SupSta A_0920-0636

Supporting Statement A

Centers for Disease Control and Prevention (CDC) Secure Public Health Emergency Response Communications Network (Epi-X)

OMB Control No. 0920-0636 Expiration 05/31/2014

Revision

February 6, 2014

Centers for Disease Control and Prevention

Office of Public Health Preparedness and Response

Division of Emergency Operations

Mark Wooster, PhD

(404) 639-3227

[email protected]

Jacqueline Burkholder, PhD

(404) 775-1560

[email protected]

Amanda Evanson

(404) 639-3113

[email protected]

Marinda Logan, MPH

(404) 639-7072

[email protected]

Table of Contents

1. Circumstances Making the Collection of Information Necessary 4

2. Purpose and Use of the Information Collection 9

3. Use of Improved Information Technology and Burden Reduction 12

4. Efforts to Identify Duplication and Use of Similar Information 12

5. Impact on small Businesses or Other Small Entities 13

6. Consequences of Collecting the Information Less Frequently 13

7. Special Circumstances Relating to the Guidelines of 5 CFR 1320.5 13

8. Comments in Response to the Federal Register Notice and Efforts 13

to Consult Outside the Agency

9. Explanation of Any Payment or Gift to Respondents 13

10. Assurance of Confidentiality Provided to Respondents 14

11. Justification for Sensitive Questions 15

12. Estimates of Annualized Burden Hours and Costs 15

13. Estimates of Other Total Annual Cost Burden to Respondents and Record 16

Keepers

14. Annualized Cost to the Federal Government 16

15. Explanation for Program Changes or Adjustments 17

16. Plans for Tabulation and Publication and Project Time Schedule 17

17. Reason(s) Display of OMB Expiration Date is Inappropriate 18

18. Exceptions to Certification for Paperwork Reduction Act Submissions 18

List of Attachments

Authorizing Legislation (Public Health Service Act (42 USC 241) Attachment A

60 Day Federal Register Notice Attachment B

Determination of Applicability of Human Subjects Regulations Attachment C

1. Justification

1. Circumstances Making the Collection of Information Necessary

This is a request for revisions to Office of Management and Budget (OMB) Control No. 0920-0636: Centers for Disease Control and Prevention (CDC) Secure Public Health Emergency Response Communications Network (Epi-X). This generic Information Collection Request (ICR) has been revised to reflect the following changes: 1) remove verbiage limiting data collection to activation of the Incident Management Structure (IMS), 2) broaden categories under which data may be collected to increase its utilization, and 3) provide clarity regarding the data elements. CDC is requesting a three year approval for this data collection.

Background

The Epidemic Information Exchange (Epi-X) is CDC’s Web-based communication system for securely communicating in immediate anticipation of, during and following public health emergencies that have multi-jurisdictional impacts and implications. The incidents of September 11, 2001 illustrated the need for an encrypted and secure communications system that would permit CDC to communicate urgently with partners at the state and local levels, and to notify them 24/7, when necessary. Similarly, Epi-X was specifically designed to provide public health decision-makers at the state and local levels a secure, reliable tool for communicating sensitive, unusual, or urgent public health incidents to neighboring jurisdictions as well as to CDC. The system was also designed to generate a request for epidemiologic assistance (Epi-Aid) from CDC using a secure, paperless environment.

 

Epi-X designers have developed functionalities that permit targeting of critical outbreak information to specific public health authorities who can act quickly to prevent the spread of diseases and other emergencies in multi-jurisdictional settings, such as those that could occur during an influenza pandemic, infection of food and water resources, and natural disasters.

There is a need to expand information collection beyond activation of the IMS because each public health incident doesn’t warrant activation of the Emergency Operations Center (EOC). Public health incidents can include any outbreak or public health emergency. There are only two other mechanisms at CDC that allow information collection during a public health incident, OMB Control No. 0920-0008 Epidemiological Assistance (Epi-Aid) which expires 7/31/2014 and the National Childhood Vaccine Injury Act (Public Law 99-660) “vaccine waiver.” This generic ICR is the bridge between those two mechanisms until other ICRs are developed. The effectiveness and efficiency of CDC’s response to any public health incident depends on information at the agency’s disposal to characterize and monitor the incident, make timely decisions, and take appropriate actions to prevent or reduce the impact of the incident.

