Loading...
HomeMy WebLinkAboutRes-2017-127BOARD OF COUNTY COMMISSIONERS COUNTY OF KITTITAS STATE OF WASHINGTON RESOLUTION NO.2017-t a.." RESOLUTION TO AUTHORIZE EXECUTION OF AN AMENDMENT TO THE CHILD DEATH REVIEW CASE REPORTING SYSTEM DATA USE AGREEMENT BETWEEN THE KITTITAS COUNTY PUBLIC HEALTH DEPARTMENT AND THE MICHIGAN PUBLIC HEALTH INSTITUTE WHEREAS, Kittitas County, through the Kittitas County Public Health Department (KCPHD), is charged with the preservation, promotion, and improvement of health in the County; and WHEREAS, KCPHD and the Michigan Public Health Institute (MPHI) entered into an Agreement signed on April 4, 2016 to establish the terms and conditions for the collection, storage, and use of data obtained from the case reviews of child deaths submitted by Child Death Review teams in Kittitas County and entrusted to the MPHI as the Child Death Review Case Reporting System; and WHEREAS, the Parties desire to amend the Agreement by amending the introductory paragraphs of Appendix B to explicitly list all 18 HIPPA identifiers. The rest of the agreement remains unchanged. NOW THEREFORE, BE IT RESOLVED that the Board of County Commissioners of Kittitas County, Washington, authorizes the Kittitas County Public Health Department to execute an amendment to an Agreement with the Michigan Public Health Institute that is attached hereto, and incorporated herein by reference. DATED this • 2017, at Ellensburg, Washington. BOARD . F COUNTY COMMISSIONERS KIT AS UNTY, WASHINGTON III . J.ewet hChair DATA USE ADDENDUM TO MASTER AGREEMENT BETWEEN THE MICHIGAN PUBLIC HEALTH INSTITUTE AND THE Kittitas County Public Health This Data Use Addendum ("Addendum") is made and entered into as of this 1st day of May 2017 by and between the Michigan Public Health Institute (known as "Receiver") and the Kittitas County Public Health (known as "Holder") both to be referred to herein as "parties ". WHEREAS, the Receiver and the Holder entered into a Master Agreement dated AprilS, 2016 for establishing the terms and conditions for the collection, storage and use of data obtained from the case reviews of child deaths submitted by the Child Death Review (CDR) team in Kittitas County and entrusted to the Receiver as the Child Death Review Case Reporting System. WHEREAS, the Receiver seeks to amend Appendix B to clarify the HIP AA Required Elements to De-Identify Case Data by specifically listing all elements or categories of elements that HIPAA law considers to be identifiers (45 CFR 164.514) and to clarify the Holder's responsibility to remove identifying information in preparation for de-identified downloads; NOW, THEREFORE, in consideration of the above account the parties agree as follows: Appendix B HIPAA Required Elements to De-Identify Case Data· The CDR-CRS supports two types of data downloads: identified and de-identified. NCFRP staff and researchers who have been approved by the NCFRP will receive only de-identified data. The CDR-CRS variables that will be removed in de-identified downloads are listed below. The CDR-CRS contains many free text fields (most often in the 'specify' or 'describe' text fields). The CDR-CRS also provides users the opportunity to provide more detail surrounding the circumstances of the death in Section N: Narrative text field. When the Narrative, 'specify,' and/or 'describe' text fields are included in a de-identified download, the Narrative, 'describe,' and 'specify' text fields SHOULD NOT contain any HIPAA Identifiers. HIP AA Identifiers include names; all geographical subdivisions smaller than a state; all elements of dates (except ye ar) for dates directly related to an individual; phone numbers; fax numbers; electronic mail addresses; social security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate/license numbers; vehicle identifiers and serial numbers; device identifiers and serial numbers; web universal resource locators; internet protocol address numbers; biometric identifiers; full face photographic images; and any other unique identifying number, characteristic or code. * Source: Code of Federal Regulations Section 164 .514(b)(2)(i). 