Data Use Agreement CDC and MPHI

Data Use Agreement

between the CDC Sudden Unexpected Infant Death (SUID) and Sudden Death in the Young (SDY) Case Registries

and the National Center for Fatality Review and Prevention

Background

The purposes of the SUID Case Registry are to compile comprehensive population-based data about the circumstances for all SUID cases, improve the completeness and quality of SUID case investigations and monitor SUID trends using standardized definitions. By building upon the infrastructure established for the SUID Case Registry, the Centers for Disease Control and Prevention (CDC) and the National Institutes for Health (NIH) developed the SDY Case Registry to establish incidence, understand the causes and risk factors for infants, children and young adults who die suddenly and unexpectedly, and to inform strategies to prevent future deaths.

Both registries build upon existing Child Death Review programs so that these teams can conduct population-based SUID surveillance with improved data quality more quickly. Grantees, like most Child Death Review programs, use the web-based Child Death Review Case Reporting System (CDR-CRS) supported by the National Center for Fatality Review and Prevention (NCFRP). CDC offers technical support and resources for grantees to improve case identification with more complete, accurate, and faster data.

Terms of this agreement:

1) CDC Use of SUID/SDY Case Registry Data:

• The NCFRP agrees to provide members of the CDC’s SUID/SDY Case Registry team with de-identifiable data from the CDR-CRS from the CDC funded jurisdictions. NCFRP staff will have access only to data submitted by participating states and their authorized data entry persons that have case identifiers removed using the HIPAA standards listed in Appendix A.

• Data will be transmitted to CDC on a quarterly basis, via a secure file transfer protocol site (SFTP). CDC Case Registry team will be responsible for ensuring the SFTP site is accessible and functional.

• The CDC will not attempt or permit others to use this data set to learn the identity of any individual mentioned in the data. If an individual’s identity is inadvertently discovered, CDC will inform NCFRP staff of the discovery, so they can prevent further discoveries. The CDC’s SUID/SDY Case Registry team will NOT inform anyone else of this knowledge.

• The CDC will not release nor permit others to release the data set or any part of it to any person other than the members of the CDC’s SUID/SDY Case Registry team who have completed a data usage agreement form.

• The CDC will store all electronic and hard copy data in a secure and confidential location that only CDC’s SUID/SDY Case Registry team members have access to. Electronic data will be backed up on a secure server per CDC protocol.

• All oral or written presentations of the results of the analyses will include an acknowledgment of each funded jurisdiction, the CDC, and NCFRP. The CDC will only report aggregated data with cell counts of six or more cases.

2) External Researchers’ Use of SUID/SDY Registry Data:

• External researchers may request access to de-identified SUID/SDY Case Registry data using the established NCFRP data release procedure. Per the NCFRP Data release policy, any release of data will be subject to a signed Contract for Access to and Use of Data between NCFRP and an authorized representative of the Receiving Institution or the individual themselves, in the case of independent researchers.

• The CDC SUID/SDY Case Registry team will maintain a list of research projects using registry data that are currently underway and planned.

• Any updates to the project list will be immediately shared with NCFRP in writing (via email). If any project on CDC’s research list is not completed (first full draft circulated to all co-authors) within the timeframe negotiated between NCFRP and CDC. The project will be considered open to external researchers. If no external researcher expresses interest, however, CDC may still choose to conduct said research project.

• Upon receipt of any request by an external researcher for use of SUID/SDY Case Registry data, NCFRP will notify the CDC SUID/SDY Case Registry Team. This notification will take place prior to review and approval by the NCFRP data review committee; and will include the years of data being requested, the principle investigator, title of project, and description of the research questions and objectives.

The NCFRP data review committee will include representatives from the CDC SUID/SDY Case Registry team, including an epidemiologist.

• Any questions as to whether a given project conflicts with current/planned CDC research will be posed to the CDC SUID/SDY Case Registry team for discussion and determination. If needed, NCFRP and CDC Registry staff will discuss proposals via conference call to aid in making a determination of non-conflict.

3) Joint authorship between CDC and NCFRP of SUID/SDY Case Registry Data

• Any research by the CDC SUID/SDY Case Registry Team or NCFRP that uses SUID/SDY Case Registry data and includes reference to one or both the SUID or SDY Registries will include joint authorship between NCFRP and the CDC SUID/SDY Case Registry Team. Team members may voluntarily remove themselves from co-authorship at any point.