Available information in anticipation of, during and following public health incident responses is often incomplete, is not easily validated by state and local health authorities, and is sometimes conflicting. This lack of reliable information often creates a high level of uncertainty with potential negative impacts on public health response operations.

Secure communications with CDC’s state, local, territorial, and tribal public health partners is essential to resolve conflicting information, validate incident status, and establish and maintain situational awareness. Reliable, secure communications are essential for the agency to gain and maintain accurate situational awareness, make informed decisions, and to respond in the most appropriate manner possible in order to minimize the impact of an incident on the public health of the United States.

CDC has recognized a need to expand the use of Epi-X to collect specific response related information in anticipation of, during and following public health emergencies. Proposed data collection instruments under this generic ICR will be designed to ensure ready access to public health and disease epidemiology information in anticipation of, during and following a public health incident emergency response. Authorized officials from state and local health departments affected by the public health incident will be informed of this data collection first through an Epi-X Facilitator, who will work closely with Epi-X program staff and the Epi-X Information Collection Request Liaison (EICRL) to ensure that Epi-X incident specific Information Collections (IC) are understood. The Office of Public Health Preparedness and Response will delegate the OMB Paperwork Reduction Act Coordinator in the Office of Science and Public Health Practice to serve the role of “Epi-X EICRL.” The EICRL will manage the Epi-X emergency response clearance process for information collections and work with the Epi-X program staff. The survey instruments will contain specific questions relevant to the current and ongoing public health incident and response activities and be administered only through Epi-X as a web-based communication system. Dissemination of information in anticipation of, during and following public health emergencies is an integral part of the overall mission of the CDC and is authorized by the Public Health Service Act (42 USC 241) (Attachment A).

 

This generic ICR is intended to answer questions of immediate public health importance in anticipation of, during and following public health emergency responses. When deciding whether a survey under the Epi-X ICR is needed, CDC will first look to data already collected by CDC or its partners. It is important to note that CDC efforts under this generic clearance will not be duplicative of information collections already conducted by CDC or other public health organizations. The resulting burden estimate is an upper-bound estimate and will be adjusted as appropriate as CDC uses the collection. In order to ensure that timely information is collected from registered users, this generic ICR will not be limited for use only during activation of the IMS structure.

The ICR process will include but may not be limited to: 1) description of a sample (e.g., all 50 states or some sample), 2) description of need and purpose proposed work (or statement of work), 3) sampling methods and the target respondent (e.g., Food Safety Officer), 4) data collection instruments and 5) estimate of response burden.

The numbers and types of activations are of course unpredictable, however, Table 1 provides examples of CDC public health incidents for the past three years.

Table 1. CDC Activations and Supported Events January 1, 2009 to August 30, 2013

Response	Start Date	End Date
Salmonella Typhimurium – Multi-state	1/15/2009	1/26/2009
Varicella Outbreak – Norwalk, CT	1/9/2009	1/21/2009
Kentucky Ice Storm	1/9/2009	2/11/2009
Vaccine Adverse Reaction - California	3/2/2009	3/21/2009
Red River Flooding – North Dakota	3/24/2009	4/3/2009
2009 Pandemic H1N1 Influenza Virus	4/23/2009	5/10/2010
E. coli 0157 Multi-state	6/29/2009	7/13/2009
Legionaires Disease Investigation – Baltimore, MD	10/20/2009	11/6/2009
Multidrug-Resistant Tuberculosis – Republic of Marshall Islands	10/20/2009	11/9/2009
New Hampshire Anthrax Event – New Hampshire, MA	1/5/2010	1/20/2010
Deepwater Horizon Incident	5/10/2010	8/19/2010
Guillain-Barre Syndrome (GBS) Outbreak	6/26/2011	7/27/2011
Hurricane Irene	8/28/2011	9/1/2011
Multistate Listerosis Outbreak	9/12/2011	ongoing
Positive Ricin Sample – Capital Heights, MD	10/14/2011	10/14/2011
Polio Response	12/02/2011	ongoing
West Nile Virus in Multiple States	8/1/2012	ongoing
Multi State Meningitis Outbreak Response Level III	10/5/2012	1/9/2013
Hurricane Sandy	10/26/2012	11/14/2012
H7N9 Activation	04/02/2013	06/14/2013
MERS-CoV	06/03/2013	08/13/2013
Cyclospora Outbreak	08/09/2013	08/30/2013

Privacy Impact Assessment

The most recent PIA for Epi-X was completed on July 5, 2013.  

