Agreement to Abide by Restrictions

Attachment 10. Agreement to Abide by the Restrictions on HIV Surveillance Data and Surveillance-related Data

December 18^th, 2018

OMB #0920-XXXX

AGREEMENT TO ABIDE BY RESTRICTIONS ON RELEASE OF HIV SURVEILLANCE AND SURVEILLANCE-RELATED DATA COLLECTED AND MAINTAINED BY THE DIVISION OF HIV/AIDS PREVENTION (DHAP)

I, , understand that data collected by the Centers for Disease Control and Prevention (CDC) through the National HIV Surveillance System (NHSS) and related surveillance activities, projects, and case investigations under Sections 304 and 306 of the Public Health Service Act (42 U.S.C. 242b and 242k) are protected at the national level by an Assurance of Confidentiality (Section 308(d) of the Public Health Service Act, 42 U.S.C. 242m(d)), which prohibits disclosure of any information that could be used to directly or indirectly identify any individual on whom a record is maintained by CDC. This prohibition has led to the formulation of the following guidelines for release of HIV case reports and supplemental data collected on such persons to which, in accepting access to data not considered public use, I agree to adhere. These guidelines represent a balance between potential for inadvertent disclosure and the need for CDC/DHAP to be responsive to information requests having legitimate public health application. In particular, variables that identify geographic units or facilities have the potential to indirectly identify individuals.

Therefore, I will not release, either inside or outside CDC, state/territorial-, MSA-, city,- county-, or other geographic area-specific data in any format (e.g., publications, presentations, slides, interviews) without the consent of the appropriate state or local agency, except as consistent with the format described in this document and related HICSB and BCSB standard operating procedures. Specifically, in accordance with the terms of written agreements between CDC, the Council of State and Territorial Epidemiologists (CSTE), and individual state/territorial health departments AND in accordance with the principles of the Assurance of Confidentiality for HIV surveillance and surveillance-related data authorized under Section 308d of the U.S. Public Health Service Act:

_{Levels of data release:}

 National and regional level — I am permitted to release national and regional aggregate data without cell size or denominator restrictions.

 State level (including the District of Columbia and Puerto Rico) — For any state, the District of Columbia, and Puerto Rico, I am permitted to release one-way frequencies and two-way stratifications of variables of interest (including sex, age group, race/ethnicity and transmission category) by location and year (e.g., living HIV cases by year*state * sex*race) with the denominator rule suppressing data for stratum-specific populations with less than 100. No numerator suppression rule will be applied.

o For strata where a population is not available in the U.S. Census (e.g., transmission category) the underlying population that is most similar to the

group will be checked before data are released. For example, for black men who have sex with men, the underlying population of black men will be checked for that geographic area.

o If the totals could inadvertently disclose a case through back-calculation by subtraction, secondary or complementary suppression will be done by either

1) combining two or more categories of data (e.g., aggregation of values within the stratification parameter) or 2) excluding all data in a subcategory (e.g., blocking disaggregation below a pre-selected value for the stratification parameter) across multiple states.

 Dependent areas of American Samoa, Guam, Northern Mariana Islands, the Republic of Palau and the U.S. Virgin Islands. — I am only permitted to release and present data for U.S. dependent areas at the country or territory levels. The release of data below the country or territory level or for additional dependent areas other than the five areas listed above will require permission by the applicable health department(s).

o It is permissible to release totals (cumulative and annual) and one-way frequencies (cumulative only) of sex, age group, race/ethnicity and transmission by location (e.g., country) (e.g., adults and adolescents living with diagnosed HIV infection*country*race/ethnicity; stage 3 (AIDS) classifications*year*country). No suppression rules will be applied at the country level.

 MSAs, counties, cities, and other geographic areas with ≥500,000 population

— For areas with ≥500,000 population, I am permitted to release one-way

frequencies and two-way stratifications of variables of interest (including sex, age group, race/ethnicity and transmission category) by location and year (e.g., living with HIV ever classified as stage 3 (AIDS) by year*MSA * sex*race) with the denominator rule suppressing data for stratum-specific populations with less than

100. No numerator suppression rule will be applied.

o For strata where a population is not available in the U.S. Census (e.g., transmission category) the underlying population that is most similar to the group will be checked before release. For example, for black men who have sex with men, the underlying population of black men will be checked for that geographic area.

o If the totals could inadvertently disclose a case through back-calculation by subtraction, secondary or complimentary suppression will be done by either

1) combining two or more categories of data (e.g., aggregation of values within the stratification parameter) or 2) excluding all data in a subcategory (e.g., blocking disaggregation below a pre-selected value for the stratification parameter) across multiple areas.

 Geographic areas with 50,000 – 499,999 population — I will review the data re- release agreements and most current standard operating procedures for applicable areas and restrictions in collaboration with HICSB or BCSB Branch Chief or the Research and Dissemination Team Leader, HICSB before releasing any data for geographic areas with 50,000 – 499,999 as the approval of release of data for this population differs by state.

o General suppression rules for areas with 50,000 – 499,999:

 A denominator rule of <100 will be applied for all frequencies and

stratifications with stratum-specific population denominators <100 in areas with 50,000 – 499,000 population (i.e., when the stratum-specific population is <100 for a subgroup, count data will not be presented). In addition, data will be suppressed when numerators are <5 (e.g., cells with 0 – 4 will not be presented).

 For strata where a population is not available in the U.S. Census (e.g., transmission category) the underlying population that is most similar to the group will be checked. For example, for black men who have sex with men, the underlying population of black men will be checked for that geographic area.

