal government	$283,623.00

15. Explanation for Program Changes or Adjustments

This is a program change request for an IC request for revisions. We are requesting a title change to read -- Centers for Disease Control and Prevention (CDC) Secure Communications Network (Epi-X). The prior IC was distributed to individual users for their 10 minute burden evaluation of the Epi-X system. The program change is that Epi-X surveys tools will request specific technical information from one public health official reporting from each public health jurisdiction with information relevant to a specific public health incident that has impacted their location. Estimated burden has increased from 10 minutes to one hour.

The total number of burden hours has increased from 167 to an estimated 24, 200 hours using the following calculation 50 states x 100 questionnaires/ year x 1 hour/questionnaire = 5000 burden hours for state health officials and 12 questionnaires /year x 1 hour questionnaire x 1600 county health officials (approximately half of US counties) = 19,200 burden hours for county health officials. This figure is a worst case figure reflecting multiple or long term public incidents such as an influenza pandemic where there is a requirement for CDC to stay up-to-date and it contact with state and local health partners on the current status and epidemiology of a public health incident.

The original program was based on a once a year event evaluation. This IC request for revisions is based on the number of potential public health incidents that would impact a public health jurisdiction at the state or county level. The burden increases from $3,340 to an estimated $491,744. This increase represents the burden of compiling and validating public health incident specific data from that jurisdiction with up to 100 requests per year at the state level and 12 requests per year estimated for a local county public health office.

16. Plans for Tabulation and Publication and Project Time Schedule

The data collected under this IC will be used to provide information that is necessary in understanding and responding to specific public health incidents. The Program/Project Officer working with the incident specific epidemiologists will outline plans for tabulation and publication of incident specific data collection as well as the incident specific project time schedule. The collection of data, as soon as possible after the public health emergency, is critical and is the responsibility of the Program/Project Officer. Any publication derived from the public health emergency is subject to review by the State or local health departments, CDC or foreign countries. The Activities and Time Schedule begins when CDC’s Director activates CDC’s Emergency Operations Center to coordinated CDC’s activities in regards a specific public health incident.

Exhibit 4: Individual Public Health Incident ICR Project Time Schedule bases on the average length of a CDC Public Health Response of 48 days

Activity	Time Schedule
Pre-notification Epi-X e-mail sent to Public Health Officials potentially impacted by the incident	Within 1 week of CDC’s Director activating CDC’s Emergency Operations Center (EOC)
Epi-X Initial Incident Specific data collection initiated	Within 2 weeks after CDC’s EOC is activated (Day 14 of an average 48 day response))
Preliminary data analysis and assessment
Follow-up with Epi-X Public Health Officials engage in Incident Specific Public Health Response	Within 3 weeks after CDC’s EOC is activated (Day 21)
Epi-X Second Incident Specific Data Collection – (if needed)	Within 4 weeks after CDC’s EOC is activated (Day 28)
Data analysis and assessment	Within 5 weeks after CDC’s EOC is activated (Day 35)
Epi-X Third Incident Specific Data Collection (if needed)	Within 6 weeks after CDC’s EOC is activated (Day 42)
All data collection completed	1 month after CDC EOC is deactivated – work reverts to program
Data cleaning, coding and analysis	5-7 months after CDC EOC is deactivated
Completion of Evaluation Reports and Review	8-10 months after CDC EOC is deactivated
Publication and Dissemination of Incident Epidemiology Summary	11-12 months after CDC EOC is deactivated

17. Reason(s) Display of OMB Expiration Date is Inappropriate

We are not requesting an exemption to the display of the expiration date.

18. Exceptions to Certification for Paperwork Reduction Act Submissions

There are no exceptions to the certification.

1 The Strategic National Stockpile is a national repository of antibiotics, antivirals, chemical antidotes, antitoxins, life-support medications, IV administration equipment, airway maintenance supplies, and medical/surgical items managed by CDC. During a public health emergency, State and local public health systems and resources may become overwhelmed. The SNS is designed to supplement and re-supply state and local public health agencies in the incident of such an emergency.

13