Overview of the Data Collection System

Data will be collected under the Epi-X ICR using a web-based tool. This tool already is established for the current ICR and has been in use since 2003. It will be adapted as needed to accommodate the data collection instruments developed as part of this generic ICR. Respondents will receive the survey instrument as an official CDC email, which is clearly labeled, “Epi-X Emergency Public Health Incident Information Request”. The e-mail message would be accompanied by a link to an Epi-X Forum discussion web page. Respondents could choose to provide their answers to the survey questions by posting information within the discussion.

The information collected will be maintained indefinitely. Issues related to data security, confidentiality and informed consent are described below.

Items of Information to be Collected

This generic ICR covers organizational or jurisdictional level data elements (i.e., data elements collected from state, local, tribal, and territorial levels of government and non-governmental organizations) that may be qualitative or quantitative. These data elements may be collected in anticipation of, during and following the public health emergency (data elements related to response and recovery phases of the emergency for intentional and non-intentional and naturally occurring public health threats.

We have broadened the categories under which data may be collected to increase its utilization, and provided clarity regarding the data elements. This will allow more utility of the ICR and capture data elements that are of importance for public health incidents. Categories of data elements that may be collected under this ICR may include, but are not limited to: data elements pertaining to infectious diseases, natural or manmade mass casualty incidents, environmental health, informatics, biosurveillance, evaluation of health communication messaging, and Strategic National Stockpile materiel. Examples of data elements categories include:

Communicable Diseases: signs and symptoms questions (e.g., signs and symptoms of influenza-like illness or other signs and symptoms of the disease of interest, symptom onset), exposure history, travel history (including commercial conveyance information), vaccination status, medical history, plans for further travel during infectious period, travel companion information including vaccination status, plans for further travel during the incubation period; flight or vessel information; tracking of treatment or prophylactic measures and adverse incidents to vaccination or medications; laboratory results; disease outcomes; monitoring social media reports about illness in communities.

Non-communicable Diseases: health status including diagnosis of chronic conditions that require ongoing medical treatment or monitoring including (but not limited to) diabetes, cancer, cardio vascular diseases, arthritis, asthma, chronic obstructive pulmonary disease, dementia, physical and mental disabilities and chronic kidney disease. Information collected on these conditions should include both existence of the condition as well as current treatment plans and pharmacologic regimens.

Natural or Manmade Mass Casualty Incidents: circumstances of incident (e.g., tornado, hurricane, forest/range fire, flood, explosion, structural collapse, fire, plane crash and train crash); mechanisms of injury (e.g., drowning/submersion, suffocation, fall, cut/pierce, struck by/against, smoke inhalation, burn by fire/flame or hot object/substance, inhaled: toxic gas/fumes, particulate matter; burned by: explosion, secondary fire, chemical, unknown; and struck by fixed object: pushed or knocked against object); injury type by anatomic region; specified care received in prehospital, hospital or rehabilitation settings; potential surge and lack of availability of specialized care (e.g., trauma center, burn center beds available).

Environmental Health: population estimates; shelters (e.g., security/law enforcement availability, hot water availability, safety of food source, availability of hand-washing facilities, adequacy of water supply, safety of water source, reported outbreaks, unusual illness/injuries, adequate number of toilets, sewage system type, adequate number of collection receptacles, adequate child/caregiver ratio, adequate number of cots/beds/mats, adequate spacing, presence of companion animals, and handicap accessibility); environmental exposures and health impact secondary to natural disasters (earthquake, flood, hurricane, tornado, etc.), and extreme weather conditions (heat and cold)); built environment (e.g., community planning as it relates to recovery), personal and public safety; chemical exposures (e.g., proximity to the site of release, personal exposure description, medical history, occupational history, radiation countermeasures, description of acute health effects immediately after release, personal protection equipment worn by responders or hospital workers); radiological exposures (e.g., exposure location, potential routes of contamination, radiation assessment, prodromal symptoms, radiation countermeasures; rapid response registry: (e.g., registrant information, proxy or close friend/relative information, exposure information); exacerbation of chronic medical conditions; availability of routine pharmaceutical supplies (e.g., medications for chronic medical conditions); unusual pests, plagues, damage to drinking water infrastructure, boil water notices, environmental health hazards like exposure, falls, carbon monoxide poisoning, monitoring social media reports about illness in communities; community experiences and perceptions.

