Data Management Plan

Appendix I: Data Management Plan

Appendix I1: Data Management Plan (DMP) form

Appendix I2: NCEH/ATSDR Data Use Agreement Template

Appendix I3: SOPs for Data Management

Appendix I1: Data Management Plan (DMP) form

Table 1 – Core DMP Elements (should be filled out when project approval is sought)

MRID

(NCEH/ATSDR metadata repository identifier - for NCEH/ATSDR OD use only.) P1805-0008

*Title

Biological and Environmental Sampling of Per- and Polyfluoroalkyl Substances (PFAS)

*Description

A statistically based, community sampling design will be used to determine

• PFAS serum concentrations from participants living in communities with exposures to PFAS in drinking water.

• PFAS urine concentrations from a subset of participants living in communities with exposures to PFAS in drinking water.

  • An initial 10% of urine samples will be analyzed for 18 PFAS and creatinine. Additional analytes may be added should methods become available. If the geometric mean PFAS concentrations in this initial subset are elevated compared to the U.S. national reference population, as defined by the 2013-2014 NHANES 95th percentile, all other urine samples from the site will be analyzed.

• PFAS concentrations in indoor dust and tap water samples from a subset (10%) of homes of participants in biological sampling.

A questionnaire will be administered to all participants to gather information that can be used to characterize each individual’s exposure.

The collected data will be analyzed to determine PFAS blood levels for individual participants as well as the community as a whole. Serum and urine concentrations will be compared to reference ranges from nationally representative data, and correlations between environmental and biological PFAS concentrations will be evaluated.

*Last DMP Update

May 30, 2022

*Contact Name and Email

CDC PI or POC Name (last, first): Scruton, Karen

CDC PI or POC e-mail address: isg3@cdc.gov

CDC PI or POC phone number: 770-488-1325

Organization

ATSDR/OCHHA

*Unique Identifier and catalog/database name

TBD

*Data Access Level(s) – CHECK ALL APPLY

(The degree to which the data collected as part of this project could be made publicly available, regardless of whether it has been made available. Projects can have multiple datasets or different data elements within a single dataset that are approved for different levels of public access.)

PUBLIC Release

☐ Public release – Full dataset

(Dataset can be made available without restrictions; data steward no longer controls data. This should be the default selection for all datasets unless justified otherwise.)

☒ Public release – Aggregate data

(Underlying dataset cannot be released or shared, but aggregate/summary data can.be made available to public access without restriction)

Justification (required if selected): Underlying dataset cannot be released in order to protect personally identifiable information, only aggregate summary data will be made available to public access without restriction.

☐ Public release - Release by ad-hoc request

(Metadata will be released and the dataset is available by ad-hoc request; data requests CANNOT be denied; no data use agreement or restrictions; data steward no longer controls data.)

Justification (required if selected):

RESTRICTED Release

☒ Restricted use data sharing

(Dataset is available to particular parties under certain use restrictions or use agreement; data not always under CDC custody. The use restriction/agreement (or template) needs to be attached.

Justification (required if selected): Limited data set (including no direct PII) may be shared with approved data requestors for approved scientific purposes via data use agreement.

☐ Restricted access data sharing

(Dataset is only available in an RDC; data need to remain under CDC custody.)

Justification (required if selected):

No Data Release/Sharing

☐ No release or data sharing

Justification (required if selected):

Access Rights/Restrictions

(Include information regarding access or restrictions based on privacy, security, or other policies of the owner of the data. Include an explanation for the selected “Public Access Level” above.)

In compliance with federal and state privacy protection laws and regulations, the limited data set may be shared with other federal, state and/or local public health and environmental agencies via data use agreements for research purposes to advance the scientific understanding of human exposures to PFAS.

License/Other Agreements

(The license or non-license [i.e., public domain] status with which the dataset will be published. See Open Licenses for more information. May include DTA, MTA, IAA, MOU or other agreements concerning data use and access.)

