Dept Health Affairs IRB-Privacy Review-Approval

Document Title: The Millennium Cohort Family Study Follow-Up Survey 2014-15

Privacy Reviewer: DHA Privacy and Civil Liberties Office (Privacy Office)

Initial Review Date: January 27, 2014

Final Review Date: February 10, 2014

Disposition: Altered System of Records Notice (SORN) and Privacy Act Statement (PAS) Required (Survey fielding contingent upon publication of the altered SORN and provision of an appropriate PAS)

DHA Privacy and Civil Liberties Office (Privacy Office)

Internal Review Checklist

X Thorough analysis of the Survey Documentation

The DoD sponsor of The Millennium Cohort Family Study Follow-Up Survey 2014-15 (Survey) is the Naval Health Research Center, Deployment Health Research Department (NHRC). NHRC will operate as an Executive Agent when collecting responses from current and former spouses of active duty service members of the service branches (ADSMs) for use with this Survey. This analysis is based on the following documents:

• A Supporting Statement for Paperwork Reduction Act Submission for The Millennium Cohort Study [2. OMB 83I SUPPORTING STATEMENT_11-21-12];

• The Survey questions [6. 2014 Family FUP Survey OMB 25JUN13];

• An e-mail and postcard which ask invitees to complete this Survey [Family Invitation Email Example; Invitation Card Example];

• Reminders which ask invitees to complete this Survey [Postcard Example; Reminder Card Example];

• A letter that will be delivered with the paper form of this Survey [Cover Letter Example];

• A webpage that will be shown to participants before the online form of this Survey [family_loginscreen];

• A postcard thanking participants [National Military Family Month Postcard Example];

• A memorandum explaining why Social Security Number (SSN) usage will be permitted in conjunction with this Survey [7. Justification for the Use SSN];

• Documents from an Institutional Review Board (IRB) which state that personally identifiable information, including protected health information (PHI), (PII/PHI) about participants and their children may be disclosed to NHRC for use with this Survey [2. Spouse Records Approval (08-17-09); 3. Children Records Approval (01-03-13)];

• Approved Data Sharing Agreements (DSAs) which state that DHA may disclose PII/PHI about participants and their children to NHRC for use with this Survey [DSA #09-595C Approval; Executed DSA_DSAA #09-595B];

• Communications between Paul Rosenfeld of the Defense Manpower Data Center (DMDC) and Sandra Dennis of the Defense Health Cost Assessment and Program Evaluation Division of DHA [NHRC response to DMDC 2nd review (9-10-13))];

• Responses to questions asked by the Privacy Office [1. Response to Privacy Office re Family (11-27-13); 1. Millennium Questions 12-18-13];

• A Federal Register publication about this Survey which was done to comply with the Paperwork Reduction Act of 1995 [FR Pub Millennium]; and

• N06150-5, Millennium Cohort Study (June 16, 2003, 68 FR 35657) (N06150-5); the Department of the Navy (Navy) system of records notice (SORN) that will be altered for use with this Survey [SORN N06150-5]

(collectively, the “Survey Documentation”). This Privacy Act Review, and its Analysis and Recommendations, is limited to the 2014-2015 follow-up survey intended for current and former spouses of ADSMs and the PII/PHI that will be analyzed in conjunction with the responses. This review does not consider previously fielded surveys, surveys intended for ADSMs, nonresponse surveys, focus groups, the validity of any DSAs or IRB documents, or webpages apart from those used to collect survey responses. The Privacy Office assumes, and therefore did not review if, this Survey’s use of the SSN complies with DoDI 1000.30, Reduction of Social Security Number (SSN) Use Within DoD. The Privacy Office also assumes, and therefore did not review if, this surveying of human research subjects complies with all requirements related to the protection of those subjects.

X Statement of purpose check

The Millennium Cohort Study is designed to develop a long-term profile of health change among current and former ADSMs and to better define the nature of, and risk factors for, post war illness among current and former ADSMs. This related Survey is designed to investigate the impact of military service and deployment on the health of current and former ADSM spouses and their co-resident children and the quality of the relationships between current and former ADSMs, spouses and their children. DoD and U.S. Department of Veterans Affairs (VA) policy makers and researchers will use the results of this Survey, and other surveys done as part of the Millennium Cohort Study, to develop prevention and treatment strategies that will help maintain and improve the well-being of current and former ADSMs and their families.

X Timeframe check

This Survey is scheduled to be fielded from approximately May 2014 to May 2016.

