Data Sharing and Disclosure Review

Appendix F: Data Sharing and Disclosure Review

1. Disclosure Review and PII Management at CDC/ATSDR

2. Data Management Plan (DMP)

1. Disclosure Review Disclosure Review and PII management at CDC/ATSDR

The Pease Study has developed a Data Management Plan (Part 2) following the CDC/ATSDR Open Data Policy, in which aggregated exposure, health outcomes, and biomarkers results will be made publicly available, and the sharing of individual level data is restricted. All requests for individual level data will be reviewed and evaluated on a case-by-case basis, and a data use agreement is required for all restricted data sharing.

When receiving data requests (including Freedom of Information Act [FOIA] requests) for restricted data sets (e.g. individual level of data), the ATSDR data manager and study principal investigator will follow the disclosure review steps below to review and approve the data requests:

1. Establish a disclosure review board with NCEH/ATSDR privacy professional, study principal investigator, and ad-hoc subject matter experts (SMEs) to review and evaluate the scientific and public health needs in the data request.

   1. Given the high sensitivity of health history information being collected and the high risk of disclosure given the detailed information about the data on personal, behavioral, and residence history collected in the study, the primary goal of the disclosure review board is to make sure that data sharing activities comply with all applicable laws, regulations, and restrictions, and the data are shared for approved uses at the appropriate level.

   2. SMEs will be from NCEH/ATSDR, NCHS, and other CDC national centers, and selected based on the characteristics, sensitivity, and level of details of data elements to be requested.

   3. The disclosure review board will be charged to uphold the requirements of the Certificate of Confidentiality (CoC) which covers this research under Subsection 301(d) of the Public Health Service Act.

   4. Stop here if the proposed data use in the data request is not approved

2. Collect information about the security and privacy protection controls in data requestor’s institution and determine the acceptable re-identification risk threshold for a particular data request.

   1. The acceptable re-identification risk threshold will be determined on a case-by-case basis.

   2. The general decision rule for selecting the acceptable risk threshold is based on a set of factors such as the set of security and privacy controls and practices that the data requestor has in place, the invasion of privacy and potential injury to participants due to data breach, the motives and the capacity of the requestor to re-identify the participant, and so on.

3. Conduct risk assessment and de-identify the data accordingly until the re-identification risk is below the selected threshold above.

   1. Data manager will lead and coordinate the data preparation based on the approval of disclosure review board.

   2. Evaluate the re-identification risk level in the data set. If the risk level is above the acceptable risk threshold, apply applicable de-identification approaches to continue de-identifying the data to reduce the risk level until it is below the acceptable risk threshold.

   3. Stop here if the scientific value of the de-identified data set doesn’t meet the needs in the data request.

4. Use NCEH/ATSDR Data Use Agreement template (attached) to develop a tailored data use agreement (DUA).

   1. The DUA shall be signed prior to data transfer.

5. Approve/disapprove the data request based on the acceptance of the DUA terms and conditions by the data requestor.

PII Management at CDC/ATSDR

PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

All documents with PII (i.e., consent forms, permission forms, collection logs, etc.) will be kept in locked cabinets and all electronic data will be stored on password-protected encrypted CDC computers.

At CDC/ATSDR, PII data from the Pease Study will be stored separately from non-PII data. All EA PII data files will be stored on a CDC/ATSDR encrypted Multi-User Share Tool (MUST) (\\cdc.gov\locker\ATSDR_PFAS_PEASE\PII) and further encrypted by CDC/ATSDR approved file level encryption software (e.g. Symantec Encryption Desktop).

The ATSDR data manager will oversee all PII evaluation, finalization and de-identification activities. Before data collection begins, the ATSDR data manager will review the Pease Study questionnaires and identify questions with potential PII. At the end of data collection, the ATSDR data manager will lead all re-identification risk assessment and de-identification activities to finalize the Pease Study PII and non-PII data sets.

Each Pease Study study participant will be assigned a study ID that will link their PII and non-PII individual records. PII will not be linked with files used for statistical analyses and will not appear in any reports generated from the Pease Study data set. Only the Pease Study principal investigators and ATSDR data manager will have access to the linking information between non-PII records (e.g. study ID, sample identification codes) and PII records for administrative purposes.