*Publisher/Owner

(The publishing entity and optionally their parent organization(s). This could be the “owner” of the data.)

CDC/ATSDR

Access URL(s), If Known

(URL providing indirect access to the DMP, dataset, data dictionary [variable names and valid values], data collection instrument and other relevant information, including the research protocol if possible.)

TBD

Download URL(s), If Known

(URL providing direct access to a downloadable file of the dataset, summary data, or data tables.)

TBD

*Spatial

(The range of spatial applicability of a dataset. Could include a geographic region or a named place [city, county, state, region, country].)

Data will be collected from Department of Defense (DoD) and non-DoD sites across the county.

*Temporal

(The range of temporal applicability of project)

Start date of data collection (month/year): June 2022

End date of data collection (month/year): June 2025

Table 2 – Additional DMP Elements (should be filled out where possible when project approval is sought; however, many fields can only be filled out later when publication/report is cleared)

*Tags/Keywords

(Keywords to help users discover the dataset.)

PFAS, PFOA, PFOS, PFNA, PFHxS

*Intramural or Extramural Project

☐ Intramural

☒ Extramural (grant, cooperative agreement, contract, IAA, CDC Foundation, other)

Specify mechanism: Project will be conducted as appropriate for each PFAS EA.

Project Type – CHECK ALL APPLY

(Multiple selections may apply.)

☐ Research ☐ Emergency

☒ Non-research ☒ Exposure investigation

☐ Surveillance ☐ Ongoing collection

☐ Evaluation ☐ Other

Dates

Estimated date of data release/sharing (month/year): June 2025

Preservation expiration date (year that the dataset will be available until): TBD

Data Category

(For explanation of D1 to D10 codes, see Table on page 1)

☐ D1 ☒ D2 ☐ D3 ☐ D4 ☐ D5

☐ D6 ☐ D7 ☐ D8 ☐ D9 ☐ D10

Justification: (provide detailed information about the data category selected above. If D6 is selected, provide quantitative estimates of costs in releasing data and expected volume of use. If D7 is selected, specify the reason that prevents the owner from releasing/sharing the data.)

Data will be collected by a contractor or cooperative agreement partner funded by CDC/ATSDR.

Population Represented

(e.g., “residents of x,” “inpatients at x,” “users of product x”)

TBD – Residents of DoD or non-DoD locations with PFAS contaminated drinking water. Exact locations to be determined.

Data Collection Protocol

(Brief description with reference to document or website that provides detailed information.)

Participants in each exposure assessment will complete consent/assent/parental permission forms, provide blood and urine samples and respond to a questionnaire. Participants will be responsible for collecting first morning urine samples in their homes and transporting them to the centralized blood collection location. A subset of participant households will be randomly selected for environmental (i.e., indoor dust and tap water) sampling. Administration of consent forms for environmental sampling and indoor dust and tap water sample collection will take place during a home visit.

All blood samples will be shipped to the NCEH laboratory for analysis of PFAS concentrations and may then shipped to a bio-specimen repository for storage. A subset of urine samples will be shipped to the NCEH laboratory for analysis of PFAS concentrations. The remaining urine samples may be shipped to a bio-specimen repository for storage. Drinking water and indoor dust samples will be shipped to an EPA-accredited laboratory for analysis of PFAS concentrations.

Detailed data collection procedures are available in the protocol for the assessments.

Data Management Protocol

(Brief description with reference to physical location(s) or system(s) where data will be housed (e.g., CDC shared network drive, data host system name, SQL database, etc.) and to data formats. Include the locations of dataset both before data release and after data release.)

All data will be transmitted to ATSDR or ATSDR contractor for incorporation into a centralized data management system. All results will be electronically transmitted in spreadsheet format using a secured and password-protected network.

All documents with personal identifying information (i.e., consent forms, assent forms, collection logs, etc.) will be kept in locked cabinets and all electronic data will be stored on a password-protected network servers behind firewalls, accessible only to those staff working directly with raw data.