Informatics: demographics (e.g., location, size, geographic coverage) of healthcare entities (e.g., hospitals, emergency departments, laboratories, pharmacies); healthcare entity information/data transfer resources and capabilities; types and volume of data available.

Biosurveillance: syndrome definitions and algorithms, number of outpatient and emergency department visits; unusual illness reports received in Poison Control Centers , demographic information of cases, including geocoded data; patient disposition; hospitalization rates, emergent surgeries, ICU utilization, medical supplies availability, hospital census reports; mortality data; laboratory test orders and results; treatment protocols, types of surveillance systems, surveillance methods (e.g., telephone) and tools (e.g., secured data network (SDN) used.

Evaluation of Health Communication Messaging: receipt of CDC communications (including social media and website messages and guidance) by partners during emergency incidents, helpfulness of messages and guidance, clarity, special audiences of messages and guidance, timeliness of delivery, how and if messages and guidance were used.

Strategic National Stockpile¹ Materiel: types of adverse reactions to countermeasures, number of adverse reactions, number of cases, types of symptoms, Investigational New Drug (IND) and Emergency Use Authorization patient information for hospitalized patients (e.g. laboratory results and medical history), medical countermeasure dashboard activity (e.g., pharmaceutical and medical supply manufacturers, distributors and retailers), current inventory on hand, disposition of the inventory, how inventory was stored, sub recipients of the materiel (e.g., Indian Health Service, community health centers, local public health departments, other health facilities), which sites were delivered to, how many people received the materiel and timeliness of delivery from the federal sites down to the local sites.

Occupational Health: morbidity and mortality reports, worker base camps issues, characteristics of the workers (e.g., census, demographics mostly Spanish speaking low literacy etc.)

2. Purpose and Use of the Information Collection

The purpose of this generic ICR will be to create an accurate, reliable knowledge base related to an ongoing public health emergency incident, to ensure situation awareness by CDC, other federal agencies, and state, local, territorial and tribal public health officials, to facilitate communication that will inform appropriate decision making, and to execute effective and efficient response activities. Ultimately, information acquired from this process will strengthen the public health communications infrastructure and the nation’s ability to respond to multi-jurisdictional disease outbreaks, natural disasters, and bioterrorism threats. There are positive benefits of collecting the data:

1) Many public health emergencies involve more than one jurisdiction and uniform data are needed to drive response (e.g., which and how many resources were deployed after a hurricane affected multiple states, clinical symptoms of patients with a novel virus, etc.?)

2) Data collected may be of benefit to other agencies (e.g., Food and Drug Administration).

There are negative public health consequences of not having the data:

1) A delay in data collection will result in the loss of information that will potentially a) compromise CDC’s ability to effectively respond to the emergency, b) be used to assist with the response or answer evaluation questions (e.g., how many and which staff were deployed, what duties were performed, by whom, and when during the response, and what was the impact of their involvement in the response?), c) impair public health efforts to identify and implement lessons learned from the emergency.

2) A delay in data collection may significantly inhibit data sharing and coordination across federal, state and local agencies, causing a delay in an emergent response.

CDC will conduct surveys across a range of public health topics using standard questionnaire administration approaches. CDC is requesting a three-year approval for a generic clearance to assess information related to a myriad of public health emergencies and response issues that affect state, local, territorial, and tribal health agencies.

Information will be used to assess situational awareness of current public health emergencies, make decisions that will affect planning, response and recovery activities of subsequent emergencies, and fill gaps in knowledge that will strengthen surveillance, epidemiology, and laboratory science; better supporting efforts in states and communities.

Respondent universe is comprised of state, tribal, local and territorial governmental officials/employees that are employed by an agency involved in provision of public health services in the United States. That agency is represented by local, state, tribal or territorial health departments or any governmental entity with primary mission to improve public health.

The scope of data collection is limited to responsibilities and duties of governmental employees acting in their official capacity. Thus individual data collections that require review by an Institutional Review Board (IRB) are not covered. OMB will decline individual data collection requests if it includes respondents that are governmental employees with official duties other than public health.

The collection will include the following categories of governmental officials: 1) state, territorial, local, or tribal public health officials/employees; 2) municipal/city public health employees.

