AOC

Status: Original and derived artifacts are available for this document.

Download: pdf

Attachment 7. Assurance of Confidentiality
ASSURANCE OF CONFIDENTIALITY
THE NATIONAL FIREFIGHTER REGISTRY (NFR) DATA
FIELD RESEARCH BRANCH (FRB)
DIVISION OF FIELD STUDIES AND ENGINEERING (DFSE)
NATIONAL INSTITUTE FOR OCCUPATIONAL SAFETY AND HEALTH (NIOSH)
CENTERS FOR DISEASE CONTROL AND PREVENTION (CDC)
2025

The Secretary of Health and Human Services (HHS) delegated authority to the National Institute for Occupational
Safety and Health (NIOSH) of the Centers for Disease Control and Prevention (CDC) to collect health and
occupational information for the purpose of monitoring and evaluating the cancer incidence among firefighters
in the United States and its territories as outlined in the Firefighter Cancer Registry Act of 2018. The National
Firefighter Registry (NFR) data will be used by scientists within CDC/NIOSH to monitor cancer incidence among
firefighters and evaluate relationships between occupational and other characteristics and cancer. The data can
also be analyzed by CDC/NIOSH scientists for other public health purposes. Data will be provided in a deidentified format for sharing with the public including external researchers, as appropriate.
The Division of Field Studies and Engineering (DFSE), National Institute for Occupational Safety and Health
(NIOSH) has received a 308(d) Assurance of Confidentiality for National Firefighter Registry (NFR) data in order
to protect the sensitive nature of these records which include direct (social security number (SSN), date of birth
(DOB), and first and last name) and indirect (sex, age, race/ethnicity, marital status, employer (name of fire
department), employee ID, current and past job titles (e.g., firefighter, company officer, fire chief, etc.), and hire
date) identifiers obtained through an enrollment questionnaire. The NFR team will also use firefighters’ direct
identifiers to link with population-based (e.g., state) cancer registries, the National Death Index (NDI), and other
information databases for the purposes of determining cancer and health status, cancer diagnosis information,
vital status, and cause of death. CDC/NIOSH will also request roster information from fire departments and state
agencies to provide NIOSH with a list of individuals to be contacted to participate in the NFR and for tracking
participation. The NFR team could also collect incident and employment records from fire departments or
agencies that maintain these records for firefighters who consent to participate in the NFR. Lastly, participating
firefighters can also request that exposure tracking software programs release their exposure tracking data for
inclusion in NFR analyses to better understand firefighters’ exposure profile.
Given that this data collection may include sensitive information that is identifiable or potentially identifiable for
individuals, NIOSH has requested and received authorization under Section 308(d) of the Public Health Service
Act, (42 U.S.C. 242 m (d)) to assure the confidentiality of NFR data by protecting: identifiable data obtained from
individual firefighters participating in the NFR; firefighters’ identifiable information provided by other
institutions (e.g., fire departments, population-based cancer registries, exposure tracking programs); and the
identifying information of fire departments in order to maximize participation from fire departments that are
helping with recruitment or providing information to the NFR for consenting firefighters.
Identifiable information collected will be kept confidential and, aside from CDC/NIOSH or other federal
employees assigned to the project, government contractors, visiting scientists, cooperative agreement partners,
guest researchers, and fellows and trainees, third parties will be restricted from accessing this data. These
individuals who handle the identifiable information will be required to adhere to a security and confidentiality
protocol, participate in annual security training, and sign a 308(d) Nondisclosure Agreement and 308(d)
Confidentiality Pledge. Institutions that house cancer registries and other information databases will be given

access to select identifiable data for data linkage purposes (i.e., so CDC/NIOSH can acquire cancer diagnosis,
health, and vital status records). Those institutions will not be using NFR data for public health purposes, nor will
they receive any data beyond those needed for making successful data linkages for sharing with CDC/NIOSH. Deidentified NFR data will only be accessible to external researchers through a Research Data Center (RDC). All
requests for de-identified NFR data files from outside parties must be made through a proposal to the RDC as
outlined in Section D. Confidentiality Security Statement.
The voluntarily provided information collected by CDC/NIOSH as part of this activity that would permit
identification of individuals or institutions (firefighters and fire departments) is collected and maintained under
Sections 304 and 306 of the Public Health Service (PHS) Act (42 U.S.C. Sections 242b, 242k) with an assurance
that it will be held in strict confidence in accordance with Section 308(d) of the PHS Act (42 U.S.C. Section
242m(d)). Such data will be used only for the purposes stated in this Assurance, and it will not otherwise be
disclosed or released without the consent of the firefighters who provided information to the NFR and parties
who were given this Assurance.
No information collected through the activities outlined in this Assurance that could be used to identify any
individual on whom a record is maintained, either directly or indirectly, will be made available to anyone as set
out in this Assurance. In particular, such information will not be disclosed to: the public; family members; parties
involved in civil, criminal, or administrative litigation, or for commercial purposes; to agencies of the federal,
state, local tribal, or territorial government including Congress, unless as described herein. This protection lasts
forever, even after death.