CIRB Privacy Act Memo

DATE:

December 28, 2009

TO:

Steve Friedman, MHSA
Division of Cancer Treatment and Diagnosis, NCI

FROM:

NIH Privacy Act Officer

SUBJECT: Applicability of the Privacy Act: NIH “NCI Central Institutional Review Board (CIRB)
Initiative”
I have reviewed the NCI submission to OMB entitled “NIH NCI Central Institutional Review Board
(CIRB) Initiative” which involves the collection of data using various information collection tools to
support its activities. This includes forms requiring completion by a site conducting clinical trials eligible
for review by the CIRB as well as forms requiring completion by CIRB board members.
I have determined the Privacy Act will apply to this data collection, which includes the collection of
personally identifiable information (PII) such as name, address, home telephone number, cell phone
number, gender, ethnicity, social security number, financial information, educational level, etc. The
CIRB system of records was designed to request CIRB members provide profile information, nondisclosure agreements, direct deposit forms, etc. and to allow anyone who contacts the CIRB helpdesk
to complete a survey.
Data collected from forms regarding helpdesk support, enrollment, membership, direct deposit,
application and review is stored on CIRB information systems and is not purged or deleted. It is stored
within the system indefinitely as legacy data for review and analysis of CIRB activities. The need to
collect PII occurs sporadically and is stored electronically with frequent backups to ensure information
is recoverable as needed.
The data collection is covered by NIH Privacy Act Systems of Record 09-25-0200, “Clinical, Basic
and Population-based Research Studies of the National Institutes of Health (NIH), HHS/NIH/OD.”
If you have any questions, please contact my office at (301) 496-2832.

Karen M. Plá
Enclosure