Privacy Act Checklist

Privacy Act Checklist

OMB control # 0920-1100

Identification of Behavioral and Clinical Predictors of Early HIV Infection

(Project DETECT)

Does the data collection involve collecting sensitive or personally identifiable information?

Data collected in Project DETECT involves sensitive information. Sensitive information includes questions on socio-demographics, medical care, HIV testing, pre-exposure prophylaxis, antiretroviral treatment, history of sexually transmitted disease, symptoms of early HIV infection, substance use and sexual behavior.

The collection of personally identifiable information is limited to the subset of participants in Phase 2 where study staff must collect contact information on a paper chart in order to follow-up participants if they miss an appointment.

Participants will be identified through the use of a unique Participant ID number. All data to be sent to CDC will be linked only to the unique Participant ID. CDC will not receive any personally identifiable information.

Describe how personal information will be maintained and who will have access to it.

Project DETECT has multiple levels of protection to ensure privacy and the security of the information collected from study participants. Study participants will be identified through a unique participant ID number. An encrypted file on a secured study computer will contain a list matching the patient clinic ID number to the study participant ID number. That list will be used to link data collected for the surveys with data located in the patient’s clinic record (e.g., HIV test results).

The study surveys are primarily self-administered using computer-assisted self-interview software (CASI) and conducted in a private space within the participating clinics. The HIV Symptom and Care survey will be administered by the research assistant in a private space in the clinic, and entered into the CASI software system. All surveys will be conducted on research study-specific computers that are encrypted and password protected.

For Phase 2 participants, a hard copy research chart will be created to securely store a) signed consent forms; and b) subject identifiers (e.g., contact information). The subject identifiers will be collected by research staff to facilitate scheduling of follow up visits. This information will be kept in a locked file drawer and will only be accessible by authorized study staff. At no time will this contact information be linked with survey results, test results, or any data submitted to CDC.

Data from the surveys will be merged with HIV test results and relevant clinical data. The Clinic ID will be removed and only the participant ID will remain in the dataset. Data will be stored on a secure server.

How long will sensitive or personal information be maintained? This information is crucial. If sensitive information is maintained for even one day, the Privacy Act will apply and we will have to provide language in the clearance package.

CDC will receive a de-identified dataset with no personal identifiers. All Project DETECT data will be stored at the CDC on a secure data server in restricted access folders accessible to only DETECT project officers and data manager.

All local data will be kept at the awardees’ main study site clinic. This includes contact information for Phase 2 participants which will be maintained in a hard copy record until the end of the project and then destroyed.

Will the collected information be covered by the appropriate CDC Assurance of Confidentiality?

No, the information collected is not covered by a CDC Assurance of Confidentiality. The information, however, is covered by a Certificate of Confidentiality.

If identifiable information will be filed and retrieved by the name of the individual:

Identifiable information will not be filed and retrieved by the name of the individual. Only a unique participant ID number will be used for filing and retrieval of data.

2