Sup Statement NCHS Emergency Clearance Jan11_2017

Supporting Statement

National Center for Health Statistics (NCHS) Confidentiality Pledge Revision Notice

Request for OMB approval of an Emergency ICR

Contact Information

Susan G. Queen, Ph.D.

Office of Planning, Budget, and Legislation

National Center for Health Statistics

3311 Toledo Road, Room 2590

Hyattsville, MD 20782

301-458-4281

[email protected]

January 11, 2017

SUPPORTING STATEMENT

TABLE OF CONTENTS

A. Justification 4

1. Circumstances Making the Collection of Information Necessary 4

2. Purpose and Use of the Information Collection 5

3. Use of Information Technology and Burden Reduction 5

4. Efforts to Identify Duplication and Use of Similar Information 5

5. Impact on Small Businesses or Other Small Entities 5

6. Consequences of Collecting the Information Less Frequently 5

7. Special Circumstances Relating to the Guidelines for 5CFR1320.5 6

8. Comments in Response to the Federal Register Notice and Efforts to Consult Outside the Agency 6

9. Explanation of Any Remuneration to Respondents 6

10. Protection of the Privacy and Confidentiality of Information Provided by Respondents 6

11. Institutional Review Board (IRB) and Justification for Sensitive Questions 6

12. Estimates of Annualized Burden Hours and Costs 6

13. Estimate of Other Total Annual Cost Burden to Respondents or Record Keepers 7

14. Annualized Cost to the Federal Government 7

15. Explanation for Program Changes or Adjustments 7

16. Plans for Tabulation and Publication and Project Time Schedule 7

17. Reason(s) Display of OMB Expiration Date is Inappropriate 7

18. Exceptions to Certification for Paperwork Reduction Act Submissions……………………..7

Supporting Statement

National Center for Health Statistics (NCHS) Confidentiality Pledge Revision Notice

•This emergency clearance is being used to obtain Paperwork Reduction Act (PRA) clearance from OMB for the NCHS Information Collections Requests (ICRs) listed in the table below, in order to implement a revised confidentiality pledge that is resulting from mandatory implementation of the Einstein monitoring by the Department of Homeland (DHS) as mandated by the Cybersecurity Act of 2015.

•This single ICR is being submitted to update the NCHS’s confidentiality pledge within each of the ICRs listed in the table below. Otherwise, the respective content, scope, burden, and expiration dates related to the respective ICRs will remain unchanged.

•The methodological designs within the individual ICRs captured by this submission will not change.

•The subpopulation studies within the individual packages will not change.

•The analysis plans within the individual ICRs captured by this submission will not change.

This is an emergency request for a new information collection to allow for the revision of the NCHS Confidentiality Pledge.

As per OMB instruction, this single ICR is being submitted to update the NCHS confidentiality pledge for all of the packages listed below.

OMB Control Number	Title of Information Collection
0920-0119	National Ambulatory Medical Care Survey Supplement on Culturally and Linguistically Appropriate Services (NAMCS CLAS)
0920-0212	National Hospital Care Survey
0920-0213	NCHS: National Vital Statistics Report Forms
0920-0214	National Health Interview Survey
0920-0215	Application Form and Related Forms for the Operation of the National Death Index
0920-0217	NCHS Application for Vital Statistics Training Form
0920-0222	NCHS Questionnaire Design Research Laboratory
0920-0234	National Ambulatory Medical Care Survey (NAMCS)
0920-0278	National Hospital Ambulatory Medical Care Survey
0920-0314	National Survey of Family Growth
0920-0729	Customer Surveys Generic Clearance for the National Center for Health Statistics
0920-0943	Data Collection for the Residential Care Community and Adult Day Services Center Components of the National Study of Long-term Care Providers
0920-0950	National Health and Nutrition Examination Survey
0920-1015	The National Ambulatory Medical Care Survey (NAMCS) National Electronic Health Record Survey (NEHRS)
0920-1030	Developmental Studies to Improve the National Health Care Surveys
0920-1063	NAMCS Supplement of Primary Care Policies (NSPCP) for Managing Patients with High Blood Pressure, High Cholesterol, or Diabetes

Otherwise, the content, scope, burden, and current expiration dates of each respective ICR will remain unchanged.

Part A. Justification

1. Circumstances Making the Collection of Information Necessary

As part of the Consolidated Appropriations Act for Fiscal Year 2016 signed on December 17, 2015, the Congress included the Federal Cybersecurity Enhancement Act of 2015 (H.R. 2029, Division N, Title II, Subtitle B, Sec. 223). This Act, among other provisions, permits and requires the Secretary of the Department of Homeland Security to provide Federal civilian agencies’ information technology systems with cybersecurity protection for their Internet traffic. The technology currently used to provide this protection against cyber malware is known as Einstein 3A; it electronically searches Internet traffic in and out of Federal civilian agencies in real time for malware signatures.

When such a signature is found, the Internet packets that contain the malware signature are shunted aside for further inspection by DHS personnel. Because it is possible that such packets entering or leaving a statistical agency’s information technology system may contain a small portion of confidential statistical data, NCHS can no longer promise its respondents that their responses will be seen only by statistical agency personnel or their sworn agents. However, NCHS can promise, in accordance with provisions of the Federal Cybersecurity Enhancement Act of 2015, that such monitoring can be used only to protect information and information systems from cybersecurity risks, thereby, in effect, providing stronger protection to the integrity of the respondents’ submissions.