State, territorial and tribal health officers are in a unique position to provide CDC information on jurisdiction’s public health threats, status of public health infrastructure work force and financing at state, local, territorial and tribal level. For that reason CDC will survey that category if, for example, the assessment of the magnitude of a particular public health problem is needed (surveillance), or when evaluation of the jurisdiction’s capacity to respond to a particular health problem (assessment and performance management) is warranted.

County and municipal/city public health employees are at the forefront of public health service delivery and emergency response. Examples of surveys for that category may include, but not be limited to assessment of their performance in provision of public health services. .

In general, CDC expects that these collections will be solicited from either officials/employees in a particular category (e.g., epidemiologists, public health preparedness and response staff, etc., or to the geographic subset of professional officials/employees for which a particular health emergency was thought to be relevant (e.g., all county health employees whose counties had been affected by a disease outbreak). This collection of information will employ statistical methods for data collection as described in section B.

Surveys will be organized for the purpose of gathering information on administration, quality, quantity, improvement, inputs, activities, outputs, and outcomes related to delivery of public health services.

Specific questions will be formulated around one or more of the three themes of the ten essential public health services listed below:

Assessment:

• Monitoring health status to identify community health problems during a public health emergency

• Diagnosing and investigating health problems and health hazards in the community during a public health emergency

• Evaluating effectiveness, accessibility, and quality of personal and population-based health services during a public health emergency

Policy Development:

• Development of policies and plans that support individual and community health efforts during a public health emergency

• Enforcement of laws and regulations that protect health and ensure safety during a public health emergency.

• Research for new insights and innovative solutions to health problems during a public health emergency

Assurance:

• Linking people to needed personal health services and assure the provision of health care when otherwise unavailable during a public health emergency

• Assuring a competent public health and personal health care workforce during a public health emergency

• Informing, educating, and empowering people about health issues during a public health emergency

• Mobilizing community partnerships to identify and solve health problems during a public health emergency

In general, CDC does not expect these collections to yield data that can be generalized, but will produce needed information regarding important health topics that affect state and local public health emergency issues. CDC expects to use these findings to understand better the range of experiences among state, local, tribal, and territorial governmental officials/employees and as one of many inputs into decision making.

CDC will submit the specific information collections to OMB for review as individual collections (IC) under this generic clearance framework. Individual submissions will include the purpose of the collection, a description of sample (e.g., all 50 states or some sample), the target respondent (e.g., food safety officer), the questions to be asked, and the response burden. These specific information collections will be included in the PRA public docket prior to their use. OMB will review and approve an individual IC in an expedited manner. However, if the specific information collection falls outside the scope of the generic clearance or is otherwise inconsistent with the terms of the generic clearance, OMB will return the proposed information collection to the agency for additional consideration or require that the full PRA process be followed, including public notice and comment, for the review and approval.

Privacy Impact Assessment Information

The information is being collected to provide CDC with information for all-hazards public health emergencies. The information may be used to provide answers to the following questions:

• How are public health emergencies coordinated and handled by the state, local government, tribal and territorial governments?

• Are the Strategic National Stockpile assets being deployed in a reasonable period of time following a public health emergency? Are follow-on assets needed based on amount of countermeasures currently on hand?

• From a public health systems perspective, how are the entities involved working together to improve recovery and response during a public health emergency?

• During a public health incident, how are data being integrated and exchanged to provide accurate information?

• How are unstructured data being implemented and validated during a public health emergency?

• How are multiple forms of data and information resources being used to inform health intelligence?

Respondents will be advised of the nature of the activity, the length of time required for participation and that their participation is voluntary. The purpose is to organize the information collected and use this information in anticipation of, during and following a public health emergency.

3. Use of Improved Information Technology and Burden Reduction

In past years, land-line telephone conversations were viewed as the only “secure” means of communication between epidemiologists, health officers, and the CDC. Epi-X is CDC’s first and only secure, encrypted network being used to convey urgent public health information between key state health officials, CDC, and HHS. The prospect of bioterrorism has heightened the importance and necessity of this network, as has the multi-jurisdictional public health impact of natural disasters and infectious disease outbreaks.

 

Epi-X was designed as a web-based network to communicate urgent public health information securely, in a paperless environment. All authorized public health officials must apply for, and be granted identify verification credentials through CDC’s Secure Access Mangement Services (SAMS) or use a valid HHS Personal Identity Verification (PIV) card to access Epi-X.

