# Presentation: 705565

## Confidentiality Programs and Practices at the

**National Center for Health Statistics**

**Alvan O. Zarate, Ph.D.**
**Confidentiality Officer**

## National Center for Health Statistics

- Public Health Service Act – July, 1956
- Origins:
-    - National Office of Vital Statistics          	 (Census)
-    - National Health Survey (Public Health                 	 Service)

## NCHS - Mission

- Surveys and special studies on the Nation’s health
- Study of methods and survey techniques and data dissemination

## NCHS – Data Collections Systems

- Population Based surveys
- 	- Health Interview Survey
-    - Clinical Examination
-    - Family Formation
- Records Based data collection
-    - Vital Statistics
-    - Hospital, Nursing home, M.D.

## 	Data Collected I

- Self perceived health status
- Health condition
- Disability
- Health Insurance
- Use of health care facilities
- Birth weight
- Cause of death

## Data Collected II

- Coroner’s reports
- Cause of fetal death
- Other cause: suicide, hiv
- Drug & alcohol use
- Sexual experiences
- Sexually transmitted disease
- Income

## Data Collected III

- Date of birth, gender
- Occupation
- Race
- Geographic area (county, state)
- Rare events conditions

## Overview

- Organization
- NCHS Confidentiality Statute
- “Training”- Initial Orientation/Continuing
- Security – physical/electronic
- Exit procedures
- Protocol review

## Overview (cont.)

- Data handling – program practices, physical inspections
- Data file tracking
- Preparation of public use files
- Research Data Center

## Staff

- Confidentiality Officer (Hlth Stat. -15)
- Program Analyst - 12
- Program Analyst - 11

## Organization

- NCHS Director
- Associate Director, Office of Planning, Budget & Legislation
- Confidentiality Officer
- Division Directors

## The Law	

- Privacy Act
- Public Health Service Act                           	Section 308(d)
- FOIA                                                            Personal and medical files:                                                Exemption 3 – specifically exempted by statute                                                    Exemption 6 – clearly unwarranted invasions of privacy

## Public Health Service Act

- Section 308(c):   NCHS shall disseminate its statistics on as wide a basis as is practicable
- Section 308(d):  *Identifiable *data    not used for any other: (1) purpose or (2) party than that *consented* to by respondent

## Informed Consent and Confidentiality	

- 	full exposure to the facts the respondent needs to make an intelligent decision concerning the provision of personal information to NCHS.

## Types of Consent

- Two Types:                                                 -passive: providing data = consent                 -active: signing form = consent
- Assurance of confidentiality                        -household/clinic/establishment                  -telephone

## Identifiability	

- information which can be used to establish individual or establishment identity,
- 	- **directly** -  name, address or unique identifying number
- 	-  **indirectly** - matching data about a persons/establishment with other data containing names, addresses, etc.

## Re-identification by Matching

- Removal of direct identifier
**“****De-identification”**
- Identified file 		Name abcdefghijkl
- Identifier deleted		           abcdefghijkl
**“****Re-identification”**
- Public use file               abcdefghijkl
- External file	abcdefgmno

- Name

## Recent Legal Developments		

- 2001: NCHS Confidentiality Statute upheld by U.S. Appeals Court
- 	-Akzo-Nobel v. United States
- E-Government Act of 2002
- 	- Title V  (CIPSEA) Confidentiality Information Protection and Statistical Efficiency Act

## CIPSEA

- Fines and Penalties for unauthorized disclosure of confidential information collected under a pledge of con-confidentiality for statistical purposes
-      - $250,000
-      -  Felony

## Staff Training-Orientation

- Video                                                           -Law and violations                                        -staff obligations                                          -confidentiality                                             -identifiability                                               -data release policy                                        -acceptable practices                                  -non-acceptable practices

## Staff Training-Orientation

- Personal contact
- Non-disclosure affidavit
- Orientation Package
- NCHS Staff Manual on Confidentiality

## Staff Training – Continuing awareness

- Re-signing of pledge
- Posters (Do’s & Don’ts)
- Confidentiality policy reminders
- Confidentiality “quiz”
- Special Presentations

## Security	

- Physical inspection of program areas (“walk-throughs”) – periodic
- Secure Building
- Electronic security
- Employee exit procedures

## Review of Data Collection Protocols I

- Assurance of Confidentiality
-    -  Authority                                                    -  Voluntary                                                     -  Statistical use                                              -  Effect on respondent                                     -  Statement of data sharing, 	linking

## Review of Data Collection Protocols II

- SSN, Medicare no. questions, data linking, consent for provider data
- Plans for data sharing
- Status of research participant – other agencies, contractors, collaborators
- Document consistency
- Re-contact statement

##              Working with the Programs

- Questionnaire design
- Data requests
- FOIA requests
- Confidentiality brochures and web statements on data handling and safeguards
- Interagency confidentiality agreements, mou’s, psc’s, contracts

## Data Tracking I

- Internal
- 	- Program to program
- 	- Limited access
- 	- Duration of use
- 	- Program responsible

## Data Tracking II

- Special case and external use (written agreements with beta testers and   collaborators):
- 	- Minimum necessary
- 	- Clear responsibility/accountability
- 	- Time limitations
- 	- Tracking data base
- 	- Return/destruction

## NCHS Disclosure Review Board

- Review of all micro data files intended for public use
- Organization
- Procedures:  survey description, file documentation, disclosure potential checklist

## Assessment of Disclosure Risk	

- Survey timing, link to other surveys
- Geography
- Items with unusual risk:  direct identifiers, income, race and ethnicity, occupation, health conditions, verbatim text, contextual variables
- Matches with known files
- Existing/added distortion

## NCHS Research Data Center

- On-site, remote access
- NCHS staff supervision.
- Dedicated & specially modified hardware - no floppy drive, no connection to outside networks.
- All merges performed by NCHS staff.
- Restriction on material brought into RDC.
- Restrictions on material taken from RDC

## Thank Youaoz1@cdc.gov