Data Restriction Agreement

Attachment D3

AGREEMENT TO ABIDE BY RESTRICTIONS ON RELEASE OF DATA RELATED TO PREGNANCY AND INFANT OUTCOMESFOLLOWING ZIKA VIRUS INFECTION COLLECTED AND MAINTAINED BY THE PREGNANCY AND BIRTH DEFECTS TASK FORCE, EMERGENCY OPERATIONS CENTER, CENTERS FOR DISEASE CONTROL AND PREVENTION (CDC)

I, ___________________________, understand that data collected by the Centers for Disease Control and Prevention (CDC) through the Zika Virus Pregnancy and Infant Outcomes Surveillance and related surveillance activities, projects, and case investigations under Sections 304,306, and 307 of the Public Health Service Act (42 U.S.C. 242b, 242k, and 242l) are protected at the national level by an Assurance of Confidentiality (Section 308(d) of the Public Health Service Act, 42 U.S.C. 242m(d)), which prohibits disclosure of any information that could be used to directly or indirectly identify any individual on whom a record is maintained by CDC. This prohibition has led to the formulation of the following guidelines for release of Zika case reports and supplemental data collected on such persons to which, in accepting access to data not considered public use, I agree to adhere. These guidelines represent a balance between potential for inadvertent disclosure and the need for the CDC to be responsive to information requests having legitimate public health application. In particular, variables that identify geographic units or facilities have the potential to indirectly identify individuals.

Therefore, I will not release, either inside or outside CDC, state/territorial-, MSA-, city,- county-, or other geographic area-specific data in any format (e.g., publications, presentations, slides, interviews) without the consent of the appropriate state or local agency, except as consistent with the format described in this document and related Zika Response standard operating procedures. Specifically, I will abide by restrictions on the release of data in accordance with the principles of the Assurance of Confidentiality for Zika surveillance and surveillance-related data authorized under Section 308d of the U.S. Public Health Service Act. I will also comply with the terms of the Memorandum of Understanding with INS in Colombia regarding data sharing and publication.

Covered Data Collections

I understand that this agreement applies to data collected through each of the following data collection systems and activities:

U.S. Zika Pregnancy Registry (USZPR)

Zika Active Pregnancy Surveillance System (ZAPSS)

Zika-related Active Birth Defects Surveillance System (ZABDS)

Zika Virus RNA Persistence in Pregnant Women and Congenitally Infected Infants in Puerto Rico (ZiRP)

Congenital Infection and Developmental Outcomes in Infants Prenatally Exposed to Zika (CIDPEZ)

Proyecto Vigilancia de Embarazadas con Zika (VEZ)

Zika en Embarazadas y Niños en Colombia (ZEN)

Case Investigations of Microcephaly and Pediatric Infections in Colombia

Levels of data release:

• National and regional level — I am permitted to release national and regional aggregate data without cell size or denominator restrictions. I will only release these data for statistical reporting and analysis, and will make no attempt to link these data with other data sets or information for the purpose of identifying an individual.

• State, territory, and dependent area level (including any of the 50 States, the District of Columbia, and any US territory or freely associated state — I will not release any information without the explicit jurisdictional permission from the state, District of Columbia, or the territory or dependent area from which the data originated. With explicit permission, I am permitted to release one-way frequencies and two-way stratifications of variables of interest (including sex, age group, race/ethnicity and transmission category) by location and year (e.g., living Zika cases by year*state *sex*race). However, small cell counts and estimates based on small cell counts (rates, proportions and simple ratios) must be suppressed to ensure confidentiality and reliability of estimates, according the rules outlined below.

• Suppression of Cell Counts to Protect Confidentiality -- Data counts will be suppressed when numerators are <5 if presenting them would divulge potentially identifiable information (e.g., cells with 1 – 4 will not be presented in conjunction with demographic information, such as state of residence, and maternal age, race/ethnicity, marital status; or with information on dates of travel, treatment, or expected delivery). Guidance for removing identifying information is available at: http://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf.

  • When cell counts are suppressed for this reason, a notation in either technical notes or footnotes will read “Cell details are not displayed because of small numbers (n = 1–4), which do not meet standards for maintaining confidentiality.”

  • If the totals for all strata could inadvertently disclose a case through back-calculation by subtraction, secondary or complementary suppression will be done by either 1) combining two or more categories of data (e.g., aggregation of values within the stratification parameter) or 2) excluding all data in a subcategory (e.g., blocking disaggregation below a pre-selected value for the stratification parameter) across multiple states, territories or dependent areas.

  • Case reports from which potentially identifying information has been removed are not subject to the suppression rule.

  • Any requests for data at this level will require permission by the applicable health department.

• Suppression of Cell Estimates to Ensuring Reliability – Rates, proportions, and simple ratios will be suppressed if they are based on fewer than 20 events; 20fewer corresponds to a relative standard error (RSE) of 23 percent or greater.

  • When estimates are suppressed for this reason, a notation in either technical notes or footnotes will read “Figure does not meet standards of reliability or precision; based on fewer than 20 events in the numerator the relative standard error is ≥23%.”