Epi-X will enable state and local respondents to communicate clearly, securely, and specifically the information CDC requires to respond effectively to public health emergency incidents.

3. Efforts to Identify Duplication and Use of Similar Information

Every effort will be made to avoid duplication by other Federal Agencies and partner organizations (not limited to the following examples: Council of State and Territorial Epidemiologists (CSTE), National Association of City and County Health Officials (NACCHO), and Association of State and Territorial Health Officials (ASTHO).

An Epi-X incident specific survey instrument will only be used during a specific public health incident where secure and time sensitive communications are needed. Information from the survey instrument would be for that incident.

3. Impact on Small Businesses or Other Small Entities

There will be no impact to the business sector or other small entities during the collection of information. Information will be collected only from authorized Epi-X public health officials.

3. Consequences of Collecting the Information Less Frequently

Data collection covered under this generic ICR will be related to a specific all-hazards public health emergency. The frequency of data collection as it relates to consequences to the federal government or policy activities will depend on the specific public health incident.

The information to be collected will be for specific public health emergency incidents. The information may serve as a baseline for future public health incidents response surveys. Data collection instruments used during a public health emergency response would enhance the acceptance and use of Epi-X as a tool for the collection and dissemination of critical and ongoing emergency response public health information. There are no legal obstacles to reduce the burden.

3. Special Circumstances Relating to the Guidelines of 5 CFR 1320.5

Because public health emergency response incidents are unpredictable, there may be circumstances that would require the respondents to collect information as soon as possible to assist CDC and other public health agencies to mitigate the impact of an incident and report information more than quarterly. Such situations would include for example, a hurricane disaster response incident and an on-going foodborne outbreak response in the same state at the same time.

3. Comments in Response to the Federal Register Notice and Efforts to Consult Outside the Agency

A. A 60-Day Federal Register Notice was published in the Federal Register on, month November 18, 2013, Vol. 78, No. 222, pp. 69090- 69092 (Attachment B). There were no public comments.

The program at times may consult with individuals outside of the agency on this data collection instrument for a specific public health incident. Within CDC, design architects, medical epidemiologists, program analysts, evaluators, research scientists, health communicators and others are consulted regarding the design of the survey instruments. When necessary other Federal agencies will be consulted (e.g., Department of Homeland Security, Environmental Protection Agency, Federal Bureau of Investigation, United States Department of Agriculture and Food and Drug Administration).

3. Explanation of Any Payment or Gift to Respondents

Respondents will not be remunerated for their responses or participation in the Epi-X system.

3. Assurance of Confidentiality Provided to Respondents

The survey will collect information from public health officials of the CDC Secure Communications Network (Epi-X) on incident specific information related to public health emergency response. The purpose of the information will be to gain and maintain accurate situation awareness, make informed decisions, and respond in the most appropriate manner possible to minimize the impact of an incident on the public health of the United States. The information gathering process will occur through web-based technology that connects authorized state and local public health officials, which is deemed to be secure and adheres to standard security protocols.

IRB Approval

IRB approval is not required for this data collection. It was determined that this is public health non-research.

Privacy Impact Assessment Information

A. This submission has been reviewed by OPHPR, who determined that the Privacy Act is applicable.

B. Data will be treated in a secure manner and will not be disclosed. Epi-X is a secure, electronic communication system that enables local, state, and federal public health officials to share information about recent outbreaks and other health events in a rapid manner. Advisement information for Epi-X users in the form of a Privacy Policy Notice is located in Attachment 3. Data collection instruments will not involve collecting sensitive and/or personal identifiable information. Data collected through use of this generic IC s will be stored as all information in Epi-X is stored: in an SQL database that resides behind the CDC firewall. The physical security where the servers reside requires special CDC security clearance to enter the room. Cleared individuals must pass through a double door system that is electronically controlled by a pass key. The servers are locked in separate locked cages that only the System Administrators (SA) can access. The servers require server-side strong security passwords to enter the server. Written rules of behavior for SAs are enforced by recording and monitoring access logs and through training. A designated Security Steward monitors and enforces all security concerns. The Information Technology Services Office scans computers regularly to ensure that adequate protection is maintained on the servers.

