Privacy Act Checklist

Privacy Act Checklist

OMB control # 0920-New

Title of Project: Injection Drug Use Surveillance Pilot Project

Does the data collection involve collecting sensitive or personally identifiable information?

Yes, the data collection includes sensitive information such as drug use and sexual behaviors. The data collection does not include direct identifiers such as name, address, date of birth, or social security number.

Describe how personal information will be maintained and who will have access to it.

Data will be collected locally using portable computers that are solely used for data collection activities. Portable computers are protected by using a coded password only known by authorized project staff. The portable computers must be kept with the staff at all times when in the field; the computers are collected and secured by the field supervisor after the last interview each day. When not in use in the field, the portable computers are to be locked in a drawer or office.

Data entered by participants and staff using portable computers will be transmitted to Research Electronic Data Capture (REDCap), a secure web-based application for administering surveys, rather than being stored locally on computers at each site. The award recipient will routinely download and clean the data files. At the conclusion of data collection, the award recipient will process all data collected across the 6-30 participating sites and produce a clean, final data set for use by CDC. This dataset will be sent in encrypted form to CDC via the Secure Data Network (SDN).

How long will sensitive or personal information be maintained? This information is crucial. If sensitive information is maintained for even one day, the Privacy Act will apply and we will have to provide language in the clearance package.

Data will be maintained indefinitely as this is a surveillance pilot project with the potential to continue. The primary purpose of the project is to develop a surveillance system to monitor drug use risk and prevention behaviors and the infectious disease consequences of high-risk drug use in 6-30 select urban and non-urban areas of the United States that have been impacted by the opioid crisis.

This submission has been reviewed for Privacy Act applicability by the NCHHSTP PRA Coordinator, and it has been determined that the Privacy Act does not apply.

Will the collected information be covered by the appropriate CDC Assurance of Confidentiality?

Yes, the collected information will be covered by the Assurance of Confidentiality for HIV/AIDS Surveillance Data. The Assurance provides the highest level of legal confidentiality protections to the individual persons who are the subject of this data collection, and to the individuals and organizations responsible for data collection. The terms of the Assurance of Confidentiality reflect the collective experience of CDC, health departments, and the Council of State and Territorial Epidemiologists with respect to the collection, electronic transmission, and dissemination of HIV/AIDS surveillance data. The Assurance includes established policies and procedures governing all aspects of data collection and de-identification, physical security for paper forms and records, electronic data storage and transmission, and the release of aggregate data in forms that cannot be linked back to individual participants. The protections afforded by the Assurance of Confidentiality last forever and endure even after the respondent’s death.

If identifiable information will be filed and retrieved by the name of the individual:

No. The data collected will be anonymous, in that name or social security number are not collected. Data collected, both locally and at CDC, will be stored and accessed by a survey identification number.

2