CDC Response to OMB

11/22/2011

OMB ICR Reference No: 201109-0920-002 (CDC #0920-11BJ)

Response to OMB request for clarification/follow-up dated 11/07/2011

OMB Question:

1. In the supporting document, CDC recognizes that participant-specific information could be combined with other data to identify participants in a program. CDC claims that it will not attempt to identify individuals using these data linkages. Can the CDC provide an outline of the procedures in place to assure these linkages are not made and participants are not identified (this outline can be included in the agency’s Supporting Statement A).

In Supporting Statement A, the CDC narrative specific to this issue was as follows:

The participant process and outcome data will include site-specific information (organization and location codes) and group-specific information (core group code and lifestyle coach’s identifier). The organization will identify, assign, and maintain a coded identification number for each participant, and only de-identified, coded, participant-level information will be transmitted to CDC. However, CDC recognizes that some of the participant-specific information (ethnicity, race, age, gender, method of determining prediabetes status) when coupled with other data (organization code, location code and core group code) might be considered Individually Identifiable Data (IIF). CDC will not attempt to identify individuals by data linkages involving demographic, geographic or outcome information, contact individual participants, or disclose any participant-level data.

In addition, the CDC response to the OMB question is as follows:

We believe that the procedures that we have proposed are appropriately scaled to the low likelihood of disclosure and the low likelihood of harm that could result from inadvertent disclosure of individual participant information.

To elaborate, in the DPRP data system, the participant-level evaluation data will be linked to the organization-level application data through the organization code, which is assigned to the organization by CDC at the time of acceptance into the program and subsequently appended to all participant-level records by the organization before sending to CDC. Hence, the only linkage of participant records within the Diabetes Prevention Recognition Program (DPRP) data system will be to the organization contact information (e.g., organization name, address, phone number, contact person). The DPRP applicant organizations will assign and maintain all other codes, including the participant ID and lifestyle coach ID, and CDC will not have access to the keys for these codes or to the applicants’ data systems.

No information in identifiable form (directly or indirectly identifiable) about the lifestyle program coaches or participants should be transmitted to CDC. All identifiers (except the organization code, which is provided by CDC) will be assigned and maintained by the applicant organization. Data is to be submitted in a precisely defined format. The DPRP data system will incorporate standard procedures for checking the format and content of evaluation data submissions upon receipt. If evaluation data is sent to CDC that does not conform to the specified format, or includes IIF, it will not be accepted and will be returned or destroyed immediately.

CDC is concerned with program performance, not the performance of individual participants. While CDC will report recognition status for each participating organization, and may produce summary reports that include data on the performance of some or all recognized organizations, CDC will not report on individual participant performance. CDC-produced summary reports may link aggregate program data to geographic area-level variables (e.g., state or county-level demographics), but we do not believe that such reports could be used to identify an individual participant.

In summary, we believe that the risk for identification or disclosure is very low for several reasons:

1. CDC will not accept IIF about lifestyle program coaches or participants. This will be ensured by requiring that evaluation data be submitted in a specific format and having procedures to check format and content before data are accepted.

2. The only direct linkage of participant-level data in the DPRP data system will be to the organization contact information via the organization code.

3. CDC will not have access to the keys to any codes other than the organization code or to the applicant organizations’ data systems.

4. CDC will not attempt to identify individuals by data linkages involving demographic, geographic or outcome information.

5. CDC will not report on the performance of individual particpants and will not disclose any participant-level data.

In addition, we would point out that CDC provides the critical assurance to participating organizations that CDC will use the data only as described and will safeguard and secure the data to the full extent allowable by law. On the organization side, the DPRP Standards document clearly assigns the principal responsibility for maintaining participant privacy to the participating organization.

OMB Comment:

There are minor grammatical errors in Supporting documents A, B and attachments.

CDC response:

These have been noted and corrected in the following documents:

1. Supporting Statement A

2. DPRP Workgroup members

3. Ongoing Evaluation Data Reminder

OMB Comment: One of the documents has been marked “draft”. Please submit finalized version of all supporting documents and attachments.

CDC response:

A final Diabetes Mellitus Inter-agency Coordinating Committee (DMICC) agenda has replaced the draft version.