“Least privilege” rule (need to know access) is enforced for all authorized users. Only authorized users with valid SAMS credential or HHS PIV card have access to data collected through Epi-X. Users of Epi-X are authorized by a state public health department official (usually the State Epidemiologist), through their affiliation with a partner organization (e.g., CSTE, APHL, NACCHO, ASTHO), or through their affiliation with a government agency (e.g., CDC, HHS, DHS, DoD, DoS). Authorized users are required to read and abide by the Epi-X User Agreement, which delineates their roles and responsibilities with regard to the use of Epi-X information. Authorized users are subject to the terms of the privacy policy.

All information collected through Epi-X is retained in perpetuity. Data collected through use of these generic IC instruments will be available on the secure website as an Epi-X report, Epi-X Forum discussion posting, or as an attachment to a report or discussion posting. Data added as attachments are not searchable, but data added to an Epi-X report or Epi-X Forum discussion posting are searchable. None of the data collection instruments ask for names of individuals so these would not be available as parameters for searching Epi-X reports or Epi-X Forum postings.

C. Respondents will be notified of the voluntary nature of their response and asked if there are any limitations or time embargoes as to how the information should be shared or disseminated. The Epidemic Information Exchange’s (Epi-X) purpose is to create an accurate, reliable knowledge base related to an ongoing public health emergency incident, to ensure situation awareness by CDC and state local, territorial and tribal public health officials, to facilitate communication that will inform appropriate decision making, and to execute effective and efficient response activities. As many public health emergency incidents are multi-jurisdictional, information acquired from this process will be shared with appropriate, federal, state, and local partners to strengthen the public health communications infrastructure and the nation’s ability to respond to multi-jurisdictional disease outbreaks, natural disasters, and bioterrorism threats.

Based on a respondent’s limitations on the data collected, it may be shared with other appropriate Federal Agencies (e.g., Food and Drug Administration) and local or state jurisdictions who are Epi-X subscribers.

3. Justification for Sensitive Questions

Information collected under this generic will not contain questions of a sensitive nature.

3. Estimates of Annualized Burden Hours and Costs

Because most public health emergency responses are multistate and multijurisdictional, each incident specific survey instrument would be sent to appropriate public health officials/offices that are responsible for a specific incident response in each jurisdiction affected.

State Epidemiologist: The number of respondents and the number of responses per respondent reflects an upper limit and the uncertainty of predicting public health emergencies. A population based estimate was used that would reflect a state’s epidemiologist whose jurisdiction covered a large population over a large geographic area and would receiving a maximum of two surveys per week. This rate was used for all states regardless of their population or geographic size.

County Health Officials: The number of respondents and the number of responses per respondent again reflects an upper limit and the uncertainty of predicting public health emergencies. Some county health officials may receive more than one survey, some may receive none. However, as subdivision of the states, the maximum estimated was set at one survey per month.

50 states x 104 questionnaires (52 weeks x 2) / year x 1 hour/questionnaire = 5200 burden hours for state health officials

12 questionnaires /year x 1 hour questionnaire x 1600 county health officials (approximately half of US counties) = 19,200 burden hours for health officials

Total = 24,400 burden hours x three years = 73,200 for the full 3 year approval period

Exhibit 1. Estimated Annualized Burden Hours

Type of Respondent		No. of Respondents	No. Responses per Respondent	Average Burden per Response (in hours)	Total Burden Hours
State Epidemiologists		50	104	1	5, 200
County Health Officials		1600	12	1	19,200
Total					24,400

The mean hourly wage is based on the United States national average for 2012 taken from the Bureau of Labor Statistics website (www.bls.gov).

Exhibit 2. Estimated Annualized Burden Costs

Total Burden Hours	Hourly Wage Rate	Total Respondent Costs
24,400	$22.01	$537,044

*May 2012 National Occupational Employment and Wage Estimates for All Occupations

3. Estimate of Other Total Annual Cost Burden to Respondents or Record

Keepers.

There are no capital or maintenance costs to the respondents.

14. Annualized Cost to the Government

The government costs include personal costs for federal staff and contrator staff involved in operating and mainitaining the Epi-X web system, the staff involved in project oversight and development of this IC, and project staff engaged in the deployment of an information collection tool during a specific public health response. IC development involves input from across the agency and equals approximatley 10% of a GS-13 public health analyst, 10% of a GS-14 scientist, and 10% of a GS-15 scientist. Project oversight, survey intiation, data analysis, results compilation, and report writing during one 48 day incident response involves approximatley: 10% of two GS-14 Scientist and 10% of one GS-15 scientist during an average 48 day response period, times four responses per year. (48 days is 13% of 365 days x 10% of time during that 48 days). Calculation based on a GS grade Step 5 base + locality pay 5 x 25% for benefits) . The total cost to the Federal government is $503,246.00.

