Agreement to Abide by Restrictions

Confidentiality Security Statement Attachment 6
AGREEMENT TO ABIDE BY RESTRICTIONS ON RELEASE OF HIV
SURVEILLANCE AND SURVEILLANCE-RELATED DATA COLLECTED AND
MAINTAINED BY THE DIVISION OF HIV/AIDS PREVENTION (DHAP)
October 2019

I, ___________________________, understand that data collected by the Centers for Disease
Control and Prevention (CDC) through the National HIV Surveillance System (NHSS) and
related surveillance activities, projects, and case investigations under Sections 304 and 306 of the
Public Health Service Act (42 U.S.C. 242b and 242k) are protected at the national level by an
Assurance of Confidentiality (Section 308(d) of the Public Health Service Act, 42 U.S.C.
242m(d)), which prohibits disclosure of any information that could be used to directly or
indirectly identify any individual on whom a record is maintained by CDC. This prohibition has
led to the formulation of the following guidelines for release of HIV surveillance and
surveillance-related data collected on such persons to which, in accepting access to data not
considered public-use, I agree to adhere. These guidelines represent a balance between the
potential for inadvertent disclosure and the need for CDC/DHAP to be responsive to information
requests having legitimate public health application, and reflect input from DHAP subject matter
experts, statisticians, and approval of state and local surveillance programs. In particular,
variables that identify geographic units or facilities have the potential to indirectly identify
individuals.
Therefore, I will not release, either inside or outside CDC, state/territorial, MSA, city, county, or
other geographic area-specific data in any format (e.g., publications, presentations, slides,
interviews) without the consent of the appropriate state or local agency, except as consistent with
the format described in this document and related HICSB and BCSB standard operating
procedures. Specifically, in accordance with the terms of written data re-release agreements
between CDC, the Council of State and Territorial Epidemiologists (CSTE), and individual
state/territorial health departments AND in accordance with the principles of the Assurance of
Confidentiality for HIV surveillance and surveillance-related data authorized under Section
308(d) of the U.S. Public Health Service Act:
Levels of data release:
National and regional level — I am permitted to release national and regional aggregate data
without cell size or denominator restrictions. Data will include (but not be limited to) multiple
cross tabulations by geographic level, sex at birth (or current gender if available, for
national/regional level analyses only), race/ethnicity (based on Office of Management and
Budget (OMB) categories), age group, transmission category (or exposure category), and year.
These include the variables outlined below and may include other variables reported to the
National HIV Surveillance System, Medical Monitoring Project (MMP) or National HIV
Behavioral Surveillance.

State level (including the District of Columbia and Puerto Rico) — For any state, the District
of Columbia, and Puerto Rico. I am permitted to release one-way frequencies, two-way, threeway, and four-way stratifications of variables of interest (including sex at birth, age group,
race/ethnicity and transmission/exposure category) by location (i.e., states) and year with the
denominator rule suppressing data for stratum-specific populations of size <100 according to the
level of release specified in the state’s data re-release agreement. I understand that the
stratifications released may vary by jurisdiction and will review and release data according to
each jurisdiction’s agreed level of release. A summary listing of specified release levels for each
state is available from the Data Analysis and Dissemination Team, HICSB.

o No numerator suppression rule will be applied.
o For strata where a population size is not available in the U.S. Census (e.g.,
transmission/exposure category) the size of the underlying population that is most
similar to the group will be checked before data are released. For example, for black
men who have sex with men, the underlying population of black men will be checked
for that geographic area.
o If the totals could inadvertently disclose a case through back-calculation by
subtraction, secondary or complementary suppression will be done by either 1)
combining two or more categories of data (e.g., aggregation of values within the
stratification parameter) or 2) excluding all data in a subcategory (e.g., blocking
disaggregation below a pre-selected value for the stratification parameter) across
multiple states.
o Any requests for data beyond this data-release agreement will require permission by
the applicable health department.