Both ATSDR and Abt Associates (“contractor”) will minimize PII data access to staff on a need-to-know basis. All PII access requests need to be reviewed and approved by the Pease Study principal investigators. All PII data request, access, approval, and use activities will be recorded in a log file that will include at least the following:

• Requestor’s name and organization

  • Requestor’s needs for PII

  • Request date

  • Approved by

  • Approval date

  • Approved uses and storing location of PII

  • PII access/use expiration date

  • Data use agreement or Memorandum of Understanding, if any

  • Status (e.g. new request, under review, approved, in use, disposed, etc.)

Only authorized staff have access to PII. The ATSDR data manager is responsible for managing access to PII and recording all PII access activities. All approvals of access to PII will be reviewed every six months, and access to PII will be removed immediately when no longer needed.

2. Data Management Plan

NCEH/ATSDR Data Management Plan Template for CDC Datasets

Purpose: This template helps CDC¹ dataset custodians and extramural researchers develop data management plans (DMPs). The template is intended for use with any type of CDC and CDC-funded public health datasets, including non-research (public health practice) data received from state health departments (such as surveillance and program data); non-research (public health practice) data collected by CDC (such as surveillance and emergency investigation data); and research data collected or received by CDC or CDC grantees.

Background: DMPs should comply with the CDC/ATSDR Policy on Releasing and Sharing Data (http://isp-v-maso-apps.cdc.gov/Policy/Doc/policy385.pdf) in addition to any policies from the relevant CIO, division, and branch. In addition, DMPs for research involving human subjects should adhere to procedures approved by relevant Institutional Review Boards, if applicable.

Data collected and received by CDC are federal records and are subject to federal laws and rules, as described in Appendix B of the CDC-ATSDR Data Release Guidelines and Procedures for Re-release of State-Provided Data.

Plans for datasets provided by states should also be consistent with the CDC-ATSDR Data Release Guidelines and Procedures for Re-release of State-Provided Data (available at http://www.cste2.org/webpdfs/drgwgreport.pdf).

When to use this document: First, complete the NCEH/ATSDR Data Management Plan Determination form. If a DMP is needed, use this template to develop such a plan for each data collection activity. Complete the DMP during the project planning phase; the plan will represent a mutual understanding between CDC and the data source institution(s), if any.

Data categories: Covered by policy: green shading (D1–D3); covered by policy but release/sharing limited: yellow shading (D4–D7); not covered by policy: red shading (D8–D10).

D1 = data collected or generated by CDC	D6 = data deemed not shareable due to inadequate return on investment
D2 = data collected or generated by other agencies or organizations funded or co-funded by CDC	D7 = data deemed not shareable for other reasons
D3 = data reported to CDC by another entity that become part of a CDC data collection system	D8 = data collected or generated by other organizations that are shared with CDC and without CDC funding
D4 = data protected from disclosure by applicable laws or regulations	D9 = data provided to CDC by license or other agreements (MOU, IAA, DTA or MTA) that state restrictions on use or sharing of data
D5 = data deemed not sharable due to a potential dual-use research of concern	D10 = data provided to CDC by another federal agency under restricted terms of use and sharing of the data

NCEH/ATSDR Data Management Plan Form

This plan describes the anticipated use and release by CDC of the dataset named below. All CDC DMPs are required to be in compliance with the CDC/ATSDR Policy on Releasing and Sharing data, available at http://isp-v-maso-apps.cdc.gov/Policy/Doc/policy385.pdf. This plan is modifiable and does not represent a legal contract between CDC and any other entity. The elements included do not necessarily constitute an exhaustive list of all possible elements for a DMP, so users should add elements as needed.

The DMP is submitted through eClearance for review and approval. Use “TBD” if you cannot determine some of this information at the time of submission. Elements with an asterisk (*) are required data fields for metadata.

Table 1 – Core DMP Elements (should be filled out when project approval is sought)

MRID

(NCEH/ATSDR metadata repository identifier - for NCEH/ATSDR OD use only.)

*Title

(Human-readable name of the project. Title should be in plain English and include sufficient detail to facilitate search and discovery.)

Human health effects of drinking water exposures to PFAS at Pease International Tradeport, Portsmouth, NH (Pease Study).

*Description

(Human-readable description with sufficient detail to enable a user to quickly understand whether the project or dataset is of interest. A short, clear description is ideal.)

The Pease Study will be a proof of concept study for the multi-site health study. It will be a cross-sectional study and will recruit from the convenience sample of children and adults who participated in the 2015-7 Pease biomonitoring program. The goal is to enroll at least 350 children (ages 4-17) and 1,000 adults aged ≥18 years.