Exhibit 3. Annualized Cost to the Federal Government

Labor:
CDC personnel for Epi-X system management 100% GS-13	$121, 123.00
Contractor labor for Epi-X system management	$96,500.00
CDC personnel for ICR development including contribution from programs for survey tool development	$42,000.00
CDC personnel for response incident project oversight base 2.6% of GS-14 scientist (2.6% is 1.3% x 2 GS-14) and 1.3% of a GS-15 scientist is approximately $6000.00 x 4 responses per year	$24,000.00
Annualized cost to the Federal government	$283,623.00

15. Explanation for Program Changes or Adjustments

This is a program change request for an ICR request for revisions. There is no change in burden hours. This ICR is being revised to 1) remove verbiage limiting data collection to activation of the Incident Management Structure (IMS), 2) broaden categories under which data may be collected to increase its utilization, and 3) provide clarity regarding the data elements.

The total number of burden hours will remain the same as an estimated 24, 200 hours using the following calculation 50 states x 100 questionnaires/ year x 1 hour/questionnaire = 5000 burden hours for state health officials and 12 questionnaires /year x 1 hour questionnaire x 1600 county health officials (approximately half of US counties) = 19,200 burden hours for county health officials. This figure is a worst case figure reflecting multiple or long term public incidents such as an influenza pandemic where there is a requirement for CDC to stay up-to-date and it contact with state and local health partners on the current status and epidemiology of a public health incident.

This ICR for revisions is based on the number of potential public health incidents that would impact a public health jurisdiction at the state or county level. This represents the burden of compiling and validating public health incident specific data from that jurisdiction with up to 100 requests per year at the state level and 12 requests per year estimated for a local county public health office.

16. Plans for Tabulation and Publication and Project Time Schedule

The data collected under this generic ICR will be used to provide information that is necessary in understanding and responding to specific public health incidents. The Program/Project Officer working with the incident specific epidemiologists will outline plans for tabulation and publication of incident specific data collection as well as the incident specific project time schedule. The collection of data, as soon as possible after the public health emergency, is critical and is the responsibility of the Program/Project Officer. Any publication derived from the public health emergency is subject to review by the State or local health departments, CDC or foreign countries.

Exhibit 4: Individual Public Health Incident ICR Project Time Schedule bases on the average length of a CDC Public Health Response of 48 days

Activity	Time Schedule
Pre-notification Epi-X e-mail sent to Public Health Officials potentially in anticipation of , during or following the incident	Within 1 week in anticipation of, during or following a public health incident
Epi-X Initial Incident Specific data collection initiated	Within 2 weeks in anticipation of, during or following a public health incident (Day 14 of an average 48 day response))
Preliminary data analysis, assessment and distribution
Follow-up with Epi-X Public Health Officials engage in Incident Specific Public Health Response	Within 3 weeks after CDC’s EOC is activated (Day 21)
Epi-X Second Incident Specific Data Collection – (if needed)	Within 4 weeks after CDC’s EOC is activated (Day 28)
Data analysis and assessment	Within 5 weeks after CDC’s EOC is activated (Day 35)
Epi-X Third Incident Specific Data Collection (if needed)	Within 6 weeks after CDC’s EOC is activated (Day 42)
All data collection completed	1 month after CDC EOC is deactivated – work reverts to program
Data cleaning, coding and analysis	5-7 months after CDC EOC is deactivated
Completion of Evaluation Reports and Review	8-10 months after CDC EOC is deactivated
Publication and Dissemination of Incident Epidemiology Summary	11-12 months after CDC EOC is deactivated

17. Reason(s) Display of OMB Expiration Date is Inappropriate

We are not requesting an exemption to the display of the expiration date.

18. Exceptions to Certification for Paperwork Reduction Act Submissions

There are no exceptions to the certification.

1 The Strategic National Stockpile is a national repository of antibiotics, antivirals, chemical antidotes, antitoxins, life-support medications, IV administration equipment, airway maintenance supplies, and medical/surgical items managed by CDC. During a public health emergency, State and local public health systems and resources may become overwhelmed. The SNS is designed to supplement and re-supply state and local public health agencies in the incident of such an emergency.

19