5 - Assurance of Confidentiality

Attachment 5. Assurance of Confidentiality for HIV/AIDS Surveillance Data
ASSURANCE OF CONFIDENTIALITY FOR SURVEILLANCE OF ACQUIRED
IMMUNODEFICIENCY SYNDROME (AIDS) AND INFECTION WITH HUMAN
IMMUNODEFICIENCY VIRUS (HIV) AND SURVEILLANCE-RELATED DATA
(INCLUDING SURVEILLANCE INFORMATION, CASE INVESTIGATIONS AND
SUPPLEMENTAL SURVEILLANCE PROJECTS, RESEARCH ACTIVITIES, AND
EVALUATIONS)
The national surveillance program for HIV/AIDS is being coordinated by the HIV Incidence and
Case Surveillance Branch (HICSB) and the Behavioral and Clinical Surveillance Branch
(BCSB) of the Division of HIV/AIDS Prevention - Surveillance and Epidemiology (DHAP SE), the National Center for HIV/STD/TB Prevention, a component of the Centers for
Disease Control and Prevention (CDC), an agency of the United States Department of Health
and Human Services. The surveillance information requested by CDC consists of reports of
persons with suspected or confirmed AIDS or HIV infection, including children born to
mothers infected with HIV, and reports of persons enrolled in studies designed to evaluate
the surveillance program. The information collected by CDC is abstracted from laboratory,
clinical, and other medical or public health records of suspected or confirmed HIV/AIDS
cases; and from surveys that interview persons in recognized HIV risk groups or known to
have a diagnosis of HIV/AIDS.
Surveillance data collection is conducted by State and Territorial health departments which forward
information to CDC after deleting patient and physician names and other identifying or
locating information. Records maintained by CDC are identified by computer-generated
codes, patient date of birth, and a state/city assigned patient identification number. The data
are used for statistical summaries and research by CDC scientists and cooperating state and
local health officials to understand and control the spread of HIV/AIDS. In rare instances,
expert CDC staff, at the invitation of state or local health departments, may participate in
research or case investigations of unusual transmission circumstances or cases of potential
threat to the public health. In these instances, CDC staff may collect and maintain
information that could directly identify individuals.
Information collected by CDC under Section 306 of the Public Health Service Act (42 U.S.C. 242k)
as part of the HIV/AIDS surveillance system that would permit direct or indirect
identification of any individual or institution on whom a record is maintained, and any
identifiable information collected during the course of an investigation on either persons
supplying the information or persons described in it, is collected with a guarantee that it will
be held in confidence, will be used only for the purposes stated in this Assurance, and will
not otherwise be disclosed or released without the consent of the individual or institution in
accordance with Section 308 (d) of the Public Health Service Act (42 U.S.C. 242m(d)). This
protection lasts forever, even after death.

Information that could be used to identify any individual or institution on whom a record is
maintained by CDC will be kept confidential. Full names, addresses, social security numbers,
and telephone numbers will not be reported to this national HIV/AIDS surveillance system.
Medical, personal, and lifestyle information about the individual, and a computer-generated
patient code will be collected.
Surveillance information reported to CDC will be used without identifiers primarily for statistical
and analytic summaries and for evaluations of the surveillance program in which no
individual or institution on whom a record is maintained can be identified, and secondarily,
for special research investigations of the characteristics of populations suspected or
confirmed to be at increased risk for infection with HIV and of the natural history and
epidemiology of HIV/AIDS. When necessary for confirming surveillance information or in
the interest of public health and disease prevention, CDC may confirm information contained
in case reports or may notify other medical personnel or health officials of such information;
in each instance, only the minimum information necessary will be disclosed.
No CDC HIV/AIDS surveillance or research information that could be used to identify any
individual or institution on whom a record is maintained, either directly or indirectly, will be
made available to anyone for non-public health purposes. In particular, such information will
not be disclosed to the public; to family members; to parties involved in civil, criminal, or
administrative litigation, or for commercial purposes; to agencies of the federal, state, or local
government. Data will only be released to the public, to other components of CDC, or to
agencies of the federal, state, or local government for public health purposes in accordance
with the policies for data release established by the Council of State and Territorial
Epidemiologists.
Information in this surveillance system will be kept confidential. Only authorized employees of
DHAP - SE in HICSB, BCSB, and in the Quantitative Science and Data Management Branch
(QSDMB), their contractors, guest researchers, fellows, visiting scientists, research interns
and graduate students who participate in activities jointly approved by CDC and the
sponsoring academic institution, and the like, will have access to the information. Authorized
individuals are required to handle the information in accordance with procedures outlined in
the Confidentiality Security Statement for Surveillance of Acquired Immunodeficiency
Syndrome (AIDS) and Infection with Human Immunodeficiency Virus (HIV) and
Surveillance-Related Data (Including Surveillance Information, Case Investigations and
Supplemental Surveillance Projects, Research Activities, and Evaluations).
Date: 9/18/2006