The adult and children studies will obtain blood specimens from participants to measure PFAS serum levels and several effect biomarkers in addition to completing a questionnaire. The child and adult studies will evaluate changes in serum PFAS concentration over time using the existing biomonitoring and new PFAS results, and will contribute to half-lives and elimination rate estimations for PBPK modeling. Urine specimens will be collected and stored until such time that analytical methods are developed and scientific evidence shows which PFAS tests will yield useful measureable results.

The results from the Pease Study will contribute to the body of scientific research examining health outcomes related to community PFAS exposures from contaminated drinking water. They will inform the direction and design of the multi-site and other future PFAS studies.

(refer to study protocol for detailed information)

*Last DMP Update

(Most recent date on which the DMP was changed, updated, or modified.)

2/21/2019

*Contact Name and Email

CDC PI or POC Name (last, first): Pavuk, Marian

CDC PI or POC e-mail address: FSH8

CDC PI or POC phone number: 770-488-3671

Organization

(Use CIO/Division/Branch as locator of where the project is conducted or supported; or use the awardee institution for an extramural project.)

ATSDR/NCEH, DTHHS/EEB

*Unique Identifier and catalog/database name

(A unique identifier for the project as maintained within an Agency catalog or database. For intramural submissions, protocol/S3P number can be used. For extramural submissions, grant/cooperative agreement/ contract number can be used to map to related documents.)

*Data Access Level(s) – CHECK ALL APPLY

(The degree to which the data collected as part of this project could be made publicly available, regardless of whether it has been made available. Projects can have multiple datasets or different data elements within a single dataset that are approved for different levels of public access.)

PUBLIC Release

☐ Public release – Full dataset

(Dataset can be made available without restrictions; data steward no longer controls data. This should be the default selection for all datasets unless justified otherwise.)

☐ Public release – Aggregate data

(Underlying dataset cannot be released or shared, but aggregate/summary data can.be made available to public access without restriction)

Justification (required if selected):

☐ Public release - Release by ad-hoc request

(Metadata will be released and the dataset is available by ad-hoc request; data requests CANNOT be denied; no data use agreement or restrictions; data steward no longer controls data.)

Justification (required if selected):

RESTRICTED Release

☒ Restricted use data sharing

(Dataset is available to particular parties under certain use restrictions or use agreement; data not always under CDC custody. The use restriction/agreement (or template) needs to be attached.

Justification (required if selected):

The data set contains demographic, educational, medical, and other health related information that can be combined to potentially identify individual study participants. If all potential PII is removed completely, the scientific value of the data set will decrease significantly. Therefore only limited data sets can be shared for scientific purposes if the data requests are approved by study PIs and the recipients agree and sign the data use agreement.

☐ Restricted access data sharing

(Dataset is only available in an RDC; data need to remain under CDC custody.)

Justification (required if selected):

No Data Release/Sharing

☐ No release or data sharing

Justification (required if selected):

Access Rights/Restrictions

(Include information regarding access or restrictions based on privacy, security, or other policies of the owner of the data. Include an explanation for the selected “Public Access Level” above.)

The data set is protected by a Certificate of Confidentiality

License/Other Agreements

(The license or non-license [i.e., public domain] status with which the dataset will be published. See Open Licenses for more information. May include DTA, MTA, IAA, MOU or other agreements concerning data use and access.)

N/A

*Publisher/Owner

(The publishing entity and optionally their parent organization(s). This could be the “owner” of the data.)

ATSDR

Access URL(s), If Known

(URL providing indirect access to the DMP, dataset, data dictionary [variable names and valid values], data collection instrument and other relevant information, including the research protocol if possible.)

TBD

Download URL(s), If Known

(URL providing direct access to a downloadable file of the dataset, summary data, or data tables.)

TBD

*Spatial

(The range of spatial applicability of a dataset. Could include a geographic region or a named place [city, county, state, region, country].)

Pease International Tradeport, Portsmouth, NH, USA

*Temporal

(The range of temporal applicability of project)

Start date of data collection (month/year): August/2019 (estimated)

End date of data collection (month/year): July/2020 (estimated)

Table 2 – Additional DMP Elements (should be filled out where possible when project approval is sought; however, many fields can only be filled out later when publication/report is cleared)

*Tags/Keywords

(Keywords to help users discover the dataset.)

