Child Death Review Case Reporting System Data Use Agreement

Home Browse Search

5. The Receiver is not responsible for any damage caused by viruses originating from any places not attributable to the Receiver. 6. It is strongly suggested that the Holder CDR staff have consistent/comparable security practices in place for data that is downloaded from the servers back to the Holder CDR staff or back to the Holder CDR staff s identified users. G. Access to the CDR Data on the Servers Receiver staff managing the server and CDR -CRS will only access the data submitted by the Holder CDR staff in the event that there are unforeseen problems with the database that need troubleshooting, correction or upgrading. Receiver staff will not amend, addend, alter or erase any information contained in data files without prior written authorization. 2. Identifiers will be removed from data downloads based on the permission levels for each of the Holder CDR staff and Receiver. This removal of data elements is a software program feature of the CDR -CRS. 3. NCRPCD staff will have access only to data submitted by the Holder CDR staff and its authorized data entry persons that have case identifiers removed using the HIPAA standards listed in Appendix B, unless in the event of unforeseen problems with the database that require troubleshooting or during development of CDR -CRS releases or upgrades. 4. The Holder CDR staff will identify the level of access to data of its authorized persons at both the state and local level. Data will be accessible to the Holder CDR staff via the Internet. 5. It is strongly suggested that the Holder has signed confidentiality statements from all of its authorized users (see Appendix C as example statement). 6. The Holder will provide the DOH with the written names and contact information for persons with permission to access data, and the DOH will forward this information to the Receiver in the event that the Receiver is asked by the DOH to create logins. 7. Any breach of security or unintended disclosure known by the Receiver will be reported immediately to the appropriate Receiver supervisors, Privacy Officer, Security Officer, and Research Integrity Officer. The Holder will then be notified of the event and steps will be taken by the Holder CDR staff to mitigate harm and cure the breach of security within thirty days. As stated in Section A, the privacy protocols and policies in place at the Receiver are in compliance with HIPAA and meet or exceed federal standards. 8. Any breach of security or unintended disclosure known by the Holder CDR staff will be reported immediately to the Receiver, and the DOH. If the Holder wants staff access removed, the DOH or the Receiver can remove staff from the database to restrict access to data. Steps will be taken in coordination with the Holder CDR staff to mitigate harm. H. Permitted Data Uses Data housed at the Receiver are not subject to the Freedom of Information Act (FOIA) and, as such, no data submitted by the Holder CDR staff will be released by the Receiver in response to any FOIA request. The Holder CDR staff will address any FOIA request made to the Holder CDR staff. M