21_T. Westat Information Security and Confidentiality Pledge

T. Westat Information Security and Confidentiality Pledge

EMPLOYEE OR CONTRACTOR'S ASSURANCE OF CONFIDENTIALITY OF DATA

ASSESSMENT OF ADMINISTRATIVE COSTS OF ELECTRONIC HEALTH INCENTIVES (eHIP) PROJECTS

Statement of Policy

Westat is firmly committed to the principle that the confidentiality of individual data obtained through Westat data collection must be protected. This principle holds whether or not any specific guarantee of confidentiality was given at time of data collection (or self-response), or whether or not there are specific contractual obligations to the client. When guarantees have been given or contractual obligations regarding confidentiality have been entered into, they may impose additional requirements, which are to be adhered to strictly.

Procedures for Maintaining Confidentiality

1. All Westat employees working on the Assessment of Administrative Costs of Electronic Healthy Incentives (eHIP) Project shall sign this assurance of confidentiality. This assurance may be superseded by another assurance for a particular project.

2. Westat employees shall keep private the names of study participants all information or opinions collected in the course of data collection, and any information about participants or other individuals learned incidentally. All shall exercise reasonable caution to prevent access by others to data in their possession.

3. Unless specifically instructed otherwise, an employee, upon encountering a respondent or information pertaining to a respondent that s/he knows personally, shall immediately terminate the activity and contact her/his supervisor for instructions.

4. An employee will not disclose any information from or about, or provide access to, information or information systems except as instructed by the Contracting Officer's Representative (COR) or an individual designated by the COR.

5. Reasonable caution shall be exercised in limiting access to data to only those persons who are working on the specific project and who have been instructed in the applicable confidentiality requirements for that project.

6. If records with identifiers are to be transmitted between Westat and an external party, this shall be done via secure electronic methods (e.g., secure file transfer protocol).

7. The project director shall be responsible for ensuring that all personnel and contractors involved in handling data on a project are instructed in these procedures throughout the period of performance. At the end of the period of performance, the project director shall arrange for proper storage or disposition of data including any particular contractual requirements for storage or disposition. When required to turn over data to our clients, we must provide proper safeguards to ensure confidentiality up to the time of delivery.

8. The project director shall ensure that practices adhere to the provisions of the U.S. Privacy Act of 1974 with regard to interviews of individuals for the Federal Government. They will ensure that procedures are established in each interview to inform each respondent of the authority for the interview, the purpose and use of the interview, the voluntary nature of the interview (where applicable) and the effects on the respondents, if any, of not responding.

PLEDGE

I hereby certify that I have carefully read and will cooperate fully with the above procedures. I will keep private all information concerning individual respondents to which I gain access. I will not discuss, disclose, disseminate, or provide access to these data and identifiers except as authorized by Westat or the COR. In addition, I will comply with any additional procedures established by Westat for a particular contract. I will devote my best efforts to ensure that there is compliance with the required procedures by personnel whom I supervise. I understand that violation of this pledge is sufficient grounds for disciplinary action, including dismissal. I also understand that violation of the privacy rights of individuals through such unauthorized discussion, disclosure, dissemination, or access may make me subject to criminal or civil penalties. I give my personal pledge that I shall abide by this assurance of confidentiality.

Name (Print or Type)

Signature Date