Privacy Narrative

Privacy Narrative
The Centers for Disease Control and Prevention (CDC) Study on Disparities in Distress Screening among Lung and Ovarian Cancer Survivors

Title: _______________________________________________________________________________________

Elizabeth Rohan
Point of Contact: _____________________________________________________________________________
The datasets created will contain no means of identifying individual respondents. Security protocols
will be implemented to ensure that all data are recorded and stored in such a manner that individual
research subjects cannot be identified directly or through identifiers. No identifying information will
be recorded in the data file, and there will be no way to detect the identification of any respondent.
Contractors will not share identifiers with CDC or with any other entities. Data will be destroyed
after 12 months.
EHR Data Collection
EHR entries will include a unique ID number, generated by Westat, for each respondent. Only
only the data management contractor (not CDC) will have the secure database to link ID
numbers with individuals. No identifying information will be recorded in the data file and
there will be no way to detect the identification of any respondent.

From the Hospital to Westat - Secure Transfer of EHR Data
Limited EHR and distress screening data will be transmitted from the facilities via Westat's
Secure File Transfer System (SFTP) that provides a secure data transfer service that meets
CDC policies for data transmission via the Internet. If the hospital agrees, Westat will access
EHR data remotely using Westat's remote abstraction security requirements that meet
FISMA, encryption, and FedRAMP requirements. The SFTP provides the secure data network
and transmission mechanism needed to receive and store data files from participating hospitals.
All files sent via the SFTP are securely stored and transferred using Federal Information
Processing Standard (FIPS) 140-2 validated Advanced Encryption Standard (AES) encryption.
Data are encrypted both during transmission and when stored on the Westat server. Login and
password is required to access the SFTP server.
Qualitative Data collection
Key Informant Interviews: Westat will not need to collect the contact information of the key
informant interviewees, since it will have been provided to them during the recruitment phase
via the list from the Commission on Cancer. Data collected will be about distress screening
protocol at the facility.
For Focus Groups: Westat will not need to collect the contact information of focus group participants;
this will be organized by the key informants.
For both key informant interviews and focus groups: The study team will safeguard the names of
respondents, all information or opinions collected in the course of qualitative data collection
(focus groups and interviews), and any information about respondents learned incidentally
during the project. All interview respondents will be required to provide verbal informed
C/I/O Approvals:
consent (Attachment 5g) and will be assured that all collected information will be kept private
Information
Systems
Security
Officer
Associate
Director conducting
for Science the interview
and not
disclosed
in any
identifiable form to anyone but
the researcher
or focus group, except
as otherwise
required by law. Respondent names will be
kept separate
Digitally
signed by
Digitally
signed by
from the qualitativeCynthia
data (i.e.,
transcripts
and
summary
notes
of
recorded
interviews
and
focus
Rachel
Kaufmann
-S
Allen -S
groups).
Date: 2019.01.08
Date: 2019.01.16
13:00:16 -05'00'
17:57:50 -05'00'
A voluntary consent form is located in Attachment 5g.

Cynthia
Allen -S

From Westat to CDC - Secure Transfer

Rachel
Kaufmann -S