• All co-authors will abide by International Committee of Medical Journal Editors (ICMJE) criteria for authorship: (http://www.icmje.org/recommendations/)

  • Substantial contributions to the conception or design of the work; or the acquisition, analysis, or interpretation of data for the work; AND

  • Drafting the work or revising it critically for important intellectual content; AND

  • Final approval of the version to be published; AND

  • Agreement to be accountable for all aspects of the work in ensuring that questions related to the accuracy or integrity of any part of the work are appropriately investigated and resolved.

• Contributors who meet fewer than all 4 of the above ICMJE criteria for authorship will not be listed as authors, but will be acknowledged.

3) Renewal and revision of this agreement :

• The terms of this agreement may be revised at any time, pending review and agreement by both CDC and NCFRP. At a minimum, the terms will be reviewed and updated, as necessary, at the start of each CDC funding cycle.

By the authority vested in me as a representative of the CDC’s SUID/SDY Case Registry team, my signature indicates the CDC’s SUID/SDY Case Registry team agreement to comply with these requirements.

Name:____________________________

Title:_____________________________

Organization: ______________________

Signature: ________________________

Date:_______________________________

By the authority vested in me as a representative of MPHI/ NCFRP my signature indicates agreement to comply with these requirements.

Name:____________________________

Title: _____________________________

Organization: ______________________

Signature: ________________________

Date: _____________________________

Appendix A

HIPAA Required Elements to De-Identify Case Data^*

The CDR-CRS supports two types of data downloads: identified and de-identified. NCFRP staff and researchers who have been approved by the NCFRP will receive only de-identified data. The CDR-CRS variables that will be removed in de-identified downloads are listed below.

The CDR-CRS contains many free text fields (most often in the ‘specify’ or ‘describe’ text fields). The CDR-CRS also provides users the opportunity to provide more detail surrounding the circumstances of the death in Section N: Narrative text field. When the Narrative, ‘specify,’ and/or ‘describe’ text fields are included in a de-identified download, the Narrative, ‘describe,’ and ‘specify’ text fields SHOULD NOT contain any HIPAA Identifiers.

HIPAA Identifiers include names; all geographical subdivisions smaller than a state; all elements of dates (except year) for dates directly related to an individual; phone numbers; fax numbers; electronic mail addresses; social security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate/license numbers; vehicle identifiers and serial numbers; device identifiers and serial numbers; web universal resource locators; internet protocol address numbers; biometric identifiers; full face photographic images; and any other unique identifying number, characteristic or code.

Identifying information can be entered into the CDR-CRS element fields in the list below, including free text fields associated with the listed fields, because all the listed fields and their related text fields will be removed from every de-identified download. However, Users should be instructed by the Holder not to enter any identifying information in other free text fields, including Section N: Narrative text field, because these text fields may be included in de-identified downloads. NCFRP cannot review free text fields in de-identified downloads to assure that they contain no HIPAA Identifiers.

HIPAA Required Elements to De-Identify Case Data

The CDR-CRS elements listed below will be removed for all persons accessing de-identified case data:

Introduction: Case Definition

Case number

County of review

Review team number

Sequence of review

Death certificate number

Birth certificate number

Medical examiner/Coroner number

Date CDR team notified of death

Section A: Child Information

Child first name

Child middle name

Child last name

Child name: unknown

Date of birth: month, day, and year

Date of birth: unknown

Date of death: month and day

Date of death: unknown

Residential address: unknown

Residential address: street

Residential address: apartment

Residential address: city

Residential address: county

Residential address: zip

Section D: Incident Information

Date of incident

Date of incident: same

Date of incident: unknown

Time of incident

Time of incident: am or pm

Time of incident: unknown

Incident county

Death county

Section L: Review Meeting Process

Date of first CDR meeting

Section M: SUID and SDY Case Registry

Date of first Advanced Review meeting

Date of SUID Case Registry data entry complete

Section O: Form Completed By

Form completed by – Person’s name

Form completed by – Title

Form completed by – Agency

Form completed by – Phone

Form completed by – Phone extension

Form completed by – Email

Form completed by - Date

Date of quality assurance completed by State

My CDR Outcomes

My CDR Outcomes – Person’s name

My CDR Outcomes - Team of review

^*Source: Code of Federal Regulation Section 164.514(b)(2)(i).

*

CDC_MPHI Data Use Agreement