Privacy Impact Assessment

Save

Privacy Impact Assessment Form
v 1.21
Status

Form Number

Form Date

Question

Answer

1

OPDIV:

CDC/NCHHSTP/DHAP

2

PIA Unique Identifier:

0920-21HI

2a Name:

11/10/2021

Red Carpet Entry (RCE) Program Implementation
General Support System (GSS)
Major Application

3

Minor Application (stand-alone)

The subject of this PIA is which of the following?

Minor Application (child)
Electronic Information Collection
Unknown

3a

Identify the Enterprise Performance Lifecycle Phase
of the system.

Initiation
Yes

3b Is this a FISMA-Reportable system?

4

Does the system include a Website or online
application available to and for the use of the general
public?

5

Identify the operator.

6

Point of Contact (POC):

7

Is this a new or existing system?

8

Does the system have Security Authorization (SA)?

No
Yes
No
Agency
Contractor
POC Title

Behavioral Scientist

POC Name

Deborah Gelaude

POC Organization CDC/NCHHSTP/DHAP
POC Email

[email protected]

POC Phone

404-639-1905
New
Existing
Yes
No

8b Planned Date of Security Authorization
Not Applicable

Page 1 of 9

Save
8c

Briefly explain why security authorization is not
required

CDC will only be receiving deidentified data.

10

Describe in further detail any changes to the system
that have occurred since the last PIA.

New Information Collection.

11 Describe the purpose of the system.

The purpose of this information collection is to create a toolkit
for HIV clinics to implement the Red Carpet Entry (RCE)
Program and test the toolkit in two clinics. The study will
evaluate the implementation of the RCE program utilizing the
RCE toolkit, to ensure that: it can be easily used by clinic staff in
engaging newly diagnosed persons with HIV (PWH) and
persons returning to care into HIV medical care; that the
program runs properly; and that PWH are connected to a
provider or care team within 3 days. The study will evaluate key
components that contribute to program effectiveness
according to implementation science, including the
implementation strategies used to prepare for and implement
RCE, adaptations made to integrate RCE, implementation
context, and implementation outcomes such as acceptability,
appropriateness, feasibility, fidelity, reach, and sustainability.
Based on the information collected in this study, the toolkit will
be revised to include experiences of the clinics and their
implementation strategies and adaptations. The RCE toolkit
will be disseminated by CDC to the broader HIV health care
community. This is important because only federal agencies
like CDC have the resources and infrastructure to broadly
disseminate evidence-based interventions (EBIs). Broad
dissemination and uptake of EBIs like RCE can help lower
population rates of HIV transmission.
PII will be abstracted from the Electronic Health Record (EHR)
of clients enrolled in the Red Carpet Entry Program at
participating study clinics. Participating clinics are
subcontracted to implement RCE and collect data for this
project. Staff participating in the RCE implementation at the
participating clinics are located in local clinics and referred to
as 'RCE clinic staff.'

Describe the type of information the system will
collect, maintain (store), or share. (Subsequent
12
questions will identify if this information is PII and ask
about the specific data elements.)

The Contractor will be responsible for collecting all data for this
study. To ensure that respondents’ health information is
protected, we will take the following measures to separate PII
from study-related data: (1) all respondents will receive unique
identification codes, which will be stored separately from PII on
a password protected computer and or locked file cabinet;
data will be collected by trained RCE clinic staff using a secure,
password-protected database stored on the participating
clinic’s secure server or project computer; (2) Contract study
staff and RCE clinic staff who play a role in data collection and
analysis will be trained in proper procedures for securing
project data and protecting participant confidentiality; and (3)
an encryption key will be used to transform dates included as
part of the Electronic Health Record (EHR) records abstracted.

Page 2 of 9

Save

Provide an overview of the system and describe the
13 information it will collect, maintain (store), or share,
either permanently or temporarily.

PII will be abstracted from the Electronic Health Record (EHR)
of clients enrolled in RCE and collected from RCE clinic staff
involved in implementing RCE via survey and interview data
collection activities (data collection conducted by Contract
study staff). Client PII is collected for the purpose of describing
the sample and determining study outcomes (demographics,
appointment dates, HIV diagnosis date, length of time from
diagnosis to RCE visit). PII is collected from RCE clinic staff
during the interview/survey for the purpose of describing the
clinic staff sample (demographics). Additional PII is collected
for purpose of implementing RCE, such as names and phone
numbers/email addresses for contacting RCE clients when
appointments are missed. Access to all PII is limited to clinic
staff. PII accessed at participating clinics remains on site. PII
from client data will not be transmitted to the Contractor or to
the CDC. PII from participants will not be transmitted to CDC.
PII that will be abstracted include; Name, email address, phone
number, DOB, mailing address, sex, gender, race and ethnicity,
appointment dates and clinic location.
Yes

14 Does the system collect, maintain, use or share PII?

Indicate the type of PII that the system will collect or
15
maintain.