De-identified samples will be sent to the laboratories—no individual identifiers will be included. Any reports produced from this information will not identify specific individuals.

Process for Omitting Identifying Information

(Description of what identifiers are in the database, how they will be removed, and by whom.)

All samples and data will be identified with a unique code. Only the project coordinator will have access to the link between the sample identification code and personal identifying information in order to facilitate communication of individual results with participants.

Data Quality Protocol (to address issues of privacy protection and statistical stability)

(Brief description with reference to document or website that provides detailed information. Describe methods for data validation and error resolution, removal or shielding of any proprietary information, removal or shielding of sensitive information [i.e., data with dual use applicability], removal or shielding of any individually identifying information including indirect identification.)

All laboratory analyses will be conducted with established procedures for quality assurance and control according to NCEH and EPA protocols. These methods are identified in the protocol for the exposure assessments and are available from NCEH and EPA.

Data Retention/Disposal Plan

(State when and how the dataset will be archived or destroyed [in accordance with CDC/ATSDR Records Control Schedule: http://isp-v-maso-apps/RecSched/images/RCS.pdf ].)

Records will be retained and disposed of in accordance with the CDC Records Control Schedule. Physical copies of assessment materials and reports will be maintained at ATSDR until no longer needed by program officials and will be kept no longer than five years following completion of the exposure assessment in accordance with retention schedules. Computer documents will be disposed of when no longer needed by program officials and will be kept no longer than five years following the study. Personal identifiers will be deleted from records when no longer needed. Disposal methods will include erasing computer files, shredding paper materials, or transferring records to the Federal Records Center when no longer needed for evaluation and analysis. Records are retained for 20 years.

Data Analysis Plan

(Brief description of planned use of the data. Can include reference to document [e.g., information collection request, research protocol, or other] that provides more detailed information.)

Data will be analyzed for each individual participant and in aggregate. Detailed information is provided in the protocol.

Publication Plan

(Brief description of planned CDC-authored and CDC-coauthored publications, including topic, type of publication, and estimated timeline.)

Findings from the exposure assessments are expected to be published as ATSDR reports and in the peer reviewed literature. The topic of publications will be human exposure to per- and polyfluoroalkyl substances. Reports and publications are estimated to be released by 2025.

Data Release Documentation

(List documents provided to users, e.g., variable definitions, codebook, metadata file, guidance on data use.)

TBD

Data Release Format

(Recommend to use non-proprietary format when possible, such as CSV, JSON, etc. Also specify data dictionary file format.)

CSV

Data Release Notification

(State how potential users will be informed of dataset availability.)

TBD

Date Form Completed: _May 30, 2022_________

By: _Karen Scruton, MS, Exposure Investigations Section Chief

Date Form Last Revised: _May 30, 2022_________

By: _ Karen Scruton, MS, Exposure Investigations Section Chief

Appendix I2: NCEH/ATSDR Data Use Agreement Template

Instructions for Data Use Agreement for NCEH/ATSDR Data Set

Restricted data sets are usually not available for public use because they contain Personally Identifiable Information (PII), Protected Health Information (PHI), or sensitive information about data subjects. The purpose of this template is to help National Center for Environmental Health/Agency for Toxic Substance and Disease Registry (NCEH/ATSDR) programs and data set custodians develop data use agreements so that they can share restricted data set(s) with NCEH/ATSDR or non-NCEH/ATSDR researchers for approved purposes.

The data use agreement (DUA) must be completed prior to the release of, or access to, specified data sets covered by the agreement. The DUA is an agreement between NCEH/ATSDR and the signatory data recipient, and shall be implemented only after potential data recipients have demonstrated an acceptable public health need and an understanding of the restrictions on the use of the data.

NCEH/ATSDR programs may revise or delete some of the components of this agreement, as needed and/or applicable. Additional requirements, terms, or conditions may be added in SECTION 4: TERMS OF AGREEMENT at NCEH/ATSDR programs’ discretion

If you have questions, please contact Hao Tian (ejq7@cdc.gov).