1 Identifying infonnation can be entered into the CDR-CRS element fields in the list below, including free text fields associated with the listed fields, because all the listed fields and their related text fields will be removed from every de-identified download. However, Users should be instructed by the Holder not to enter any identifying information in other free text fields, including Section N: Narrative text field, because these text fields may be included in de-identified downloads. NCFRP cannot review free text fields in de-identified downloads to assure that they contain no HIPAA Identifiers. HIPAA Required Elements to De-Identify Case Data The CDR-CRS elements listed below will be removed for all persons accessing de-identified case data: introduction; Case Denniliof) Case number County of review Review team number Sequence of review Death certificate number Birth certificate number Medical examiner/Coroner number Date CDR team notified of death SectiDn 11 ; Ch ild hlfanllalion Child first name Child middle name Child last name Child name: unknown Date of birth: month, day, and year Date of birth: unknown Date of death: month and day Date of death: unknown Residential address: unknown Residential address : street Residential address: apartment Residential address : city Residential address : county Residential address : zip Sec t ion D : In Cident Iilfaroldt;oil Date of incident Date of incident: same Date of incident: unknown Time of incident Time of incident: am or pm Time of incident: unknown Incident county Death county Secfion L : Review Meeli/lgPrOCe!J's Date of first CDR meeting 2 Section M: SUIDand SDY Case RegisLry Date of first Advanced Review meeting Date of sum Case Registry data entry complete Section 0 : Form Completed Bv Form completed by -Person's name Form completed by -Title Form completed by -Agency Form completed by -Phone Form completed by -Phone extension Form completed by -Email Form completed by -Date Date of quality assurance completed by State My CDR Outcomes My CDR Outcomes -Person's name My CDR Outcomes -Team of review * Source: Code of Federal Regulation Section 164.514(b)(2)(i). IN WITNESS WHEREOF, the parties hereto execute this agreement as follows: Michl_ By:----.:~="""'~~~~~~------ ;Jafift L. Hem J" t:( I'l l C. c: t<. ,',{ t{ I (: t' I (Yl {; A ehief Financittl Officer F,' t'I (0'1 C( I-8""",) -l.f Me? VI. A or-'" Michigan Public Health Institute Date: 'b J ((., (() f ( Kittitas County Public Health Dam H;O-&t8 By. .7Z\) Dat 3 Appendix B HIPAA Required Elements to De-Identify Case Data * These data elements will be removed for all persons accessing de-identified case data, per the Data Use Agreement. The source of these data elements is the National Center for Review and Prevention of Child Deaths' Case Reporting System: Case Report Tool. Introduction : Case Definition Case number County of review Review team number Sequence of review Death certificate nu~ber Birth certificate number Medical examiner/Coroner number Seclion 11 : Child Jn for mati()It Child first name Child middle name Child last name Child name: unknown Date of birth: month, day, and year Date of birth: unknown Date of death: month and day Date of death: unknown Residential address: unknown Residential address: street Residential address: apartment Residential address: city Residential address: county Residential address: zip Section D .' In cident Information Date of incident Date of incident: same Date of incident: unknown Time of incident Time of incident: am or pm Time of incident: unknown Incident County Death County Sectioll N : Ferm Completed BII The names and contact information will be removed . • • Source: h ttp://www.hhs .g"Qv/ocr/combincdregre)ltpdi~ Section l64.514(b )(2)(i) of the rules. 1 List of 18 HIPAA Identifiers 1. Names; 2. All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people ; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000. 3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; 4. Phone numbers; 5 . Fax numbers; 6. Electronic mail addresses; 7. Social Security numbers; 8. Medical record numbers; 9. Health plan beneficiary numbers; 10. Account numbers; 11. Certificatellicense numbers; 12. Vehicle identifiers and serial numbers, including license plate numbers; 13. Device identifiers and serial numbers; 14 . Web Universal Resource Locators (URLs); 15. Internet Protocol (IP) address numbers; 16. Biometric identifiers, including finger and voice prints; 17. Full face photographic images and any comparable images; and 18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data) There are also additional standards and criteria to protect individual's privacy from re-identification. Any code used to replace the identifiers in datasets cannot be derived from any information related to the individual and the master codes, nor can the method to derive the codes be disclosed . For example, a subject's initials cannot be used to code their data because the initials are derived from their name. Additionally, the researcher must not have actual knowledge that the research subject could be re-identified from the remaining identifiers in the PHI used in the research study. In other words, the information would still be considered identifiable if there was a way to identify the individual even though all of the 18 identifiers were removed. · Kittitas County Review Form Grants & Contract Agreement Today's Date 01/27/2016 Fund/Department 116-Public Health Contract/Grant Information II Agenda Date ILA .' I I '" I1IlYlI 1-,., ;;{)J VI Contract /G rant Agency: Child Death Review Case Re portihg System Data Use Agreem ent Period Begin Date: Date of Execution I I Period End Date: 12/31/2020 Total Grant/Contract Amount: None Grant/Contract Number: Contract/Grant Summary: The data use agreement is entered into by the Michigan Public Health Institute (MPHI) and Kittitas County Public Health Department to establish terms and conditions for the collection, storage and use of data obtained from the case reviews of child deaths submitted by Child Death Review teams in Kittitas County and entrusted to the Michigan Public Health Institute as the Child Death Review Case Reporting System. Recommendation for Board of Health and Board of Health Review on rJt.A -~ Department Head Signature .:~V ; Administrator Kittitas County Prosecutor, Auditor, and Board of Health Review and Comment: APPROVED ~~ F~ , ,.J~ p Date Signature of Board of Health member Date Financial Information I Total Amount $ State Funds $ Federal Funds $ I Percen tage County Funds Matching Funds $ CFDA# Grant/Contract Review Page 1 In-Kind $ EHplain Is Equipment being purchased? Who owns equipment? New Personnel being hired? Contact HR hiring -reporting requirements Future impacts or liability to Kittitas County: Budget Information Budget Amendment Needed? I Yes 0 attach budget form No 0 Why not New Division Created? I Revenue Code I Pass Throu gh Information Agency to Pass Through Amount to Pass Through $ Sub -Contract Approved Date: Prosecutor Review J Has the Prosecutor reviewed this agre ement? j ves D No 0 County Departments Impacted Auditor Facilities Maintenance Information Services Human Resource Prosecutor Treasurer Submitted I Signature : Department: I Date : Assignment of Tracking Information Auditor's Office Human Resource Prosecutor's Office Who Signed the grant application I Reviewer I Date Grant/Contract Review Page 2 CHILD DEATH REVIEW CASE REPORTING SYSTEM DATA USE AGREEMENT BETWEEN THE MICHIGAN PUBLIC HEALTH INSTITUTE AND KITTITAS COUNTY PUBLIC HEALTH DEPARTMENT This data use agreement is entered between the Michigan Public Health Institute (MPHI) (known hereafter as "Receiver") and the Kittitas County Public Health Department (hereinafter referred to as the "Holder") for the period of date of execution through 12/3112020. The purpose of this agreement is to establish the terms and conditions for the collection, storage and use of data obtained from the case reviews of child deaths submitted by the Child Death Review (CDR) team in Kittitas County Public Health Department and entrusted to the Receiver as the Child Death Review Case Reporting System (CDR-CRS). A. The Receiver 1. The Receiver is a non-profit private agency. It has a Cooperative Agreement, Number U49MC00225, with the Maternal and Child Health Bureau, Health Resources and Services Administration, U.S . Department of Health and Human Services, to manage the National Center for the Review and Prevention of Child Deaths (NCRPCD). As part of this agreement, the Receiver is to manage a standardized, web-based reporting system for state and local child death review teams. 2. The Receiver is responsible for the development of the NCRPCD CDR-CRS, training and liaison to state agencies participating in the system, technical assistance in using the system, and analysis and dissemination of national CDR data generated by the system. The Receiver is responsible for the maintenance of the servers, including firewall protection and other securities, and for data storage and data access by users of the CDR- CRS. 3. The Receiver holds a Federal wide Assurance (FWA) that is a written commitment to protect human research subjects by complying with federal regulations and maintaining adequate programs and procedures for the protection of human subjects. This FW A specifies adherence to the Code of Federal Regulations Title 45 Public Welfare Part 46 Protection of Human Subjects, and the use of the Belmont Report as an ethics guideline. The NCRPCD including the CDR-CRS is reviewed annually by the Receiver's Institutional Review Board. Copies of the panel decision letters are available to the Holder. 4. The Receiver complies with the federal privacy requirements specified in the HIP AA Privacy and Security Rules (45 CFR Parts 160, 162 and 164, Standards for Privacy of Individually Identifiable Health Information). The Receiver has appointed a Privacy Officer and a Security Officer, developed and adopted HIP AA-compliant privacy and security policies and procedures, and staff receive training in these policies and procedures. The Receiver's Privacy Officer annually reviews the NCRPCD, including the CDR-CRS, for adherence to HIPAA regulations and MPHI policy. Copies of the review decision letters are available to the Holder. RECEIVED MAY 0 220 \6 B Y: B. The Holder 1. The Holder is the lead for the local CDR team pursuant to RCW 70.05.170(3). 