No
Social Security Number

Date of Birth

Name

Photographic Identifiers

Driver's License Number

Biometric Identifiers

Mother's Maiden Name

Vehicle Identifiers

E-Mail Address

Mailing Address

Phone Numbers

Medical Records Number

Medical Notes

Financial Account Info

Certificates

Legal Documents

Education Records

Device Identifiers

Military Status

Employment Status

Foreign Activities

Passport Number

Taxpayer ID

Race and Ethnicity

Sex

Appointment Dates

Gender

Clinic Location

Employees
Public Citizens
16

Indicate the categories of individuals about whom PII
is collected, maintained or shared.

Business Partners/Contacts (Federal, state, local agencies)
Vendors/Suppliers/Contractors
Patients
Other

17 How many individuals' PII is in the system?

100-499

Page 3 of 9

Save

18 For what primary purpose is the PII used?

19

Describe the secondary uses for which the PII will be
used (e.g. testing, training or research)

PII will be used to: follow up with participants related to
medical visits missed; to describe the sample enrolled in the
study; and to identify key research outcomes of the Red Carpet
Entry Program implementation.
Not applicable.

20 Describe the function of the SSN.

N/A

20a Cite the legal authority to use the SSN.

N/A

Public Health Service Act, Section 301, "Research and
Investigation," (42 U.S.C. 241); and Sections 304, 306 and 308(d)
Identify legal authorities governing information use which discuss authority to maintain data and provide
21
assurances of confidentiality for health research and related
and disclosure specific to the system and program.
activities (42 U.S.C. 242 b, k, and m(d)).Information use and
disclosure is governed under Departmental regulations, 5 USC
301.
22

Yes

Are records on the system retrieved by one or more
PII data elements?

No
Directly from an individual about whom the
information pertains
In-Person
Hard Copy: Mail/Fax
Email
Online
Other
Government Sources

23

Within the OPDIV
Other HHS OPDIV
State/Local/Tribal
Foreign
Other Federal Entities
Other

Identify the sources of PII in the system.

Non-Government Sources
Members of the Public
Commercial Data Broker
Public Media/Internet
Private Sector
Other
23a

Identify the OMB information collection approval
number and expiration date.

24 Is the PII shared with other organizations?

TBD
Yes
No

Page 4 of 9

Save

Describe the process in place to notify individuals
25 that their personal information will be collected. If
no prior notice is given, explain the reason.

26

Is the submission of PII by individuals voluntary or
mandatory?

Describe the method for individuals to opt-out of the
collection or use of their PII. If there is no option to
27
object to the information collection, provide a
reason.

Describe the process to notify and obtain consent
from the individuals whose PII is in the system when
major changes occur to the system (e.g., disclosure
28 and/or data uses have changed since the notice at
the time of original collection). Alternatively, describe
why they cannot be notified or have their consent
obtained.

Study participants will be provided information about the
study, including data to be collected, during enrollment via the
informed consent process. Information will be provided using
an IRB approved consent form which will provide details about
the study, data collection, procedures and how data and PII will
be handled and stored. Clinic staff implementing RCE and
participating as respondents will be informed about measures
taken for data protection and confidentiality, and that data will
be used in aggregate form only. RCE clients will be asked to
consent to the access of their Electronic Health Record for visit
and appointment dates, demographic data (race, ethnicity,
age, gender), and date of HIV diagnosis. Participants will sign
this form and will be offered a copy for their records.
Voluntary
Mandatory
If individuals do not want to participate in the study after
approached or consented, they can simply state so and they
will not be consented or they will be removed from the study
(respectively).
The RCE clinic staff will explain to participants that it is the
clinic who will be in possession of participants' contact
information, and that they will contact participants in the event
of major changes to the system and/or use of participant's PII.
Should major system changes actually occur, an Institutional
Review Board (IRB) amendment will be drafted and a
determination made about whether the system changes
necessitate (1) updating the consent form and/or (2)
contacting participants to update them about protocol
changes.
RCE clinic staff will explain to participants during the informed
consent process ways participants can raise any concerns
about the handling of their PII at any time during the study.

Describe the process in place to resolve an
individual's concerns when they believe their PII has
29 been inappropriately obtained, used, or disclosed, or Individuals concerned about breaches in confidentiality or
that the PII is inaccurate. If no process exists, explain misuse of PII may contact the Contractor- Investigator in
why not.
charge of the Study or the Local Institutional Review Board
(IRB) of record via contact information provided in the
informed consent document.

Page 5 of 9

Save
Integrity: Data access will be limited strictly to RCE clinic staff
and Contract study staff based on secure storage procedures
for all paper forms and electronic files handling.

Describe the process in place for periodic reviews of
PII contained in the system to ensure the data's
30
integrity, availability, accuracy and relevancy. If no
processes are in place, explain why not.

Availability: PII abstracted from EHRs will be strictly maintained
by RCE clinic staff located in participating clinics and destroyed
at the end of the study. De-identified datasets will be
maintained by the Contractor. CDC will receive a copy of deidentified study data at the end of the study, and will make the
aggregate data available for potential analysis by third parties
based on conditions specified in a data sharing agreement.
Accuracy: Contractor will check the data collected in the study
database throughout the study and at the study end.
Relevancy: CDC will collaborate with the Contractor to identify
variables and measures needed for the study, thereby avoiding
the collection of data that are not relevant to study objectives.
Users
Administrators

31

Identify who will have access to the PII in the system
and the reason why they require access.