Variables permitted for release: — Variables listed below are permitted for public release. Any requests for variables other than those listed below will require approval by the CDC EOC Incident Manager, Zika Response while the EOC remains activated. Once the CDC EOC is fully deactivated, requests will require approval from the designated Division Director responsible for data integrity for the registries.

Data variables permitted for public release include:

General

• Location (e.g. U.S., region) based on standard definitions

• Year (year of diagnosis [ Zika case classifications], death, prevalence, or report)

Demographic/transmission

• Age group

  • pregnant women: 5-year age groups, at diagnosis, or calculated age at end of year for prevalence or at death for deaths

  • infants and children < 2 year: group by month of age, at diagnosis, or at death

  • children ≥ 2 years: group by single year of age, at diagnosis, or at death

• Race/ethnicity (based on OMB classification; Hispanic/Latino vs. non-Hispanic/Latino; and American Indian/Alaska Native, Asian, Black /African American, Native Hawaiian/Other Pacific Islander, or White: https://www.whitehouse.gov/sites/default/files/omb/assets/information_and_regulatory_affairs/re_app-a-update.pdf)

• Sex

• Transmission route

• Pregnancy outcome category (live birth versus pregnancy loss)

Data release and publication:

• I understand that release of data not specifically permitted by this agreement is prohibited unless written permission is first obtained from one of the Pregnancy and Birth Defects Task Force Leads and the appropriate state, territorial or local agency. Once CDC’s EOC is no longer activated for the 2016 Zika Virus Response, permission must be obtained from the Division Director overseeing the registries and the appropriate state, territorial or local agency.

• When presenting or publishing state-, city-, county-, MSA-, or dependent area-specific data in accordance with the restrictions outlined above, I will inform the appropriate state(s) and local health department(s) in advance of the release of state or local data, so as to afford them the opportunity to anticipate local queries and prepare their response.

• When presenting or publishing data from surveillance-related studies, investigations, or evaluations, I will adhere to the principles and guidelines outlined in this agreement and related standard operating procedures of the registries under the auspices of the Pregnancy and Birth Defects Task Force, or the appropriate Division Director once the Zika EOC deactivates.

Release of geocoded ZIKA surveillance data:

• Any re-release of geocoded Zika surveillance data that identifies the geographic area below the state or for territory or country level for dependent areas is subject to written approval of the applicable health department(s) (re-release of data can be in the form of peer and non-peer reviewed manuscripts, technical reports, manuals, and presentations).

• All publications using geocoded data must be cleared through official Zika Response clearance.

Publication of a manuscript in a journal or as part of conference proceedings requires a CDC clearance of that manuscript, even if an abstract for that manuscript was previously cleared.

Data Security:

1. I will not give my access password to any person.

2. I will treat all data at my desk site confidentially and maintain all CDC records that could directly or indirectly identify any individual in a locked file cabinet. Sensitive identifying information from special case investigations will only be maintained in a locked file cabinet in a locked room which has restricted access.

3. I will keep all hard copies of data runs containing small cells locked in a file cabinet when not in use and shred them when they are no longer necessary to my analysis.I will not produce a personal “back-up” data file of Zika case surveillance data or related databases maintained by CDC.

4. I will not remove electronic files, records, or databases from the worksite. When accessing electronic files, records, or databases, I will only do so on CDC-provided equipment through CITGO or VPN.

5. I will not remove hard copies of case reports, survey instruments, laboratory reports, confidential communications, or any records containing sensitive data and information or the like from the worksite,, unless it is necessary for the collection of the data. If these items are removed, they will be kept in a locked briefcase and in my possession at all times.

6. I will keep secure at all times tabulations or data in any format that could directly or indirectly identify any individual.

7. I will maintain confidentiality of records on individuals in all discussions, communications, e-mails, tabulations, presentations, and publications (and the like) by using only the minimum information necessary to convey critical information and describe the individual case.

8. I will not release data to the press or media without pre-screening of the request by the Joint Information Center-Communications, Zika Response, the leadership of the Emergency Operations Center, or the Division Director once the Zika EOC deactivates.

9. I am responsible for obtaining IRB review of projects when appropriate.

User ID: __________________

Purpose of access (provide a brief statement):

Data base(s) to be accessed:

Estimated time needed for data access/analysis:

I have read this document, “Agreement to abide by restrictions on release of Zika Surveillance and Surveillance-related data...” and the attached document “Policy for Release of Zika Pregnancy and Infant Outcomes Surveillance and Surveillance-Related Data Collected and Maintained by the Centers For Disease Control And Prevention (CDC),” and I agree to abide by them. Failure to comply with this agreement may result in disciplinary action, including possible termination of employment.

Signed: __________________________________ Date: ______________________

(Requestor)

CIO, Division, Branch _______________________________

Approved: ________________________________ Date: ______________________

Leader, Pregnancy and Birth Defects Task Force, Zika Response, Emergency Operations Center, or designee