X Beneficiaries affected check

Between June 2011 and April 2013 a survey was fielded to a pool of ADSMs (Service-Member Baseline). That pool was oversampled for women, those in the Reserve or Guard, and those who were married. If an ADSM completed the Service-Member Baseline and was married, his or her spouse was invited to complete a survey (Family Baseline). Those who completed the Family Baseline and signed the consent included with that survey will be invited to complete this Survey. Participants who indicate they are no longer married may not be invited to complete any future follow-up surveys, but will be invited to complete this Survey.

Invitees may have relocated since completing the Family Baseline. For that reason, updated invitee contact information may be obtained from:

1. DMDC records;

2. The invitee when he or she completed the Family Baseline;

3. The invitee’s current or former spouse when he or she completed a Millennium Cohort Study survey;

4. The National Institute for Occupational Safety and Health, which acquires address information from the Internal Revenue Service and shares that information with NHRC for use with this Survey;

5. The US Postal Service’s change of address records; and

6. The invitee, or current or former spouse, when he or she received a postcard which requested updated contact information for use with this Survey or another Millennium Cohort Study survey.

The postcards are sent twice a year to those who participated in a prior Millennium Cohort Study survey. The Family Baseline asked participants to provide contact information for individuals who may know how to contact the participant if their address changes (alternate contacts). This Survey will not request alternate contacts and alternate contacts collected during the Family Baseline will not be used to locate Survey invitees.

Invitees may receive paper and/or e-mail invitations inviting them to complete this Survey. At most, one initial invitation and two reminders will be sent to each address before it will be assumed any invitees at that address have declined to participate in this Survey. These invitations may be tailored to specify the current or former service branch, or military separation status, of the invitee’s current or former spouse. E-mail invitations will include a hyperlink to this Survey and paper invitations will include both a paper form of this Survey and a pre-paid return envelope.

X Reporting by subgroup check

10,006 individuals completed the Family Baseline and signed the consent, making them eligible to complete this Survey. Approximately 6,804 invitees are expected to complete this Survey. Results may be subdivided according to the participant’s date of birth, race and ethnicity, and primary language. All reported results will include responses from at least 50 participants.

X Sampling check

Any sample of Survey results will contain responses from at least 50 participants.

X Miscellaneous/unique identifiers check

The paper and online form of this Survey will include the same questions and participants may choose to complete either form. This Survey branches such that different questions will be asked if the participant indicates he or she is married, separated/divorced, or widowed. Each branch ends with two pages of questions that request contact information (see pages 38-39, 50-51, and 61-62 of the paper form). Answers to all but one question on those pages will be maintained separate from the answers collected on all other pages (responses). The one exception is the question repeated on pages 39, 51, and 62 which asks if the participant wants to share any health concerns which were not covered in this Survey. That question will be moved to different pages and analyzed with the rest of the responses.

The responses may include the participant’s date of birth, height, weight, number of children, answers to free-response questions such as why the participant thinks their current or former spouse is still in the military, and other personal information. It will be analyzed and may be reported so long as each report involves aggregate information from at least 50 participants. The contact information may be used to invite participants to complete future surveys and receive a gift if they complete this Survey. It will be stored separate from the responses, accessed only by key personnel, and not analyzed or reported.

All participants received a randomly assigned number (Subject-ID) when they were invited to complete the Family Baseline and that same Subject-ID will be provided when they are invited to complete this Survey. Participants will be told to write that Subject-ID and last four digits of their SSN on the paper form of this Survey or provide those numbers when beginning or continuing the online form of this Survey. The Subject-ID will remain attached to the responses and contact information. It will be used to link responses provided during the Family Baseline, this Survey, and future surveys, and to determine if a participant has completed this Survey and should not receive reminders. It will also be used to link a participant’s responses to his or her contact information in order to then link the responses to other PII/PHI about the participant. The files linking the Subject-IDs to participants’ contact information will only be accessible to key personnel.

Responses may be linked to PII/PHI about the participant and his or her children. That PII/PHI may come from (1) personnel and medical records acquired from DMDC and DHA and (2) mortality information from the Armed Forces Institute of Pathology, the National Death Index, and the VA. If the participant is active duty, retired, or separated from military service, and received medical services from the VA, their responses may be linked to (1) their VA medical and personnel information, (2) the DoD Joint Theater Trauma Registry, and (3) the Navy/Marine Corps Trauma Registry.

Several contractors will be involved in this Survey:

• Epidemiologists may help develop quality measurement systems, develop written abstracts, papers, and presentations, and perform data analysis;

• Research psychologists may assist with abstracts, papers, presentations, and data analysis;

• Data Analysts may clean and analyze data;

• Study Coordinators may oversee operations, logistics, and the budget;

• Research Assistants may assist with processing, scanning, and verifying the responses;

• Fiscal Managers may oversee the budget;

• Database Managers may oversee and clean contact information, responses, and other information about the participant and his or her family;

• Web Developers may design any necessary websites; and

• Survey Methodologists may advise on Survey design and marketing materials.