Developers
Contractors

RCE clinic staff will have access to PII in
order to collect study data and to de-

Others
Describe the procedures in place to determine which Only RCE clinic staff (data manager, RCE Concierge, and Clinic
Champion) may access clinic study records which contain PII.
32 system users (administrators, developers,
Only RCE clinic staff will have access to study data and
contractors, etc.) may access PII.
encryption keys.
Describe the methods in place to allow those with
33 access to PII to only access the minimum amount of
information necessary to perform their job.

The Contractor will share with RCE clinic staff during training
and via the study protocol that study data will only be handled
by clinic staff for the purpose(s) specified.

Identify training and awareness provided to
personnel (system owners, managers, operators,
contractors and/or program managers) using the
34
system to make them aware of their responsibilities
for protecting the information being collected and
maintained.

The Contractor will train RCE clinic staff and Contract study
staff during the pre-implementation period on proper data
handling and management during study in order to protect
data and ensure that staff follow the study protocol for data
collection, access, management, sharing, and destruction.

Describe training system users receive (above and
35 beyond general security and privacy awareness
training).

The Contractor will train RCE clinic study staff on security and
privacy protocols with regards to study implementation,
including use of study computers, data collection procedures
(including use of the Access Database), handling, storage and
transmission to the Contractor.

Do contracts include Federal Acquisition Regulation
36 and other appropriate clauses ensuring adherence to
privacy provisions and practices?

Yes
No

Page 6 of 9

Save

Describe the process and guidelines in place with
37 regard to the retention and destruction of PII. Cite
specific records retention schedules.

Clinics will destroy study files after final, de-identified data are
transfered to the Contractor, cleaned and verified at the end of
the project. The Contractor will transfer all de-identified data to
CDC. Record retention will be conducted in accordance with
the CDC Scientific and Research Project Records Control
Schedule ("Big Bucket").

Describe, briefly but with specificity, how the PII will
38 be secured in the system using administrative,
technical, and physical controls.

Administrative Controls:
Only authorized RCE clinic study staff (the clinic-based data
manager, RCE Concierge, and Clinic Champion) will have
access to the project computers and their site-specific data.
Clinics will de-identify data by removing names and medical
record numbers and replacing them with the client’s study ID.
Study IDs will be linked to medical record numbers only on a
clinic computer or secure server, and only RCE clinic study staff
will be able to back-convert a study ID into a medical record
number. Only authorized RCE clinic study staff and Contractor
Study staff will have access to study-specific FTP sites.
Technical Controls:
The contract study staff and RCE clinic study staff will only use
secure, password-protected databases; secure servers; and
project computers to collect, maintain or share project files.
The RCE clinic study staff will transfer de-identified data to the
contractor via a secure, password-protected FTP site (each
clinic will use their own FTP site).
Physical Controls:
Project paper files (consent forms and HIPAA authorization
forms) will stored in a locked file cabinet at each clinic site.
Clinic data collected as part of the study will be stored on a
password-protected project computer or secure local server at
the clinic in an encrypted Access database. Project databases at
clinics will be destroyed when the project is completed.

REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV
Senior Officer for Privacy.

Reviewer Questions
1

Are the questions on the PIA answered correctly, accurately, and completely?

Answer
Yes
No

Reviewer
Notes
2

Does the PIA appropriately communicate the purpose of PII in the system and is the purpose
justified by appropriate legal authorities?

Yes

Do system owners demonstrate appropriate understanding of the impact of the PII in the
system and provide sufficient oversight to employees and contractors?

Yes

No

Reviewer
Notes
3

No

Reviewer
Notes

Page 7 of 9

Save
Reviewer Questions
4

Does the PIA appropriately describe the PII quality and integrity of the data?

Answer
Yes
No

Reviewer
Notes
5

Is this a candidate for PII minimization?

Yes
No

Reviewer
Notes
6

Does the PIA accurately identify data retention procedures and records retention schedules?

Yes
No

Reviewer
Notes
7

Are the individuals whose PII is in the system provided appropriate participation?

Yes
No

Reviewer
Notes
8

Does the PIA raise any concerns about the security of the PII?

Yes
No

Reviewer
Notes
9

Is applicability of the Privacy Act captured correctly and is a SORN published or does it need
to be?

Yes
No

Reviewer
Notes
10

Is the PII appropriately limited for use internally and with third parties?

Yes
No

Reviewer
Notes
11

Does the PIA demonstrate compliance with all Web privacy requirements?

Yes
No

Reviewer
Notes
12

Were any changes made to the system because of the completion of this PIA?

Yes
No

Reviewer
Notes

General Comments

Page 8 of 9

Save
OPDIV Senior Official
for Privacy Signature

Beverly E.
Walker -S

Digitally signed by
Beverly E. Walker -S
Date: 2022.01.20
10:11:28 -05'00'

HHS Senior
Agency Official
for Privacy

Page 9 of 9