PFAS, exposure, health outcomes, endocrine, metabolic, neuro-behavioral, children, adults

*Intramural or Extramural Project

☒ Intramural

☐ Extramural (grant, cooperative agreement)

Specify mechanism: contract

Project Type – CHECK ALL APPLY

(Multiple selections may apply.)

☒ Research ☐ Emergency

☐ Non-research ☐ Exposure investigation

☐ Surveillance ☐ Ongoing collection

☐ Evaluation ☐ Other

Dates

Estimated date of data release/sharing (month/year): 03/2025

Preservation expiration date (year that the dataset will be available until):

Data Category

(For explanation of D1 to D10 codes, see Table on page 1)

☐ D1 ☒ D2 ☐ D3 ☐ D4 ☐ D5

☐ D6 ☐ D7 ☐ D8 ☐ D9 ☐ D10

Justification: (provide detailed information about the data category selected above. If D6 is selected, provide quantitative estimates of costs in releasing data and expected volume of use. If D7 is selected, specify the reason that prevents the owner from releasing/sharing the data.)

Population Represented

(e.g., “residents of x,” “inpatients at x,” “users of product x”)

Population and subjects are selected based on the exposure characteristics of subjects and/or area/site studied. Do not necessarily represent the site or area.

Refer to section 3.2 “Study Populations and Eligibility” in the study protocol for detailed information.

Data Collection Protocol

(Brief description with reference to document or website that provides detailed information.)

Refer to section 3.6 Data Collection Procedures in the study protocol.

Data Management Protocol

(Brief description with reference to physical location(s) or system(s) where data will be housed (e.g., CDC shared network drive, data host system name, SQL database, etc.) and to data formats. Include the locations of dataset both before data release and after data release.)

Study data will be stored on an encrypted CDC MUST share: \\cdc.gov\locker\ATSDR_PFAS

Process for Omitting Identifying Information

(Description of what identifiers are in the database, how they will be removed, and by whom.)

Before data collection starts, study data manager will review all questions and identify potential PII.

All potential PII will be managed as PII during the study until the final PII evaluation is completed.

When data collection ends, study data manager will work with study PIs to conduct re-identification risk assessment, and finalize the PII in the dataset.

Once the final PII are identified, they will be removed from the data set and stored and managed separately from the non-PII data.

Data Quality Protocol (to address issues of confidentiality protection and statistical stability)

(Brief description with reference to document or website that provides detailed information. Describe methods for data validation and error resolution, removal or shielding of any proprietary information, removal or shielding of sensitive information [i.e., data with dual use applicability], removal or shielding of any individually identifying information including indirect identification.)

Refer to Section 3.7.3 Quality Control/Quality Assurance in study protocol.

Data Retention/Disposal Plan

(State when and how the dataset will be archived or destroyed [in accordance with CDC/ATSDR Records Control Schedule: http://isp-v-maso-apps/RecSched/images/RCS.pdf ].)

Data will be stored on the dedicated MUST share until they are no longer needed for scientific and administrative reasons determined by the program that owns the data. Then the program will follow ATSDR policy and record control schedule to archive and dispose the data files.

Data Analysis Plan

(Brief description of planned use of the data. Can include reference to document [e.g., information collection request, research protocol, or other] that provides more detailed information.)

Refer to section 3.7 Biochemical Analyses, 3.9 Exposure Estimation, and 3.10 Statistical Analysis in study protocol.

Publication Plan

(Brief description of planned CDC-authored and CDC-coauthored publications, including topic, type of publication, and estimated timeline.)

To be developed.

Data Release Documentation

(List documents provided to users, e.g., variable definitions, codebook, metadata file, guidance on data use.)

TBD

Data Release Format

(Recommend to use non-proprietary format when possible, such as CSV, JSON, etc. Also specify data dictionary file format.)

TBD

Data Release Notification

(State how potential users will be informed of dataset availability.)

TBD

Date Form Completed: _03/19/2019____________ By: _Marian Pavuk, Co-PI

Name, Title

Date Form Last Revised: _________________ By: _________________________________

Name, Title

Instructions for Data Use Agreement for NCEH/ATSDR Data Set

Restricted data sets are usually not available for public use because they contain Personally Identifiable Information (PII), Protected Health Information (PHI), or sensitive information about data subjects. The purpose of this template is to help National Center for Environmental Health/Agency for Toxic Substance and Disease Registry (NCEH/ATSDR) programs and data set custodians develop data use agreements so that they can share restricted data set(s) with NCEH/ATSDR or non-NCEH/ATSDR researchers for approved purposes.