Consequently, with the passage of the Federal Cybersecurity Enhancement Act of 2015, the Federal statistical community has an opportunity to welcome the further protection of its confidential data offered by DHS’ Einstein 3A cybersecurity protection program. The DHS cybersecurity program’s objective is to protect Federal civilian information systems from malicious malware attacks. The Federal statistical system’s objective is to ensure that the DHS Secretary performs those essential duties in a manner that honors the Government’s statutory promises to the public to protect their confidential data. Given that the Department of Homeland Security is not a Federal statistical agency, both DHS and the Federal statistical system have been successfully engaged in finding a way to balance both objectives and achieve these mutually reinforcing objectives.

However, the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA, Title 5 of Public Law 107-347) promises that respondents’ data will be seen only by statistical agency personnel or their sworn agents. Since it is possible that DHS personnel could see some portion of those confidential data in the course of examining the suspicious Internet packets identified by Einstein 3A sensors, NCHS needs to revise its confidentiality pledge to reflect this process change.

The following NCHS statistical confidentiality pledge will now apply to the Information Collections whose Paperwork Reduction Act Office of Management and Budget numbers and titles listed at the beginning of this supporting statement.

We take your privacy very seriously. All information that relates to or describes identifiable characteristics of individuals, a practice, or an establishment will be used only for statistical purposes. NCHS staff, contractors, and agents will not disclose or release responses in identifiable form without the consent of the individual or establishment in accordance with section 308(d) of the Public Health Service Act (42USC 242m) and the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA, Title 5 of Public Law 107-347). In accordance with CIPSEA, every NCHS employee, contractor, and agent has taken an oath and is subject to a jail term of up to five years, a fine of up to $250,000, or both if he or she willfully discloses ANY identifiable information about you. In addition, NCHS complies with the Federal Cybersecurity Enhancement Act of 2015. This law requires the federal government to protect federal computer networks by using computer security programs to identify cybersecurity risks like hacking, internet attacks, and other security weaknesses. If information sent through government networks triggers a cyber threat indicator, the information may be intercepted and reviewed for cyber threats by computer network experts working for, or on behalf, of the government.

2. Purpose and Use of the Information

There will be no change from the currently underlying approved packages.

3. Use of Information Technology and Burden Reduction

There will be no change from the currently approved underlying packages.

4. Efforts to Identify Duplication and Use of Similar Information

There will be no change from the currently approved underlying packages.

5. Impact on Small Businesses or Other Small Entities

There will be no change from the currently approved underlying packages.

6. Consequences of Collecting the Information Less Frequently

There will be no change from the currently approved underlying packages.

7. Specific Circumstances Relating to the Guidelines of 5 CFR 1320.5

There will be no change from the currently approved underlying packages.

8. Comments in Response to the Federal Register Notice and Efforts to Consult Outside Agency

This ICR is being submitted under PRA emergency clearance procedures. NCHS will submit a regular 60-day FRN for publication and will consider public comments received in response to that document.

9. Explanation of Any Payment or Gift to Respondents

There will be no change from the respective currently approved underlying packages.

10. Assurance of Confidentiality Provided to Respondents

The following NCHS statistical confidentiality pledge will now apply to the Information Collections whose Paperwork Reduction Act Office of Management and Budget numbers and titles are listed below.

We take your privacy very seriously. All information that relates to or describes identifiable characteristics of individuals, a practice, or an establishment will be used only for statistical purposes. NCHS staff, contractors, and agents will not disclose or release responses in identifiable form without the consent of the individual or establishment in accordance with section 308(d) of the Public Health Service Act (42USC 242m) and the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA, Title 5 of Public Law 107-347). In accordance with CIPSEA, every NCHS employee, contractor, and agent has taken an oath and is subject to a jail term of up to five years, a fine of up to $250,000, or both if he or she willfully discloses ANY identifiable information about you. In addition, NCHS complies with the Federal Cybersecurity Enhancement Act of 2015. This law requires the federal government to protect federal computer networks by using computer security programs to identify cybersecurity risks like hacking, internet attacks, and other security weaknesses. If information sent through government networks triggers a cyber threat indicator, the information may be intercepted and reviewed for cyber threats by computer network experts working for, or on behalf, of the government.

11. Justification for Sensitive Questions

There will be no change from the respective currently approved underlying packages.

12. Estimates of Annualized Burden Hours and Costs

There will be no change from the currently approved underlying packages.

13. Estimates of Other Total Annual Cost Burden to Respondents or Record Keepers

There are no capital/start-up costs in any of the respective currently approved underlying packages.

14. Annualized Cost to the Federal Government

There will be no change from the currently approved underlying packages.

15. Explanation for Program Changes or Adjustments

There will be no change in respondent burden for the currently approved underlying packages by the addition of the revised confidentiality language.

16. Plans for Tabulation and Publication and Project Time Schedule

There will be no change from the currently approved underlying packages.

17. Reason(s) Display of OMB Expiration Date is Inappropriate

No changes to current requests not to display the expiration dates for the currently approved packages.

18. Exceptions to Certification for Paperwork Reduction Act Submissions

There are no exceptions to the certification.

Part B – Statistical Methods

NCHS has determined that Part B is not needed for this ICR, as there are no changes to the statistical methods from those in the currently approved underlying packages.