2. The data are entered and owned by the Holder. The Holder's staff conducts child death reviews (child mortality reviews) in Washington State pursuant to RCW 70.05.170, which authorizes the Holder to conduct those reviews. (See Appendix A) C. Washington State Department of Health (DOH) 1. Pursuant to RCW 70.05.170(4), the DOH will: a. Serve as a liaison between the the Holder CDR staff and the Receiver. b. Facilitate access to the CDR-CRS for the Holder's staff. c. Collect data sharing agreements from DOH and the Holder for the Receiver. d. Communicate with the Holder CDR staff on issues related to the CDR-CRS . e. Act as the state administrator ofthe CDR-CRS. f. Provide technical assistance to the Holder CDR staff. g. Respond to data requests. 2. The DOH will have access to the identifiable Washington State data. D. Purpose of and Type of Data 1. The Child Death Review teams in Washington are supplying data to the (NCRPCD) in order to: a. Provide the state and local CDR teams with a comprehensive CDR case reporting system for collecting, analyzing and reporting on their reviews of child deaths. b. Permit comparability of CDR data within and between local CDR teams and states. c. Use data collected to promote policy, programs, services and laws to prevent child deaths at the local, state and national levels. E. Data Entry and Transmittal 1. Data are submitted by the Holder CDR staff to the Receiver only via the Internet, using the CDR-CRS, ©Michigan Public Health Institute. The Receiver will provide paper forms to the DOH upon request; however all data is obtained by the Receiver through the Internet. 2. The Holder CDR staff are complying with its applicable state laws and policies in making the determination of the specific data to be entered into this system and of the persons it authorizes to enter and transmit the data. Relevant Holder CDR staff state CDR statutes or promulgated rules are set out in Appendix A. 3. Only persons selected by the Holder CDR staff, and provided with a password by the DOH or the Receiver will have access to the CDR-CRS for data entry and submission as a data entry user. 4. The Receiver will create and administer data entry user accounts upon request by the Holder CDR staff, or accounts can be created and maintained by DOH, the assigned state administrators of this reporting system upon request of the Holder CDR staff. 2 5. Accounts are locked out when a user attempts but fails to log in successfully 5 times in 10 minutes; such accounts remain locked out until released by NCRPCD staff or assigned state administrators. 6. Accounts are automatically logged out after 60 minutes when there is no transmission to the server, unless the DOH adjusts this time-out expiration period in coordination with NCRPCD. 7. The Receiver and/or the DOH may terminate a user's access to the system at any time. F. Data Storage 1. All data submitted via the Internet using the CDR-CRS are stored on a server located within the MPH I Data Center. 2. Data are stored on this server indefinitely unless the Holder CDR staff terminate the data use agreement. 3. The Receiver ensures the security of these servers in the following ways: a. Data transmitted to and from the web server are authenticated and encrypted with 2048-bit SSL (Secured Sockets Layer), which is the strongest currently available commercially. The certificate authority is GoDaddy and is renewed annually. b. Two stateful firewalls are utilized, as well as intrusion protection and detection products. The database server sits in a protected data network with a firewall between the database and the web server. c. The servers are in a physically secure location with restricted access and a complete automatic temperature alarm system and fire sprinkler protection system. The server rooms have separate air conditioning systems, and electrical supplies are backed up with uninterruptible power supplies, which are backed up by a diesel generator for long term power outages. d. When the MPHI Data Center is closed during non-business hours, the building is locked, an electronic alarm system is activated, and access into the building is permitted only through the use of electronic reader cards. The MPHI Data Center is also equipped with a video surveillance system. e. The Receiver continuously updates virus-scanning software on all servers and workstations. f. A small group of Receiver authorized staff have access to the server room for server management and maintenance. These staff abide by strict confidentiality agreements. These individuals will be identified and their signed confidentiality agreements provided upon request of the Holder. g. Custodial and building maintenance staff are not allowed in the server area except in the presence of authorized Receiver staff. h. The Receiver staff regularly audit database servers to ensure there are no security violations. 