AoC

Attachment 6. Assurance of Confidentiality for HIV/AIDS Surveillance Data
ASSURANCE OF CONFIDENTIALITY
FOR THE NATIONAL HUMAN IMMUNODEFICIENCY VIRUS (HIV)
SURVEILLANCE SYSTEM (NHSS) AND SURVEILLANCE-RELATED
DATA (INCLUDING SURVEILLANCE INFORMATION, CASE
INVESTIGATIONS SUPPLEMENTAL SURVEILLANCE PROJECTS,
RESEARCH ACTIVITIES, AND EVALUATIONS)
The national HIV surveillance program is being coordinated by the HIV
Incidence and Case Surveillance Branch (HICSB) and the Behavioral and Clinical
Surveillance Branch (BCSB) of the Division of HIV/AIDS Prevention (DHAP),
in the National Center for HIV/AIDS, Viral Hepatitis, STD and TB Prevention
(NCHHSTP), a component of the Centers for Disease Control and Prevention
(CDC), an agency of the United States Department of Health and Human
Services. The surveillance information requested by CDC consists of reports of
persons with suspected or confirmed HIV infection at any clinical stage of
disease, including children born to mothers infected with HIV, and reports of
persons enrolled in studies designed to evaluate the surveillance program. The
information collected by CDC is abstracted from laboratory, clinical, and other
medical or public health records of suspected or confirmed HIV cases; and from
surveys or investigations that interview persons in recognized HIV risk groups or
known to have a diagnosis of HIV.
Surveillance data collection is conducted by state and territorial health
departments which forward information to CDC after deleting patient and
physician names and other identifying or locating information. Records
maintained by CDC are identified by computer-generated codes, patient date of
birth, and a state/city assigned patient identification number. The data are used
for statistical summaries and research by CDC scientists and cooperating state and
local health officials to understand and control the spread of HIV. In rare
instances, expert CDC staff, at the invitation of state or local health departments,
may participate in research or case investigations of unusual transmission
circumstances or cases of potential threat to the public health. In these instances,
CDC staff may collect and maintain information that could directly identify
individuals.
Information collected by CDC under Section 304 and 306 of the Public Health
Service Act (42 U.S.C. 242b and 242k) as part of the HIV surveillance system
that would permit direct or indirect identification of any individual or institution
on whom a record is maintained, and any identifiable information collected during
the course of an investigation on either persons supplying the information or
persons described in it, is collected with a guarantee that it will be held in
confidence, will be used only for the purposes stated in this Assurance, and will
not otherwise be disclosed or released without the consent of the individual or
institution in accordance with Section 308 (d) of the Public Health Service Act

(42 U.S.C. 242m(d)). This protection lasts forever, even after death. Information
that could be used to identify any individual or institution on whom a record is
maintained by CDC will be kept confidential. Full names, addresses, social
security numbers, and telephone numbers will not be reported to this national HIV
surveillance system. Medical, personal, and lifestyle information about the
individual, and a computer-generated patient code will be collected.
Surveillance information reported to CDC will be used without identifiers
primarily for statistical and analytic summaries and for evaluations of the
surveillance program in which no individual or institution on whom a record is
maintained can be identified, and secondarily, for special research investigations
of the characteristics of populations suspected or confirmed to be at increased risk
for infection with HIV and of the natural history and epidemiology of HIV. When
necessary for confirming surveillance information or in the interest of public
health and disease prevention, CDC may confirm information contained in case
reports or may notify other medical personnel or health officials of such
information; in each instance, only the minimum information necessary will be
disclosed.
No CDC HIV surveillance or research information that could be used to identify
any individual or institution on whom a record is maintained, either directly or
indirectly, will be made available to anyone for non-public health purposes. In
particular, such information will not be disclosed to the public; to family
members; to parties involved in civil, criminal, or administrative litigation, or for
commercial purposes; to agencies of the federal, state, or local government. Data
will only be released to other components of CDC, or to agencies of the federal,
state, or local government, or to select members of the public for public health
purposes in accordance with the policies for data release established by the
Council of State and Territorial Epidemiologists.
Information in this surveillance system will be kept confidential. Only authorized
employees of DHAP in HICSB, BCSB, and in the Quantitative Sciences and Data
Management Branch (QSDMB), their contractors, guest researchers, fellows,
visiting scientists, authorized external collaborating researchers, research interns,
and graduate students who participate in activities jointly approved by CDC and
the sponsoring academic institution, and the like, will have access to the
information. Authorized individuals are required to handle the information in
accordance with procedures outlined in the Confidentiality Security Statement for
the National Human Immunodeficiency Virus (HIV) Surveillance System (NHSS)
and Surveillance-Related Data (including surveillance information, case
investigations, supplemental surveillance projects, research activities, and
evaluations).
Date: 2/26/2013