ERHMS

Purpose

DataManagementandInformationSecurity

Computerdatabasesprovide anexcellentformatwithwhich tomanage emergency responders’information.Inorderto 

maintainprivacy required by lawandtofacilitate efficient communicationbetweenagencies,issues ofinformationsecurity andinteroperabilitymustbe addressedin the pre-deployment phase toensure accuratemanagement ofresponders 

duringdeployment andenable reliable, comprehensivemonitoring andsurveillancepost-deployment.

How to Develop a Pre-deployment Information System Security Plan for Field Settings

1. Form information security structure.

2. Assess security needs.

3.Identify laws, regulations, and statutes applicable 

to agency and information.

4. Outline steps andresponsibilitiesbasedassessment

and regulations.

5.Implement security procedures.

6. Managerisk throughincremental changes.

Components of Information Security

There are 12 components of implementing an information management system in the field:

Risk Management Risk assessment (identify potential threats and their impact) and risk mitigation (prioritize and implement risk controls).

Security Policy Security systems in place; responsibilities for security systems; address 

compliance issues.

Organization of Information Security Structure for the governance of the security program.

Asset Management Inventory and classify information assets, agree upon its ownership, and 

protect against its loss to damage and theft.

Human Resources Security Confidentiality and availability of data through changesin personnel and 

position responsibilities.

Physical and Environmental Security Safeguards that consider the physical structures that house and support 

the information systems.

Communications and Operations ManagementProcesses to maintaining appropriate level of security, purchase and 

maintain physical assets, and resolve any issues that arise.

Access Control Only authorized personnel can access systems.

Information Systems Acquisition, Development, and Maintenance Secure processes for the entire lifecycle of the information system.

Information Security Incident Management Steps to identify, respond to, and manage any information security incident.

Continuity Management System functioning recovery should an incident occur.

Compliance Compliance with security policies and authority to enforce policies.
ERHMS

Personally Identifiable Information (PII)

Any information that can be used to distinguish or trace a specific 

individual and any other information that can be directly linked to 

that individual including name, address, telephone number, social 

security number, and health records.

How to Protect PII

• Minimize the collection, use, and retention of PII.

• De-identify the information.

• Generalize the information (group by common values), 

suppress the information (delete PII), or replace the 

information with averages.

Interoperable IT Systems: Important Action Items

There will often be a need to communicate and share data across 

IT systems:

• Agencies need to establish common policies and procedures.

Forms with fields for name, address, telephone number, and social 

security number, and personal health history contain PII

• IT specialists should communicate the differences in format, hardware, and software pre-deployment and ensure 

mutual levels of security standards.

• Ownership of assetswheremanagementwill overlap should be discussed.

• Documenting these features can allow the IT specialists to prepare their systems for interoperability during and 

post-deployment to facilitate a faster response.

Emergency Responder Health Monitoring and Surveillance

The Emergency ResponderHealth Monitoring and Surveillance (ERHMS)systemis a healthmonitoring and surveillance 

framework thatincludesrecommendations and toolsspecific to protect emergency responders during the pre-deployment, deployment, and post-deployment phases of adisaster.The intent of ERHMS isto identify exposures and/orsigns 

and symptoms early in the course of an emergency response in orderto prevent ormitigate adverse physical and psychological outcomes and ensure workersmaintain their ability to respond effectively and are not harmed in the course ofthis 

response work. Data will also help to identify during the post-deployment phase which responders would benefitfrom 

medicalreferral andpossible enrollmentina long-termhealthsurveillanceprogram.Please referto Chapter4 andsection 

4TformoreinformationonDataManagementandInformationSecurity.

National Institute for Occupational Safety and Health (NIOSH) ERHMS Contact:

erhmsonline@cdc.gov

For more information on ERHMS, please visit: 

www.cdc.gov/niosh/topics/erhms