 Any requests for data beyond this data release agreement will require permission by the applicable health department.

 Counties <50,000 population — I will review the data re-release agreements and most current standard operating procedures for applicable areas and restrictions in collaboration with the HICSB or BCSB Branch Chief or the Research and Dissemination Team Leader, HICSB before releasing any data for counties with

<50,000 population as the approval of release of data for this population differs by state.

^{o General suppression rules for counties <50,000 population:}

 A denominator rule of <100 will be applied for all frequencies and stratifications with stratum-specific population denominators <100 in counties <50,000 (i.e., when the stratum-specific population is <100 for a subgroup, count data will not be presented). In addition, data will be suppressed when numerators are <5 (e.g., cells with 0 – 4 will not be presented).

 For strata where a population is not available in the U.S. Census (e.g., transmission category) the underlying population that is most similar to the group will be checked. For example, for black men who have sex with men, the underlying population of black men will be checked for

that geographic area.

 Any requests for data beyond this data release agreement will require permission by the applicable state health department.

 Data stability requirements for release of all data regardless of level of

analysis — I will include a cautionary note on stability for all levels of analyses when estimated numbers are less than 12 or rates are calculated based on numbers less than 12.

o A notation in either technical notes or footnotes will read “Reported numbers less than 12, as well as estimated numbers (and accompanying rates and trends) based on these numbers, should be interpreted with caution because the numbers have underlying relative standard errors greater than 30% and are considered unreliable.”

Variables permitted for release: — Any requests for variables other than those listed below will require approval by the HICSB Chief or Research and Dissemination Team Leader or BCSB Chief or Behavioral Surveillance or Clinical Outcomes Team Leaders, BCSB as appropriate:

General

 Location (e.g. U.S., region, state, Metropolitan Statistical Area, county, dependent area) based on standard definitions

 Year (year of diagnosis [HIV or stage 3 (AIDS) classifications], death, prevalence, or report)

Demographic/transmission

 Age group (5-year or 10-year age group, at diagnosis, or calculated age at end of year for prevalence or at death for deaths)

_{ Race/ethnicity (based on OMB classification)}

_{ Sex}

_{ Transmission or exposure category (see HIV Surveillance Report)}

_{Data release and publication:}

 I understand that release of data not specifically permitted by this agreement is prohibited unless written permission is first obtained from the appropriate Branch Chief (HICSB or BCSB), Division of HIV/AIDS Prevention

 When presenting or publishing state-, city-, county-, MSA-, or dependent area- specific data in accordance with the restrictions outlined above, I will inform the

appropriate state(s) and local health department(s) in advance of the release of state or local data, so as to afford them the opportunity to anticipate local

queries and prepare their response.

 When presenting or publishing data from surveillance-related studies, investigations, or evaluations, I will adhere to the principles and guidelines outlined in this agreement and related HICSB and BCSB standard operating procedures.

_{Release of geocoded HIV surveillance data:}

 Any re-release of geocoded HIV surveillance data that identifies the geographic area below the state or for territory or country level for dependent areas is subject to written approval of the applicable health department(s) (re-release of data can be in the form of peer and non-peer reviewed manuscripts, technical reports, manuals, and presentations).

_{ All publications using geocoded data must be cleared through DHAP HICSB}

clearance.

 Publication of a manuscript in a journal or as part of conference proceedings requires a CDC clearance of that manuscript, even if an abstract for that manuscript was previously cleared.

_{Data Security:}

1. I will not give my access password to any person.

2. I will treat all data at my desk site confidentially and maintain in a locked file cabinet records that could directly or indirectly identify any individual on whom CDC maintains a record. Sensitive identifying information from special case investigations will only be maintained in a locked file cabinet in a locked room which has restricted access.

3. I will keep all hard copies of data runs containing small cells locked in a file cabinet when not in use, shredding them when they are no longer necessary to my analysis.

4. I will not produce a “back-up” data file of HIV case surveillance data or related

databases maintained by DHAP.

5. I will not remove electronic files, records or databases from the worksite, or access them remotely from home or other unofficial/unapproved off-worksite location.

6. I will not remove hard copies of case reports, survey instruments, laboratory reports, confidential communications, or any records containing sensitive data and information or the like from the worksite.

7. I will not remove from the worksite tabulations or data in any format that could directly or indirectly identify any individual.

8. I will maintain confidentiality of records on individuals in all discussions, communications, e-mails, tabulations, presentations, and publications (and the like) by using only the minimum information necessary to describe the individual case.

9. I will not release data to the press or media without pre-screening of the request by the NCHHSTP, Program Planning & Policy Coordination Office or DHAP Office of Policy, Planning and Communications.

10. I am responsible for obtaining IRB review of projects when appropriate.

_{User ID:}

Purpose of investigation (provide a brief statement):

Data base(s) to be accessed:

Estimated time needed for data access/analysis:

I have read this document, “Agreement to abide by restrictions on release of HIV Surveillance and Surveillance-related data...” and the attached document “Policy for Release of Centers for Disease Control and Prevention (CDC) HIV Surveillance and Surveillance-related Data,” and I agree to abide by them. Failure to comply with this agreement may result in disciplinary action, including possible termination of employment.

Signed: Date: (Requestor)

_{CIO, Division, Branch}

Approved: Date: Chief, (HICSB/BCSB), DHAP, NCHHSTP or designee

Revised February 2013