Att6. Data Confidentiality

Attachment 6- Data Confidentiality

In order to maintain the confidentiality of all data collected, the evaluation team will employ the following procedures.

Data storage: Novi, the survey platform used to administer the questionnaire, is hosted on an ORAU protected and secure server and accessed through a secure SSL/https connection. All raw data files downloaded from the online survey platform will be saved to ORAU’s secure server. The network has received Authority to Operate (ATO) by DOE in accordance with OMB regulations. The ATO signifies that housing data on ORAU’s network is equivalent to maintaining data on a federal system. The ORAU IT infrastructure is standards-based, stable, reliable, secure, responsive to project requirements, and based on the most appropriate technology platforms currently available. ORAU has received accreditation from DOE in accordance with OMB Circular A-130 and Federal Information Security Management Act (FISMA) regulations. In addition to DOE, ORAU provides IT services in support of programs funded by several other federal agencies for which having an ATO is a requirement, including among others, the CDC. All data will be deleted from Novi and ORAU servers upon completion of the study and the de-identified data have been transferred to NIOSH.

Fire department contact information: All information pulled from fire department websites and/or obtained through direct phone calls with fire departments will be saved in a password-protected spreadsheet on the secure ORAU servers. Only the ORAU evaluation team will have access to the file.

Deidentifying survey responses: All fire departments in the study sample will be assigned a random alphanumeric identifier using a random ID generator (e.g., the random_id package in R). This ID will be used in the de-identification process. Generating a study-specific unique identifier for each of the fire departments will permit the evaluation team to tie responses from individuals to fire department characteristics (i.e., type, locale, etc.) and account for the nesting of responses within the same fire department, while also removing any identifying information for the fire departments themselves (i.e., name of fire department, FDID, address, etc.).

A total of 2 spreadsheets will be produced to avoid connecting survey responses about a fire department’s safety practices or staff’s perception to identifying information about fire departments. First, we will create a password-protected spreadsheet that links the fire department information (name of fire department, zip code, department number, phone number) to their study-specific identifiers. A second file will connect the unique fire department IDs with the characteristics necessary for analysis including locale (urban vs. rural), U.S. region, and type (career, volunteer), and will be used to merge the characteristics with the survey data. The study-specific fire department IDs will be used to link the survey responses to the fire department in the backend of the survey software Novi (see Figure 1). In the example below, all of the participants with an email address listed work in the same fire department, and their information would have been obtained through the professional organizations. The other links are for all staff within the same fire department, and would be distributed to any respondents recruited through publicly available information (e.g., phone or single contact email for department).

Figure 1 – Alignment of Unique Fire Department ID in Survey Software

Upon downloading the survey data, email addresses will be removed from the survey data. The survey data will then be merged with fire department characteristics (second spreadsheet described above) to create a dataset that includes the information necessary for the analyses (i.e., study-specific fire department ID, the characteristics of the fire department, and the respondent’s position) but no identifying information. Prior to providing NIOSH with the data, all responses to open-ended questions will have identifying information redacted including removing any fire department names or locations from comments.