Data Use Agreement for NCEH/ATSDR Data Set

This data use agreement (hereinafter referred to as the “Agreement”) is entered into by and between the data provider, National Center for Environmental Health/Agency for Toxic Substance and Disease Registry (hereinafter referred to as “NCEH/ATSDR”) and the data recipient, ________________________________________________ (hereafter referred to as the “Recipient”), collectively, the “Parties”, and shall be effective as of the ________________ (enter the DUA effective date), and shall remain in effect until _________________ (enter the DUA expiration date), or until the Agreement is terminated in accordance with the provisions below.

This Agreement establishes the terms and conditions under which NCEH/ATSDR will provide, and the Recipient will obtain and use the data set specified in Section 1 and/or any derivative data set/file(s) that contain direct identifiers or information that can be combined with other information to identify individual data subjects. This Agreement is non-transferable and supersedes all previous agreements between the parties with respect to the data set specified in Section 1. Further, the terms of this Agreement may only be amended or supplemented by an agreement made in writing and signed by authorized representatives of each party.

The Agreement may be terminated by either party at any time upon _______ days’ written notice from the terminating party to the other party. Sections 1.3, 2.1, 2.3, 2.4, 3.1, 3.2, 3.3, 3.4 and ____________ (enter additional Sections as needed) shall survive the expiration or any termination of this Agreement.   

This Agreement describes the Recipient rights and obligations with respect to the data set and the limited purposes, for which the Recipient may create, receive, maintain, use, disclose and/or have access to the data set. The Recipient agrees to ensure the integrity, security, and confidentiality of the data by complying with the terms of this Agreement and applicable federal and state laws and regulations.

The Parties agree to comply with applicable federal and state laws, regulations and requirements on data sharing and privacy protection, including but not limited to Section 301(d) of the Public Health Service Act (42 USC 241(d)), 45 CFR Part 46, Human Subjects Protection, andthe CDC/ATSDR Policy on Public Health Research and Nonresearch Data Management and Access.

SECTION 1: PROJECT, DATA SET, CUSTODIAN AND RECIPIENTS INFORMATION

1.1 Project Description

(Provide an overview of the scientific activities and organizations/parties involved. Aim to include project goals, why the data are needed, how the data will be used/disclosed, etc.) ____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

The Recipient affirms that the requested data will be used by the Recipient solely in connection with project (hereinafter referred as the “Project”) as described in this Agreement, and the requested data is the minimum necessary to achieve the project goals and purposes stated in this section.

1.2 Data Set

The following data set/file(s) (hereinafter referred as the “Data Set”) is/are covered under this Agreement.

(Describe the Data Set with names of specific data elements and necessary information (e.g. study name, collection period, etc.) to clarify the data elements that will be released to the Recipient.)

__________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

1.3 Data Ownership

NCEH/ATSDR will retain all ownership rights to the Data Set, and the Recipient does not obtain any right, title, or interest in any of the Data Set, except as authorized by this Agreement.

The parties mutually agree that analyses or findings (not including personally identifiable information) created from the Data Set may be retained by the Recipient indefinitely.

The Recipient agrees not to disclose the Data Set to any person or organizations that are not authorized by this Agreement except as required by law.

1.4 NCEH/ATSDR Custodian of Data

NCEH/ATSDR Data Custodian (division/branch/section or team):

NCEH/ATSDR Point of Contact:

Name:
E-mail:
Phone Number:

1.5 The Users Who Will Have Access to Data

Recipient principal person who will be responsible for the observance of all conditions of use and for establishment and maintenance of security arrangements as specified in this Agreement to prevent unauthorized use.

Name:
Job title:
Research role:
Affiliation:
E-mail:
Phone Number:
Street Address:

Recipient point of contact (if different from the person above)

Name:
Job title:
Research role:
Affiliation:
E-mail:
Phone Number:
Street Address:

Additional users in the Recipient who will have access to the data

(Copy this table for additional users as needed, or include them in an attached document.)