Geographic Areas with ≥500,000 population — For areas with ≥500,000 population,
including MSAs, counties cities and other geographic areas, I am permitted to release oneway frequencies, two-way, three-way, and four-way stratifications of variables of interest
(including sex at birth, age group, race/ethnicity and transmission/exposure category) by location
(e.g., MSAs, counties cities and other geographic areas) and year with the denominator rule
suppressing data for stratum-specific populations of size <100 according to the level of release
specified in the state’s data re-release agreement. I understand that the stratifications released
may vary by jurisdiction and will review and release data according to each jurisdiction’s agreed
level of release. A summary listing of specified release levels for each state is available from the
Data Analysis and Dissemination Team, HICSB.

o No numerator suppression rule will be applied.

o For strata where a population size is not available in the U.S. Census (e.g.,
transmission category) the underlying population that is most similar to the group will
be checked before release. For example, for black men who have sex with men, the
underlying population of black men will be checked for that geographic area.
o If the totals could inadvertently disclose a case through back-calculation by
subtraction, secondary or complimentary suppression will be done by either 1)
combining two or more categories of data (e.g., aggregation of values within the
stratification parameter) or 2) excluding all data in a subcategory (e.g., blocking
disaggregation below a pre-selected value for the stratification parameter) across
multiple areas.
o Any requests for data beyond this data release agreement will require permission by
the applicable health department.

Geographic areas with 50,000 – 499,999 population — I will review the data re-release
agreements and most current standard operating procedures for applicable areas and restrictions
in collaboration with the HICSB or BCSB Chief or the Data Analysis and Dissemination Team
Leader, HICSB before releasing any data for geographic areas with 50,000 – 499,999 population.
I understand that the stratifications released may vary by jurisdiction and will review and release
data according to each jurisdiction’s agreed level of release. A summary listing of specified
release levels for each state is available from the Data Analysis and Dissemination Team,
HICSB.

o A denominator rule of <100 will be applied for all frequencies and stratifications in
areas with 50,000 – 499,000 population (i.e., when the stratum-specific population is
<100 for a subgroup, count data will not be presented). In addition, data will be
suppressed when numerators are 1-4 (i.e., cells with 1 – 4 will not be presented).
o For strata where a population size is not available in the U.S. Census (e.g.,
transmission category) the underlying population that is most similar to the group will
be checked. For example, for black men who have sex with men, the underlying
population of black men will be checked for that geographic area.
o Any requests for data beyond this data release agreement will require permission by
the applicable health department.

Counties <50,000 population — Data will not be released for any area/location with <50,000
population other than counties. I will review the data re-release agreements and most current
standard operating procedures for applicable areas and restrictions in collaboration with the
HICSB or BCSB Chief or the Data Analysis and Dissemination Team Leader, HICSB before
releasing any data for counties with <50,000 population. I understand that the stratifications

released may vary by jurisdiction and will review and release data according to each
jurisdiction’s agreed level of release. A summary listing of specified release levels for each state
is available from the Data Analysis and Dissemination Team, HICSB.
o A denominator rule of <100 will be applied for all frequencies and stratifications in
counties <50,000 (i.e., when the stratum-specific population size is <100 for a
subgroup, count data will not be presented). In addition, data will be suppressed when
numerators are 1-4 (i.e., cells with 1-4 will not be presented).
o For strata where a population size is not available in the U.S. Census (e.g.,
transmission category) the underlying population that is most similar to the group will
be checked. For example, for black men who have sex with men, the underlying
population of black men will be checked for that geographic area.
o Any requests for data beyond this data-release agreement will require permission by
the applicable state health department.

Dependent areas of American Samoa, Guam, Northern Mariana Islands, the Republic of
Palau and the U.S. Virgin Islands — I am only permitted to release and present data at the U.S.
dependency level. The release of data below the U.S. dependency level or for additional
dependent areas other than the five areas listed above will require permission by the applicable
health department(s).
o It is permissible to release totals (cumulative and annual) and one-way frequencies
(cumulative only) of sex at birth, age group, race/ethnicity or transmission by location
(i.e., U.S. dependency). No suppression rules will be applied.
Data stability requirements for release of all data regardless of level of analysis — I will
include a cautionary note on stability for all levels of analyses when numbers are less than 12 or
rates are calculated based on numbers less than 12, or when trends or estimates are determined to
be unstable or unreliable through other statistical methods (e.g., relative standard error).

Variables permitted for release and stratification examples: — Any requests for variables
other than those listed below will require approval by the HICSB Chief or Data Analysis and
Dissemination Team Leader, HICSB or BCSB Chief or Behavioral Surveillance or Clinical
Outcomes Team Leaders, BCSB as appropriate:
General
x

Location (United States, region, U.S. dependent area, state, MSA, county, city) based on
standard definitions

x

Year (report, diagnosis, death, prevalence, stage of disease, infection (incidence),
perinatal exposure)

Demographic/transmission
x

Sex at birth (or current gender at the national/regional level only, when available)

x

Age group (using 5-year groups or larger for state-level and smaller geographic
populations; at diagnosis, or calculated age at end of year for prevalence)

x

Race/ethnicity (based on OMB classification)

x

Transmission or exposure category (as defined in HIV Surveillance Report)