The data use agreement (DUA) must be completed prior to the release of, or access to, specified data sets covered by the agreement. The DUA is an agreement between NCEH/ATSDR and the signatory data recipient, and shall be implemented only after potential data recipients have demonstrated an acceptable public health need and an understanding of the restrictions on the use of the data.

NCEH/ATSDR programs may revise or delete some of the components of this agreement, as needed and/or applicable. Additional requirements, terms, or conditions may be added in SECTION 4: TERMS OF AGREEMENT at NCEH/ATSDR programs’ discretion

If you have questions, please contact Hao Tian (ejq7@cdc.gov).

Data Use Agreement for NCEH/ATSDR Data Set

This data use agreement (hereinafter referred to as the “Agreement”) is entered into by and between the data provider, National Center for Environmental Health/Agency for Toxic Substance and Disease Registry (hereinafter referred to as “NCEH/ATSDR”) and the data recipient, ________________________________________________ (hereafter referred to as the “Recipient”), collectively, the “Parties”, and shall be effective as of the ________________ (enter the DUA effective date), and shall remain in effect until _________________ (enter the DUA expiration date), or until the Agreement is terminated in accordance with the provisions below.

This Agreement establishes the terms and conditions under which NCEH/ATSDR will provide, and the Recipient will obtain and use the data set specified in Section 1 and/or any derivative data set/file(s) that contain direct identifiers or information that can be combined with other information to identify individual data subjects. This Agreement is non-transferable and supersedes all previous agreements between the parties with respect to the data set specified in Section 1. Further, the terms of this Agreement may only be amended or supplemented by an agreement made in writing and signed by authorized representatives of each party.

The Agreement may be terminated by either party at any time upon _______ days’ written notice from the terminating party to the other party. Sections 1.3, 2.1, 2.3, 2.4, 3.1, 3.2, 3.3, 3.4 and ____________ (enter additional Sections as needed) shall survive the expiration or any termination of this Agreement.   

This Agreement describes the Recipient rights and obligations with respect to the data set and the limited purposes, for which the Recipient may create, receive, maintain, use, disclose and/or have access to the data set. The Recipient agrees to ensure the integrity, security, and confidentiality of the data by complying with the terms of this Agreement and applicable federal and state laws and regulations.

The Parties agree to comply with applicable federal and state laws, regulations and requirements on data sharing and privacy protection, including but not limited to Section 301(d) of the Public Health Service Act (42 USC 241(d)), 45 CFR Part 46, Human Subjects Protection, andthe CDC/ATSDR Policy on Public Health Research and Nonresearch Data Management and Access.

SECTION 1: PROJECT, DATA SET, CUSTODIAN AND RECIPIENTS INFORMATION

1.1 Project Description

(Provide an overview of the scientific activities and organizations/parties involved. Aim to include project goals, why the data are needed, how the data will be used/disclosed, etc.) ____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

The Recipient affirms that the requested data will be used by the Recipient solely in connection with project (hereinafter referred as the “Project”) as described in this Agreement, and the requested data is the minimum necessary to achieve the project goals and purposes stated in this section.

1.2 Data Set

The following data set/file(s) (hereinafter referred as the “Data Set”) is/are covered under this Agreement.

(Describe the Data Set with names of specific data elements and necessary information (e.g. study name, collection period, etc.) to clarify the data elements that will be released to the Recipient.)

__________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

1.3 Data Ownership

NCEH/ATSDR will retain all ownership rights to the Data Set, and the Recipient does not obtain any right, title, or interest in any of the Data Set, except as authorized by this Agreement.

The parties mutually agree that analyses or findings (not including personally identifiable information) created from the Data Set may be retained by the Recipient indefinitely.

The Recipient agrees not to disclose the Data Set to any person or organizations that are not authorized by this Agreement except as required by law.

1.4 NCEH/ATSDR Custodian of Data

NCEH/ATSDR Data Custodian (division/branch/section or team):

NCEH/ATSDR Point of Contact:

Name:
E-mail:
Phone Number:

1.5 The Users Who Will Have Access to Data

Recipient principal person who will be responsible for the observance of all conditions of use and for establishment and maintenance of security arrangements as specified in this Agreement to prevent unauthorized use.

