Data Use Agreement CDC and MPHI

DocuSign Envelope ID: 95A1C2EF-DB2B-44E6-967A-A0D463AA7531

Data Use Agreement
between the CDC Sudden Unexpected Infant Death (SUID) and Sudden
Death in the Young (SDY) Case Registry
and the National Center for Fatality Review and Prevention
2018-2023

Background
The purposes of the SUID Case Registry are to compile comprehensive population-based data about the
circumstances for all SUID cases, improve the completeness and quality of SUID case investigations and monitor
SUID trends using standardized definitions. By building upon the infrastructure established for the SUID Case
Registry, the Centers for Disease Control and Prevention (CDC) and the National Institutes for Health (NIH)
developed the SDY Case Registry to establish incidence, understand the causes and risk factors for infants,
children and young adults who die suddenly and unexpectedly, and to inform strategies to prevent future deaths.
The combined registries build upon existing Child Death Review programs so that these teams can conduct
population-based SUID surveillance with improved data quality more quickly. Grantees, like most Child Death
Review programs, use the web-based National Fatality Review Case Reporting System (NFR-CRS) supported by
the National Center for Fatality Review and Prevention (NCFRP). CDC offers technical support and resources for
awardees to improve case identification with more complete, accurate, and faster data.

Terms of this agreement:
1) CDC Use of SUID & SDY Case Registry Data:


The NCFRP agrees to provide members of the CDC’s SUID & SDY Case Registry team with deidentifiable data from the NFR-CRS from the CDC funded jurisdictions. NCFRP staff will have access only
to data submitted by participating states and their authorized data entry persons that have case identifiers
removed using the HIPAA standards listed in Appendix A.



Data will be transmitted to CDC on a quarterly basis, via a secure file transfer protocol site (SFTP). CDC
Case Registry team will be responsible for ensuring the SFTP site is accessible and functional.



The CDC will not attempt or permit others to use this data set to learn the identity of any individual
mentioned in the data. If an individual’s identity is inadvertently discovered, CDC will inform NCFRP staff
of the discovery, so they can prevent further discoveries. The CDC’s SUID & SDY Case Registry team
will NOT inform anyone else of this knowledge.



The CDC will not release nor permit others to release the data set or any part of it to any person other
than the members of the CDC’s SUID & SDY Case Registry team who have completed a data usage
agreement form.



The CDC will store all electronic and hard copy data in a secure and confidential location that only CDC’s
SUID & SDY Case Registry team members have access to. Electronic data will be backed up on a secure
server per CDC protocol.

CDC_MPHI Data Use Agreement

DocuSign Envelope ID: 95A1C2EF-DB2B-44E6-967A-A0D463AA7531



All oral or written presentations of the results of the analyses will include an acknowledgment of each
funded jurisdiction, the CDC, and NCFRP. The CDC will only report aggregated data with cell counts of
six or more cases.

2) External Researchers’ Use of SUID & SDY Registry Data:


External researchers may request access to de-identified SUID & SDY Case Registry data using the
established NCFRP data release procedure. Per the NCFRP Data release policy, any release of data will
be subject to a signed Contract for Access to and Use of Data between NCFRP and an authorized
representative of the Receiving Institution or the individual themselves, in the case of independent
researchers.



The CDC SUID & SDY Case Registry team will maintain a list of research projects using registry data that
are currently underway and planned.



Any updates to the project list will be immediately shared with NCFRP in writing (via email). If any project
on CDC’s research list is not completed (first full draft circulated to all co-authors) within the timeframe
negotiated between NCFRP and CDC,the project will be considered open to external researchers. If no
external researcher expresses interest, however, CDC may still choose to conduct said research project.



Upon receipt of any request by an external researcher for use of SUID & SDY Case Registry data,
NCFRP will notify the CDC SUID & SDY Case Registry Team. This notification will take place prior to
review and approval by the NCFRP data review committee; and will include the years of data being
requested, the principle investigator, title of project, and description of the research questions and
objectives.

The NCFRP data review committee will include representatives from the CDC SUID & SDY Case Registry team,
including an epidemiologist.
 Any questions as to whether a given project conflicts with current/planned CDC research will be posed to
the CDC SUID & SDY Case Registry team for discussion and determination. If needed, NCFRP and CDC
Registry staff will discuss proposals via conference call to aid in making a determination of non-conflict.

3)

Joint authorship between CDC and NCFRP of SUID & SDY Case Registry Data


Any research by the CDC SUID & SDY Case Registry Team or NCFRP that uses SUID & SDY Case
Registry data and includes reference to one or both the SUID or SDY Registries will include joint
authorship between NCFRP and the CDC SUID & SDY Case Registry Team. Team members may
voluntarily remove themselves from co-authorship at any point.