Name:
E-mail:

Name:
E-mail:

Name:
E-mail:

The Recipient agrees to notify NCEH/ATSDR within fifteen (15) calendar days of any change in the named principle person, contact and users.

SECTION 2: DATA USE, TRANSFER, ACCESS, RETENTION AND DISPOSITION

2.1 Approved Use of Data

The Data Set covered by this Agreement is to be used exclusively for the following: (List all approved uses of Data Set here)

______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________

______________________________________________________________________________
______________________________________________________________________________

The Recipient agrees to use and disclose the data only in accordance with this Agreement, or as otherwise required by law. Any data use by the Recipient not specifically listed above is prohibited unless this Agreement is subsequently modified in writing. The Recipient may not use the Data Set provided to engage in any method, act, or practice that constitutes a commercial solicitation or advertisement of goods or services.

2.2 Data Transfer

Check all applicable options:

☐ Data Set will be transferred to and managed by the Recipient using secure and CDC approved technology and media.

☐ Approved users from the Recipient will be granted access to the Data Set managed by NCEH/ATSDR programs.

☐ Data Set will be available to the Recipient users ONLY at a controlled site (e.g. CDC Research Data Center)

2.3 Data Access

The access to the Data Set shall be restricted to users of the Recipient authorized by this Agreement. The Recipient agrees to ensure that anyone who accesses these data agree to the same restrictions and conditions that are included in this Agreement.

2.4 Data Retention and Disposition

The Recipient will maintain the Data Set in an appropriate manner for the content and dispose them properly.

The Recipient will, on the termination or within _________ days of the expiration of this Agreement, at its expense return to NCEH/ATSDR or destroy, at NCEH/ATSDR’s election, to the extent feasible and permitted by applicable law, all originals and copies of Data Set received from NCEH/ATSDR under this Agreement.

The Recipient will certify in writing to NCEH/ATSDR that all the Data Set that has been received, maintained, and used by or disclosed to the Recipient has been destroyed or returned to NCEH/ATSDR, and the Recipient shall retain no copies of the data.

SECTION 3: SECURITY AND PRIVACY PROTECTION

3.1 Safeguards of Data

The Data Set covered by this Agreement has been categorized by NCEH/ATSDR as _________ (enter low, moderate, or high as determined by NCEH/ATSDR Inofrmation Systems Security Officer) per Federal Information Processing Standard 199, Standards for Security Categorization of Federal Information and Information Systems.

The Recipient will establish, implement and maintain appropriate administrative, physical, and technical safeguards to protect data confidentiality, integrity, and availability. The safeguards shall provide a level and scope of security that is not less than the level and scope of common information security laws and regulations, such as Federal Information Security Act of 2002 (FISMA), the Health Insurance Portability and Accountability Act of 1994 Privacy and Security Rules, Office of Management and Budget Circular No. A-130, Appendix III – Security of Federal Automated Information Systems, Federal Information Processing Standard 200 entitled “Minimum Security Requirements for Federal Information and Information Systems”, and National Institute of Standards and Technology (NIST) Special Publication 800-53 “Recommended Security Controls for Federal Information Systems”. The Recipient will ensure prevention of any unauthorized use or disclosure of Data Set as long as the Recipient has such Data Set in its actual or constructive possession.

3.2 Privacy Protection

The Recipient will not attempt to identify or contact the data subjects within the Data Set provided unless approved in this Agreement. (Describe any agreed upon exceptions if needed)

__________________________________________________________________________________

__________________________________________________________________________________

The Recipient agrees not to disclose findings, listings, or information derived from the Data Set, with or without direct identifiers, if such findings, listings or information can, by themselves or in combination with other data, be used to deduce any individual data subject’s identity.