Name:
Job title:
Research role:
Affiliation:
E-mail:
Phone Number:
Street Address:

Recipient point of contact (if different from the person above)

Name:
Job title:
Research role:
Affiliation:
E-mail:
Phone Number:
Street Address:

Additional users in the Recipient who will have access to the data

(Copy this table for additional users as needed, or include them in an attached document.)

Name:
E-mail:

Name:
E-mail:

Name:
E-mail:

The Recipient agrees to notify NCEH/ATSDR within fifteen (15) calendar days of any change in the named principle person, contact and users.

SECTION 2: DATA USE, TRANSFER, ACCESS, RETENTION AND DISPOSITION

2.1 Approved Use of Data

The Data Set covered by this Agreement is to be used exclusively for the following: (List all approved uses of Data Set here)

______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________

______________________________________________________________________________
______________________________________________________________________________

The Recipient agrees to use and disclose the data only in accordance with this Agreement, or as otherwise required by law. Any data use by the Recipient not specifically listed above is prohibited unless this Agreement is subsequently modified in writing. The Recipient may not use the Data Set provided to engage in any method, act, or practice that constitutes a commercial solicitation or advertisement of goods or services.

2.2 Data Transfer

Check all applicable options:

☐ Data Set will be transferred to and managed by the Recipient using secure and CDC approved technology and media.

☐ Approved users from the Recipient will be granted access to the Data Set managed by NCEH/ATSDR programs.

☐ Data Set will be available to the Recipient users ONLY at a controlled site (e.g. CDC Research Data Center)

2.3 Data Access

The access to the Data Set shall be restricted to users of the Recipient authorized by this Agreement. The Recipient agrees to ensure that anyone who accesses these data agree to the same restrictions and conditions that are included in this Agreement.

2.4 Data Retention and Disposition

The Recipient will maintain the Data Set in an appropriate manner for the content and dispose them properly.

The Recipient will, on the termination or within _________ days of the expiration of this Agreement, at its expense return to NCEH/ATSDR or destroy, at NCEH/ATSDR’s election, to the extent feasible and permitted by applicable law, all originals and copies of Data Set received from NCEH/ATSDR under this Agreement.

The Recipient will certify in writing to NCEH/ATSDR that all the Data Set that has been received, maintained, and used by or disclosed to the Recipient has been destroyed or returned to NCEH/ATSDR, and the Recipient shall retain no copies of the data.

SECTION 3: SECURITY AND PRIVACY PROTECTION

3.1 Safeguards of Data

The Data Set covered by this Agreement has been categorized by NCEH/ATSDR as _________ (enter low, moderate, or high as determined by NCEH/ATSDR Information Systems Security Officer) per Federal Information Processing Standard 199, Standards for Security Categorization of Federal Information and Information Systems.

The Recipient will establish, implement and maintain appropriate administrative, physical, and technical safeguards to protect data confidentiality, integrity, and availability. The safeguards shall provide a level and scope of security that is not less than the level and scope of common information security laws and regulations, such as Federal Information Security Act of 2002 (FISMA), the Health Insurance Portability and Accountability Act of 1994 Privacy and Security Rules, Office of Management and Budget Circular No. A-130, Appendix III – Security of Federal Automated Information Systems, Federal Information Processing Standard 200 entitled “Minimum Security Requirements for Federal Information and Information Systems”, and National Institute of Standards and Technology (NIST) Special Publication 800-53 “Recommended Security Controls for Federal Information Systems”. The Recipient will ensure prevention of any unauthorized use or disclosure of Data Set as long as the Recipient has such Data Set in its actual or constructive possession.

3.2 Privacy Protection

The Recipient will not attempt to identify or contact the data subjects within the Data Set provided unless approved in this Agreement. (Describe any agreed upon exceptions if needed)

__________________________________________________________________________________

__________________________________________________________________________________

The Recipient agrees not to disclose findings, listings, or information derived from the Data Set, with or without direct identifiers, if such findings, listings or information can, by themselves or in combination with other data, be used to deduce any individual data subject’s identity.

The Recipient agrees to data aggregation when there is sufficient data and when appropriate, in a way that such aggregation will not permit the identification of data subjects.