Some contractors will have access to responses, contact information, and other PII/PHI about the participants and their children. NHRC is a DoD-covered entity subject to DoD 6025.18-R, DoD Health Information Privacy Regulation, which implements the Privacy Rule issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) within DoD, and all contractors entrusted with PHI for use with this Survey will be a business associate of NHRC for the purpose of receiving and using that PHI. Those contractors will delete all contact information, all responses, and other identifiable or de-identified information about participants or their families when their contract expires or is terminated. The Privacy Office assumes any other requirements written in a DSA will be followed when accessing, using, or disclosing PII/PHI subject to that DSA.

X Access to Survey check

This Survey will use security measures to limit the chance that a participant’s PII/PHI will be accidentally released when fielding this Survey. The paper form of this Survey will be provided with a pre-paid return envelope which does not state any PII/PHI about the participant. When that envelope is received by the Survey administrators, the responses will be separated from the contact information and the envelope will be destroyed. The online form of this Survey may only be accessed by a participant who provides their Subject-ID and the last 4 digits of their SSN. This log-in system allows intended participants to start, stop, and then continue a Survey at their convenience, but limits the chance that someone who accidentally receives or guesses a participant’s Subject-ID could access another's responses. All responses submitted online will be transmitted through a secure 128-bit encrypted connection which uses Secure Sockets Layer technology. The Survey software will not utilize persistent cookies and any collected IP addresses will not be linked to a participant’s response.

This Survey will use security measures to limit the chance that a participant’s PII/PHI will be accidentally released when maintaining that PII/PHI. Files containing responses will not include any contact information and only key personnel will have access to the files which link a Subject-ID a participant’s other contact information. Even so, all electronic files will be stored on DoD computers and all paper documents will be kept in locked files when not in use. All personnel involved in the study will be expected to adhere to information security practices and undergo regular training to remain vigilant in those practices.

X De-identification segregated from database creation or maintenance (cannot be the same party or is a HIPAA violation) check

NHRC may receive PHI about participants and their children which will be linked to a participant’s Survey responses. An IRB approved waiver allows disclosure of that PHI without first acquiring participants’ authorizations. That IRB appears to satisfy all requirements of DoD 6025.18-R C7.9, Standard: Uses and Disclosures for Research Involving Minimal Risk. NHRC has signed DSAs which further define how NHRC may use PHI owned and/or managed by DHA.

The Privacy Office assumes NHRC and its business associates will comply with the HIPAA Privacy Rule and DoD 6025.18-R when handling that PHI. Among other requirements, contractors will delete all contact information, all responses, and other identifiable or de-identified information about participants or their families when their contract expires or is terminated.

X Crosswalk collection – min. necessary vs. limited dataset vs. de-identified check

The Privacy Office assumes the PHI received by NHRC will be the minimum necessary to accomplish NHRC’s responsibilities. DSAs signed by NHRC to receive PHI owned and/or managed by DHA state that NHRC will receive the minimum amount of PHI necessary to accomplish the purposes set forth in those DSAs.

N/A Sponsors monitors the work of contractors check

All contractor personnel involved in the study will be expected to adhere to information security practices, and undergo regular training to remain vigilant in those practices. Specific oversight practices were not specified.

X All work product is owned by the government, if not, subject to destruction check

All contractors involved in this Survey will delete all contact information, all responses, and other identifiable or de-identified information about participants or their families when their contract expires or is terminated. The Privacy Office assumes that contractors will follow the HIPAA Privacy Rule and DoD 6025.18-R when receiving PHI for use with this Survey.

X “Not Totally Anonymous” check

Results will always be reported in aggregate form.

N/A Telephone collection check

X Verify accuracy of citations check

The Privacy Office assumes altered N06150-5, and any associated Privacy Act Statements (PASs), will comply with 5 U.S.C. 552a, The Privacy Act of 1974, as amended, and DoD 5400.11-R, Department of Defense Privacy Program. As such, the Privacy Office assumes altered N06150-5, and any related PASs, will include sufficient authority to collect PII/PHI for use with this Survey.

X Purpose crosswalk with SORN check

The Privacy Office assumes the uses of PII/PHI collected as part of this Survey will be compatible with the purposes of N06150-5 once it has been altered to comply with 5 U.S.C. 552a and DoD 5400.11-R.