4. For disaster recovery, the Receiver's network servers are backed-up nightly online to disk storage and replicated to disk in a second location nightly. Daily backups are kept on disk for 30 days. Data is sent to encrypted tape weekly, and weekly backups are kept off- site for 30 days. Monthly backups are saved on the encrypted backup tapes for 7 years. The tapes are delivered in locked containers via courier and stored off-site in a physically secure location. 3 5. The Receiver is not responsible for any damage caused by viruses originating from any places not attributable to the Receiver. 6. It is strongly suggested that the Holder CDR staff have consistent/comparable security practices in place for data that is downloaded from the servers back to the Holder CDR staff or back to the Holder CDR staff s identified users. G. Access to the CDR Data on the Servers 1. Receiver staff managing the server and CDR-CRS will only access the data submitted by the Holder CDR staff in the event that there are unforeseen problems with the database that need troubleshooting, correction or upgrading. Receiver staff will not amend, addend, alter or erase any information contained in data files without prior written authorization. 2. Identifiers will be removed from data downloads based on the permission levels for each of the Holder CDR staff and Receiver. This removal of data elements is a software program feature of the CDR-CRS. 3. NCRPCD staff will have access only to data submitted by the Holder CDR staff and its authorized data entry persons that have case identifiers removed using the HIP AA standards listed in Appendix B, unless in the event of unforeseen problems with the database that require troubleshooting or during development of CDR-CRS releases or upgrades . 4. The Holder CDR staff will identify the level of access to data of its authorized persons at both the state and local level. Data will be accessible to the Holder CDR staff via the Internet. 5. It is strongly suggested that the Holder has signed confidentiality statements from all of its authorized users (see Appendix C as example statement). 6. The Holder will provide the DOH with the written names and contact information for persons with pennission to access data, and the DOH will forward this infonnation to the Receiver in the event that the Receiver is asked by the DOH to create logins. 7. Any breach of security or unintended disclosure known by the Receiver will be reported immediately to the appropriate Receiver supervisors, Privacy Officer, Security Officer, and Research Integrity Officer. The Holder will then be notified of the event and steps will be taken by the Holder CDR staff to mitigate harm and cure the breach of security within thirty days. As stated in Section A, the privacy protocols and policies in place at the Receiver are in compliance with HIP AA and meet or exceed federal standards. 8. Any breach of security or unintended disclosure known by the Holder CDR staff will be reported immediately to the Receiver, and the DOH. If the Holder wants staff access removed, the DOH or the Receiver can remove staff from the database to restrict access to data. Steps will be taken in coordination with the Holder CDR staff to mitigate harm. H. Permitted Data Uses 1. Data housed at the Receiver are not subject to the Freedom of Information Act (FOIA) and, as such, no data submitted by the Holder CDR staff will be released by the Receiver in response to any FOIA request. The Holder CDR staff will address any FOIA request made to the Holder CDR staff. 4 2. All data accessed by and released to the Holder CDR staff are the responsibility of the Holder CDR staff. Any subsequent breaches of security or confidentiality once the Holder CDR staff obtain the data are the responsibility of the Holder CDR staff. 3. The Holder CDR staff will comply with its applicable state laws and policies in determining the specific data the Receiver is allowed to disclose. 4. The Receiver will not release any data that includes identifiable characteristics as defined by HIPAA (Appendix B) to any persons or organizations, except in circumstances provided in writing by the Holder CDR staff. 5. The Receiver may release de-identified data only in accordance with the MPHI IRBlPrivacy approved data dissemination policy (Appendix E). 6. All reports released by the Receiver, DOH, and the Holder CDR staff shall be developed with adequate provision for the accuracy, reliability and integrity of the data. I. Ownership 1. The Receiver acknowledges that all child death review data submitted by the Holder CDR staff and by the Holder CDR teams' designated data entry persons shall be and remain the sole property of the Holder CDR teams. The Holder CDR staff acknowledge that the CDR-CRS and all of its software platform applications are the copyrighted property of the Receiver. J. Agreement Terms and Termination 1. This agreement applies to all activities occurring between 11112016 and 12/3112020. 