Privacy Narrative

Information Collection Request - Privacy Narrative

01/23/2024

Social and Economic Barriers to Receiving Optimal Services Along the Cancer Care Continuum
Title: ______________________________________________________________________________________
Florence Tangka

Point of Contact: _____________________________________________________________________________
CDC contractors will receive existing cancer registry data (Attachment A) directly from participating cancer registries in
California, North Carolina, and Texas.
CDC contractors will collect contact information (i.e., names, email addresses, mailing addresses, phone numbers) from
Wave 1 Survivor Survey (Attachment B) respondents to process incentives and schedule interviews (as applicable). CDC
contractors will also collect updated information (i.e., names, email addresses, mailing addresses) as needed from the Wave
2 Survivor Survey (Attachment C) respondents to process incentives. A survey item on the Wave 1 Survivor Survey asks
respondents for the name, mailing address and email address of a caregiver who provided them with care during their
cancer treatment and may be interested in participating in our Caregiver Survey (Attachment D). CDC contractors will
collect information (i.e., names, email addresses, mailing addresses, phone numbers) from Caregiver Survey respondents to
process incentives and schedule interviews (as applicable). No additional information will be collected from survivor and
caregiver interview respondents to conduct the in-depth interviews (Attachments E and F). No personally identifiable
information will be collected from focus group respondents (Attachment G) (i.e., representatives from patient advocacy
organizations).
Data Storage and Security: For the Wave 1 Survivor Survey, Caregiver Survey, and Wave 2 Survivor Survey will be kept in
a password-protected, secure share drive folder within the contractor's network. The paper survey response will be scanned
and saved on secure workstations or networked shares; original hard copies will be shredded as soon as possible after
survey completion. Qualitative data (interview and focus group transcripts) will be de-identified and saved on the secure
project share drive. Databases and project file shares will be backed up nightly. Only authorized staff will have access to
these folders. All staff workstations have encrypted hard drives, and access to network resources (e.g., project share drives)
requires two-factor authentication. All staff are required to take general information security training and Health Insurance
Portability and Accountability Act of 1996 (HIPAA) security training before being granted access to project data. Data files
that will be used for analysis will not contain any identifiers.
CDC will not be able to link specific responses to actual organizations. No data delivered to CDC from the contractor or
reports produced will include PII or identifiable information.
How long CDC (and contractor, if applicable) will maintain the identifiers: All information collected throughout the study
will be stored until 5 years after the project is completed. Once 5 years have passed, the information will be permanently
deleted.
If CDC (or contractor, if applicable) intends to file and retrieve information by means of information in identifiable
form. In this case, a Privacy Act advisory statement** must be placed on the data collection instrument: To protect
participants' confidentiality, records will be edited to eliminate any PII and data will be linked using a randomly generated
alphanumeric code. A quality control check will be conducted during the data analysis task to ensure that no PII remain. Files
Most
cancer
registry
data With
includes
and
with de-identified
data will
bePII?
converted
to SAS and
being
securely
shared
with CDC.
thesePII
protocols
✔ Yes
Does
this ICR request
any
Noencrypted
If yes, before
describe:
_____________________________________
in place, a Privacy Act advisory statement is not needed.
PII will be used to process incentive

Does this ICR include a form that requires a Privacy Act Statement?payments.
Yes

✔

No

Specify the location of the consent/advisement language: The following voluntary consent forms will be included: 1)
✔ No H); 2) Wave
Wave this
1 Survivor
SurveyaConsent
(Attachment
2 Survivor
Form exist?
(AttachmentYes
I); 3)
Does
ICR require
PIA? Form
Yes
If yes,
does aSurvey
signedConsent
PIA already
Caregiver Survey Consent Form (Attachment J); 4) Survivor Interview Consent Form (Attachment K); 5) Caregiver
Interview Consent Form (Attachment L); and 6) Patient Advocacy Focus Group Consent Form (Attachment M).

C/I/O Approval
Associate Director for Science

Terri Stilllemelle -S

Digitally signed by Terri
Still-lemelle -S
Date: 2024.01.24
06:31:59 -05'00'

Information Systems Security Officer

Cynthia
Allen -S

Comments:
Terri Still-LeMelle signed on behalf of Rachel Kaufmann.

Digitally signed by
Cynthia Allen -S
Date: 2024.01.23
07:59:37 -05'00'

No