The Recipient agrees to data aggregation when there is sufficient data and when appropriate, in a way that such aggregation will not permit the identification of data subjects.

Termination of this Agreement shall not relieve the Recipient of its obligations of maintaining the confidentiality of the Data Set.

3.3 Breach Notice and Reporting

In the event of a data security/privacy breach including but not limited to data theft, loss, unauthorized access/use/disclosure, or compromise of any device storing data, the Recipient shall:

1. cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach.

2. be able to determine what information under this Agreement was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access information, and identify the initial attack vector.

3. report a suspected or confirmed breach in any medium as soon as possible and no later than 1 hour of discovery to CDC Computer Incident Response Team (CSIRT) via email at csirt@cdc.gov or telephone at 866-655-2245.

4. respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) or CDC CSIRT within 24 hours as instructed, whether the response is positive or negative

5. provide NCEH/ATSDR with status updates upon request and a written closing action report once the security event or incident has been resolved.

NCEH/ATSDR acknowledges that CDC will not interpret report of a breach, by itself, as conclusive evidence that the Recipient failed to provide adequate safeguards for the PII.

The Recipient shall bear the cost and liability for any breaches of personally identifiable information from the Data Set while they are entrusted to the Recipient. Furthermore, if NCEH/ATSDR determines that the risk of harm requires notification of affected individual persons of the security breach and/or other remedies, the Recipient agrees to provide the notice and remedies without cost to NCEH/ATSDR.

3.4 Penalty

Recipient hereby acknowledges that failure to comply with the terms of this agreement may result in cancellation of this Agreement and to further access to NCEH/ATSDR data.

The Recipient hereby acknowledges that the unauthorized use or disclosure of confidential information may be punishable under federal and state laws and regulations.

The Recipient further acknowledges that criminal penalties under the federal Privacy Act of 1974 may apply if it is determined that the Recipient or any individual employed or affiliated therewith, knowingly and willfully obtained the data file(s) under false pretenses.

By signing this Agreement, the Recipient agrees to abide by all provisions set out in this Agreement and acknowledges having received notice of potential criminal or administrative penalties for violation of the terms of the Agreement.

SECTION 4: TERMS OF AGREEMENT

NCEH/ATSDR programs may select the terms and conditions below that are applicable to the specific Data Set covered by this Agreement, and revise or delete them as needed. Additional requirements, terms, or conditions may be added at NCEH/ATSDR programs’ discretion.

The Recipient hereby agrees to adhere to the following terms and conditions.

4.1 Human Research Protection

The Recipient agrees to assume responsibility for ensuring compliance with all the requirements for the Human Research Protection Program, as prescribed by 45 CFR Part 46, if the Data Set are to be used for activities covered by those regulations.

4.2 Written Agreement for Data Access

The Recipient agrees to ensure that any person to whom the Recipient provides access to any part of the Data Set, executes a written agreement with the Recipient agreeing to the same restrictions and conditions that apply to the Recipient under this Agreement with respect to the access, use, and confidentiality of any such Data Set.

4.3 Publication and Presentation of Results

Check the conditions applicable to this Data Set and provide details if needed

☐ The Recipient agrees to add following disclaimer when reporting in all oral presentations or written publications/reports concerning the Project.

Disclaimer: ___________________________________________________________________

☐ The Recipient agrees to submit the manuscripts of all oral presentations or written publications concerning the Project to NCEH/ATSDR for review and approval prior to the publication or presentation.

☐ The Recipient agrees to notify NCEH/ATSDR of acceptances and publications using the Data Set.

☐ The Recipient agrees to add following citation as the data source in all oral presentations or written publications/reports concerning the Project.

Citation: _________________________________________________________________

☐ The Recipient agrees to acknowledge NCEH/ATSDR’s contribution of this Data Set unless requested otherwise in all oral or written presentations, reports, and publications of results derived from the Data Set under this Agreement

(Additional terms or conditions may be added here at NCEH/ATSDR programs’ discretion.)