Termination of this Agreement shall not relieve the Recipient of its obligations of maintaining the confidentiality of the Data Set.

3.3 Breach Notice and Reporting

In the event of a data security/privacy breach including but not limited to data theft, loss, unauthorized access/use/disclosure, or compromise of any device storing data, the Recipient shall:

1. cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach.

2. be able to determine what information under this Agreement was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access information, and identify the initial attack vector.

3. report a suspected or confirmed breach in any medium as soon as possible and no later than 1 hour of discovery to CDC Computer Incident Response Team (CSIRT) via email at csirt@cdc.gov or telephone at 866-655-2245.

4. respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) or CDC CSIRT within 24 hours as instructed, whether the response is positive or negative

5. provide NCEH/ATSDR with status updates upon request and a written closing action report once the security event or incident has been resolved.

NCEH/ATSDR acknowledges that CDC will not interpret report of a breach, by itself, as conclusive evidence that the Recipient failed to provide adequate safeguards for the PII.

The Recipient shall bear the cost and liability for any breaches of personally identifiable information from the Data Set while they are entrusted to the Recipient. Furthermore, if NCEH/ATSDR determines that the risk of harm requires notification of affected individual persons of the security breach and/or other remedies, the Recipient agrees to provide the notice and remedies without cost to NCEH/ATSDR.

3.4 Penalty

Recipient hereby acknowledges that failure to comply with the terms of this agreement may result in cancellation of this Agreement and to further access to NCEH/ATSDR data.

The Recipient hereby acknowledges that the unauthorized use or disclosure of confidential information may be punishable under federal and state laws and regulations.

The Recipient further acknowledges that criminal penalties under the federal Privacy Act of 1974 may apply if it is determined that the Recipient or any individual employed or affiliated therewith, knowingly and willfully obtained the data file(s) under false pretenses.

By signing this Agreement, the Recipient agrees to abide by all provisions set out in this Agreement and acknowledges having received notice of potential criminal or administrative penalties for violation of the terms of the Agreement.

SECTION 4: TERMS OF AGREEMENT

NCEH/ATSDR programs may select the terms and conditions below that are applicable to the specific Data Set covered by this Agreement, and revise or delete them as needed. Additional requirements, terms, or conditions may be added at NCEH/ATSDR programs’ discretion.

The Recipient hereby agrees to adhere to the following terms and conditions.

4.1 Human Research Protection

The Recipient agrees to assume responsibility for ensuring compliance with all the requirements for the Human Research Protection Program, as prescribed by 45 CFR Part 46, if the Data Set are to be used for activities covered by those regulations.

4.2 Written Agreement for Data Access

The Recipient agrees to ensure that any person to whom the Recipient provides access to any part of the Data Set, executes a written agreement with the Recipient agreeing to the same restrictions and conditions that apply to the Recipient under this Agreement with respect to the access, use, and confidentiality of any such Data Set.

4.3 Publication and Presentation of Results

Check the conditions applicable to this Data Set and provide details if needed

☐ The Recipient agrees to add following disclaimer when reporting in all oral presentations or written publications/reports concerning the Project.

Disclaimer: ___________________________________________________________________

☐ The Recipient agrees to submit the manuscripts of all oral presentations or written publications concerning the Project to NCEH/ATSDR for review and approval prior to the publication or presentation.

☐ The Recipient agrees to notify NCEH/ATSDR of acceptances and publications using the Data Set.

☐ The Recipient agrees to add following citation as the data source in all oral presentations or written publications/reports concerning the Project.

Citation: _________________________________________________________________

☐ The Recipient agrees to acknowledge NCEH/ATSDR’s contribution of this Data Set unless requested otherwise in all oral or written presentations, reports, and publications of results derived from the Data Set under this Agreement

(Additional terms or conditions may be added here at NCEH/ATSDR programs’ discretion.)

SIGNATORIES

On behalf of both parties, the undersigned individuals hereby attest that he or she is authorized to enter into this Agreement and agrees to all of the terms specified herein.

DATA RECIPIENT SIGNATURE:

Name of Priciple Responsible Data Recipient Title

Signature of Principle Responsible Data Recipient Date

DATA PROVIDER SIGNATURE:

Name of NCEH/ATSDR Approving Official Title

Signature of NCEH/ATSDR Approving Official Date

1 References to CDC also include the Agency for Toxic Substances and Disease Registry (ATSDR) throughout this document.