Stratifications (examples)
1-way
x

Race/ethnicity

x

Sex at birth (or current gender at the national/regional level only, when available)

x

Age group

x

Transmission category1

x

2-way

x

Sex at birth (or current gender at the national/regional level only) and age group

x

Sex at birth (or current gender at the national/regional level only) and race/ethnicity

x

Age group and race/ethnicity

x

Age group and transmission category

x

Transmission category and race/ethnicity

x

Transmission category and sex at birth (or current gender at the national/regional level
only)

3-way

1

x

Transmission category by age group and race/ethnicity

x

Transmission category by age group and sex at birth (or current gender at the
national/regional level only)

For the purpose of this agreement, we are considering stratifications at the variable level. Note that “male-to-male
sexual contact” and the dual “male-to-male sexual contact and injection drug use” transmission categories include
stratification by sex (i.e., include only men) but will be treated as a single variable for data releases.

x

Transmission category by sex at birth (or current gender at the national/regional level
only) and race/ethnicity

x

Race/ethnicity by sex at birth (or current gender at the national/regional level only) and
age group

4-way
x

Transmission category by age group, race/ethnicity, and sex at birth (or current gender at
the national/regional level only)

Data release and publication:

x

I understand that release of data not specifically permitted by this agreement is
prohibited unless written permission is first obtained from the appropriate branch chief
(HICSB or BCSB), Division of HIV/AIDS Prevention

x

When presenting or publishing state-, city-, county-, MSA-, or dependent area-specific
data in accordance with the restrictions outlined above, I will inform the appropriate
state(s) and local health department(s) in advance of the release of state or local data, so
as to afford them the opportunity to anticipate local queries and prepare their response.

x

When presenting or publishing data from surveillance-related studies, investigations, or
evaluations, I will adhere to the principles and guidelines outlined in this agreement and
related HICSB and BCSB standard operating procedures.

x

Publication of a manuscript in a journal or as part of conference proceedings requires a
CDC clearance of that manuscript, even if an abstract for that manuscript was previously
cleared.

Release of geocoded HIV surveillance data:

x

Any re-release of geocoded HIV surveillance data that identifies the geographic area
below the state or U.S. dependent-area level is subject to written approval of the
applicable health department(s) (re-release of data can be in the form of peer and nonpeer reviewed manuscripts, technical reports, manuals, and presentations).

x

All publications using geocoded data must be cleared through DHAP HICSB clearance.

Data Security:

1. I agree to follow standard operating procedures for maintaining security and
confidentiality of surveillance and surveillance-related data.

2. I will not give my access password to any person.

3. I will treat all data at my desk site confidentially and maintain in a locked file cabinet
records that could directly or indirectly identify any individual on whom CDC maintains
a record. Sensitive identifying information from special case investigations will only be
maintained in a locked file cabinet in a locked room which has restricted access.

4. I will keep all hard copies of data runs containing small cells locked in a file cabinet
when not in use, shredding them when they are no longer necessary to my analysis.

5. I will not produce a “back-up” data file of HIV case surveillance data or related databases
maintained by DHAP.

6. I will not remove electronic files, records or databases from the worksite, or access them
remotely from home or other unofficial/unapproved off-worksite location.

7. I will not remove hard copies of case reports, survey instruments, laboratory reports,
confidential communications, or any records containing sensitive data and information or
the like from the worksite.

8. I will not remove from the worksite tabulations or data in any format that could directly
or indirectly identify any individual.

9. I will maintain confidentiality of records on individuals in all discussions,
communications, e-mails, tabulations, presentations, and publications (and the like) by
using only the minimum information necessary to describe the individual case.

10. I will not release data to the press or media without pre-screening of the request by the
NCHHSTP, Program Planning & Policy Coordination Office or the DHAP Office of
Policy, Planning and Communications.

11. I am responsible for obtaining IRB review of projects when appropriate.

12. I will abide by HICSB and BCSB telework policies that prohibit accessing Assurance
covered data while teleworking.

I have read this document, “Agreement to Abide by Restrictions on Release of HIV
Surveillance and Surveillance-Related Data...” and the attached document “Policy for
Release of Centers for Disease Control and Prevention (CDC) HIV Surveillance and
Surveillance-related Data,” and I agree to abide by them. Failure to comply with this
agreement may result in disciplinary action, including possible termination of employment.

Signed: __________________________________________ Date: ______________________
(Requestor)
CIO, Division, Branch _______________________________

Approved: ________________________________________ Date: ______________________
Chief, (HICSB/BCSB), DHAP, NCHHSTP or designee

Revised October 2019