SIGNATORIES

On behalf of both parties, the undersigned individuals hereby attest that he or she is authorized to enter into this Agreement and agrees to all of the terms specified herein.

DATA RECIPIENT SIGNATURE:

Name of Priciple Responsible Data Recipient Title

Signature of Principle Responsible Data Recipient Date

DATA PROVIDER SIGNATURE:

Name of NCEH/ATSDR Approving Official Title

Signature of NCEH/ATSDR Approving Official Date

Appendix I3: SOPs for Data Management

Standard Operating Procedures of PFAS Exposure Assessment (EA) Data Management

• SOP_5.1: PII management at CDC/ATSDR

PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

All documents with PII (i.e., consent forms, permission forms, collection logs, etc.) will be kept in locked cabinets and all electronic data will be stored on password-protected encrypted CDC computers.

At CDC/ATSDR, PII data from the EA will be stored separately from non-PII data. All EA PII data files will be stored on a CDC/ATSDR encrypted MUST share (\\cdc.gov\locker\ATSDR_PFAS_EA\PII) and further encrypted by CDC/ATSDR approved file level encryption software (e.g. Symantec Encryption Desktop).

The ATSDR data manager will oversee all PII evaluation, finalization and de-identification activities. Before data collection begins, the ATSDR data manager will review the EA questionnaire and identify questions with potential PII. At the end of data collection, the ATSDR data manager will lead all re-identification risk assessment and de-identification activities to finalize the EA’s PII and non-PII data sets.

Each EA study participant will be assigned a study ID that will link their PII and non-PII individual records. PII will not be linked with files used for statistical analyses and will not appear in any reports generated from the EA data set. Only the EA principal investigators and ATSDR data manager will have access to the linking information between non-PII records (e.g. study ID, sample identification codes) and PII records for administrative purposes.

Both ATSDR and ERG will minimize PII data access to staff on a need-to-know basis. All PII access requests need to be reviewed and approved by the EA principal investigators. All PII data request, access, approval, and use activities will be recorded in a log file that will include at least the following:

• Requestor’s name and organization

  • Requestor’s needs for PII

  • Request date

  • Approved by

  • Approval date

  • Approved uses and storing location of PII

  • PII access/use expiration date

  • Data use agreement or Memorandum of Understanding, if any

  • Status (e.g. new request, under review, approved, in use, disposed, etc.)

Only authorized staff have access to PII. The ATSDR data manager is responsible for managing access to PII and recording all PII access activities. All approvals of access to PII will be reviewed every six months, and access to PII will be removed immediately when no longer needed.

• SOP_5.3: Data Sharing and Disclosure Review

PFAS EA study has developed a Data Management Plan following CDC/ATSDR Open Data Policy, in which aggregated environmental/biological results at the exposure assessment site level will be made publicly available, and the sharing of individual level data is restricted. All requests for individual level data will be reviewed and evaluated on a case-by-case basis, and a data use agreement is required for all restricted data sharing.

When receiving data requests (including FOIA) for restricted data sets (e.g. individual level of data), the ATSDR data manager and study principal investigator will follow the disclosure review steps below to review and approve the data requests:

1. Establish a disclosure review board with NCEH/ATSDR privacy professional and ad-hoc SMEs to review and evaluate the scientific and public health needs in the data request.

   1. Stop here if the proposed data use in the data request is not approved

2. Collect information about the security and privacy protection controls in data requestor’s institution and determine the acceptable re-identification risk threshold for a particular data request.

3. Conduct risk assessment and de-identify the data accordingly until the re-identification risk is below the selected threshold above.

   1. Stop here if the scientific value of the de-identified data set doesn’t meet the needs in the data request.

4. Use NCEH/ATSDR Data Use Agreement template (attached) to develop a tailored data use agreement (DUA).

   1. DUA shall be signed prior to data transfer.

5. Approve/disapprove the data request based on the acceptance of the DUA terms and conditions by the data requestor.