All co-authors will abide by International Committee of Medical Journal Editors (ICMJE) criteria for
authorship: (http://www.icmje.org/recommendations/)
o Substantial contributions to the conception or design of the work; or the acquisition, analysis, or
interpretation of data for the work; AND
o Drafting the work or revising it critically for important intellectual content; AND
o Final approval of the version to be published; AND
o Agreement to be accountable for all aspects of the work in ensuring that questions related to the
accuracy or integrity of any part of the work are appropriately investigated and resolved.



Contributors who meet fewer than all 4 of the above ICMJE criteria for authorship will not be listed as
authors, but will be acknowledged.

CDC_MPHI Data Use Agreement

DocuSign Envelope ID: 95A1C2EF-DB2B-44E6-967A-A0D463AA7531

4)

Renewal and revision of this agreement:


The terms of this agreement may be revised at any time, pending review and agreement by both CDC
and NCFRP. At a minimum, the terms will be reviewed and updated, as necessary, at the start of each
CDC funding cycle.

By the authority vested in me as a representative
of the CDC’s SUID & SDY Case Registry team,
my signature indicates the CDC’s SUID & SDY
Case Registry team agreement to comply with
these requirements.

By the authority vested in me as a representative
of MPHI/ NCFRP my signature indicates
agreement to comply with these requirements.
Janice Kidd

Name:____________________________
Name: Sharyn Parks Brown, PhD, MPH

Finance & Budget Manager

Title: _____________________________
Title: Senior Epidemiologist

Michigan Public Health Institute

Organization: ______________________
Organization: SUID & SDY Case Registries
Centers for Disease Control and Prevention

Signature: ________________________

Signature: ________________________

Date: _____________________________

10/29/2018

Date: 10/22/18

CDC_MPHI Data Use Agreement

DocuSign Envelope ID: 95A1C2EF-DB2B-44E6-967A-A0D463AA7531

Appendix A
HIPAA Required Elements to De-Identify Case Data*
The NFR-CRS supports two types of data downloads: identified and de-identified. NCFRP
staff and researchers who have been approved by the NCFRP will receive only de-identified
data. The NFR-CRS variables that will be removed in de-identified downloads are listed
below.
The NFR-CRS contains many free text fields (most often in the ‘specify’ or ‘describe’ text
fields). The NFR-CRS also provides users the opportunity to provide more detail surrounding
the circumstances of the death in Section O: Narrative text field. When the Narrative,
‘specify,’ and/or ‘describe’ text fields are included in a de-identified download, the
Narrative, ‘describe,’ and ‘specify’ text fields SHOULD NOT contain any HIPAA
Identifiers.
HIPAA Identifiers include names; all geographical subdivisions smaller than a state; all
elements of dates (except year) for dates directly related to an individual; phone numbers; fax
numbers; electronic mail addresses; social security numbers; medical record numbers; health
plan beneficiary numbers; account numbers; certificate/license numbers; vehicle identifiers and
serial numbers; device identifiers and serial numbers; web universal resource locators; internet
protocol address numbers; biometric identifiers; full face photographic images; and any other
unique identifying number, characteristic or code.
Identifying information can be entered into the NFR-CRS element fields in the list below,
including free text fields associated with the listed fields, because all the listed fields and their
related text fields will be removed from every de-identified download. However, Users should
be instructed by the Holder not to enter any identifying information in other free text
fields, including Section O: Narrative text field, because these text fields may be
included in de-identified downloads. NCFRP cannot review free text fields in deidentified downloads to assure that they contain no HIPAA Identifiers.

CDC_MPHI Data Use Agreement

DocuSign Envelope ID: 95A1C2EF-DB2B-44E6-967A-A0D463AA7531

HIPAA Required Elements to De-Identify Case Data
The NFR-CRS elements listed below will be removed for all persons accessing deidentified case data:
Introduction: Case Definition
Case number
County of review
Review team number
Sequence of review
Death certificate number
Birth certificate number
Medical examiner/Coroner number
Date CDR team notified of death
Section A: Child Information
Child first name
Child middle name
Child last name
Child name: unknown
Date of birth: month, day, and year
Date of birth: unknown
Date of death: month and day
Date of death: unknown
Residential address: unknown
Residential address: street
Residential address: apartment
Residential address: city
Residential address: county
Residential address: zip
County of death
Section D: Incident Information
Date of incident
Date of incident: same
Date of incident: unknown
Incident county

CDC_MPHI Data Use Agreement

Section M: Review Meeting Process
Date of first CDR meeting
Section N: SUID and SDY Case Registry
Date of first Advanced Review meeting
Date of SUID Case Registry data entry complete

Section P: Form Completed By
Form completed by – Person’s name
Form completed by – Title
Form completed by – Agency
Form completed by – Phone
Form completed by – Phone extension
Form completed by – Email
Form completed by - Date
Date of quality assurance completed by State
My CDR Outcomes
My CDR Outcomes – Person’s name
My CDR Outcomes - Team of review
*Source:

Code of Federal Regulation Section
164.514(b)(2)(i).