X Privacy Act Statement is required for collection

The Privacy Office assumes PASs will be placed on the paper and online form of this Survey so it will be seen by participants before an answer to the first Survey question is collected. The Privacy Office assumes the PASs will reflect altered N06150-5 and comply with both 5 U.S.C. 552a and DoD 5400.11-R.

N/A Privacy Advisory is required for use

Point of Contact/Program Office – Submissions Certification
Criteria	Completed	Not Applicable
PAS Draft	Not Provided
Survey Instrument/Tool	X
DMDC Application		X
Any corresponding documents that would be material to the system/program.	X

Analysis:

NHRC determined that a SORN will be necessary to conduct this Survey and the Privacy Office accepts that determination. This indicates a Privacy Act system of records will be created in the course of this Survey. It also indicates that Survey responses cannot be collected from a participant until a SORN is published in the Federal Register, and the participant receives a PAS, both of which should comply with 5 U.S.C. 552a and DoD 5400.11-R. The Survey Documentation states that the current SORN for this collection is N06150-5. Reasons why N06150-5 does not currently apply to this Survey include, but are not limited to:

• The categories of individuals section (a) is limited to certain groups of current and former ADSMs, (b) states that follow-up Surveys will be delivered through the postal system, and (c) does not include anyone whose initial Survey was completed after 2007;

• The categories of records section does not mention (a) the addresses or phone numbers that will be collected as part of the contact information, (b) the Subject-IDs that will be assigned to each participant, or (c) dependent and spousal information;

• The purpose is limited to a select group of veterans;

• Retrievability is limited to the name and SSN of current and former ADSMs;

• The notification and record access procedures only address requests from current or former ADSMs; and

• The record source category section does not include the VA, National Institute for Occupational Safety and Health, US Postal Service, or postcards that will be sent to request address updates.

The Privacy Office also found that the storage section does not reference paper records yet responses will be received in paper form. However, the Survey Documentation indicates that the Navy will be revising N06150-5 to describe the participants, information collected, and the uses and disclosures of that information.

The Survey Documentation indicates that this Survey should not cause a HIPAA Privacy Rule concern. An IRB approved waiver allows disclosure of PHI to NHRC for use with this Survey without first acquiring participants’ authorizations. Specifically, signed consent was waived because the research will be minimal risk and involves no procedures for which written consent in normally required outside the research context. That IRB appears to satisfy all requirements of DoD 6025.18-R C7.9, Standard: Uses and Disclosures for Research Involving Minimal Risk. NHRC is a DoD-covered entity subject to DoD 6025.18-R, which implements the HIPAA Privacy Rule within DoD, and all contractors entrusted with PHI for use with this Survey will be a business associate of NHRC for the purpose of receiving and using that PHI. The DHA DSAs indicates that NHRC will receive the minimum amount of PHI necessary to accomplish the purposes set forth in the DSAs. The Privacy Office assumes any other HIPAA Privacy Rule and DoD 6025.18-R related requirements will be followed by NHRC and NHRC contractors when handling PHI.

DHA Privacy and Civil Liberties Office Recommendations:

Collecting responses from participants requires publication of a compliant SORN and providing participants a compliant PAS. The Privacy Office assumes (a) the Navy will alter N06150-5 to permit the collections, uses, and disclosures of PII/PHI that will occur during this Survey; (b) the Navy will draft PASs to notify participants about the collection of their responses; and (c) that all these documents will comply with 5 U.S.C. 552a and DoD 5400.11-R.

The Privacy Office recommends placing a compliant PAS before the first question in the paper and online form of this Survey so it will be seen by the participant before the first Survey question is answered. The Privacy Office notes that a PAS does not need to be provided before an individual is asked for information already known to DoD when used to validate the individual’s identity. The Privacy Office also recommends that a notification before the first Survey question inform participants that each Survey question is voluntary and may be skipped. Separate notification is not required if this is stated in a PAS placed as recommended by the Privacy Office.

The Privacy Office’s analysis and recommendations assume that the actual Survey documents, the methods used to solicit participants, and the manner in which this Survey will be conducted are in accordance with the statements made in the Survey Documentation. This includes altering N06150-5 and creating PASs that complies with 5 U.S.C. 552a and DoD 5400.11-R. It also includes compliance with applicable DSAs, the HIPAA Privacy Rule, and DoD 6025.18-R. If any of these assumptions, or any information provided in the Survey Documentation, is incorrect, the Privacy Office’s Analysis and Recommendations may change and may no longer be applicable to this Survey absent subsequent Privacy Office review.

MilCo Family Survey_Approved by DHA PO Chief 9

DHA Privacy and Civil Liberties Office-20140210