2. This agreement may be terminated by the Holder or Receiver under the following circumstances: a. If the Holder wishes to terminate its relationship with the Receiver for any reason. b. If the Holder can no longer participate in the Internet web system due to changes in laws or funding for CDR programs. c. Ifthe Receiver of data no longer receives funding to serve as the NCRPCD. 3. Upon termination ofthis agreement, the Receiver, shall, upon request of the Holder CDR staff, remove all of the Holder CDR staffs child death review case data stored on the server. Child death review data stored on backup tapes cannot be removed in the event of the Holder CDR staffs termination but will never be reported or disseminated by the Receiver. 4. Any subcontractors or other agents hired by the Receiver or Holder CDR staff must agree to the same restrictions and conditions that apply through this agreement. 5. All Receiver staff with access to the data submitted by the Holder CDR staff will sign a confidentiality agreement (Appendix D). 6. The Receiver agrees to maintain an insurance rider to provide additional liability insurance, beyond that normally required for MPHI programs. 5 IN WITNESS WHEREOF, the parties hereto execute this agreement as follows: Michigan Public Health Institute Data Receiver ;/J By: ~~ -::J..J Janice Kidd,C6A MBA Finance and Budget Manager Michigan Public Health Institute Date: ~ / t 1..-1 Ii. r , State of Washington Kittitas County Public Health Department B;:~1i~:t~ Robi n Rca~ Publi c Health Administrator Date :--1-(5 ~ ....... 10~ 6 Appendix A Relevant State CDR Statutes or Promulgated Rules for the Collection, Analysis and Distribution of CDR Data RCW 70.05.170 Child Mortality Review hUp:/hmp.leg.,va.gov/HCW Idcfault.asill '!cite=70.05.170 (1 )(a) The legislature finds that the mortality rate in Washington state among infants and children less than eighteen years of age is unacceptably high, and that such mortality may be preventable. The legislature further finds that, through the performance of child mortality reviews, preventable causes of child mortality can be identified and addressed, thereby reducing the infant and child mortality in Washington state. (b) It is the intent of the legislature to encourage the performance of child death reviews by local health departments by providing necessary legal protections to the families of children whose deaths are studied, local health department officials and employees, and health care professionals participating in child mortality review committee activities. (2) As used in this section, "child mortality review" means a process authorized by a local health department as such department is defined in RCW 70.05.010 for examining factors that contribl,lte to deaths of children less than eighteen years of age. The process may include a systematic review of medical, clinical, and hospital records; home interviews of parents and caretakers of children who have died; analysis of individual case information; and review of this information by a team of professionals in order to identify modifiable medical, SOCioeconomic, public health, behavioral, administrative, educational, and environmental factors associated with each death. (3) Local health departments are authorized to conduct child mortality reviews. In conducting such reviews, the following provisions shall apply: (a) All health care information collected as part of a child mortality review is confidential, subject to the restrictions on disclosure provided for in chapter 70.02 RCW. When documents are collected as part of a child mortality review, the records may be used solely by local health departments for the purposes of the review. (b) No identifying information related to the deceased child, the child's guardians, or anyone interviewed as part of the child mortality review may be disclosed. Any such information shall be redacted from any records produced as part of the review. (c) Any witness statements or documents collected from witnesses, or summaries or analyses of those statements or records prepared exclusively for purposes of a child mortality review, are not subject to public disclosure, discovery, subpoena, or introduction into evidence in any administrative, civil, or criminal proceeding related to the death of a child reviewed. This provision does not restrict or limit the discovery or subpoena from a health care provider of records or documents maintained by such health care provider in the ordinary course of business, whether or not such records or documents may have been supplied to a local health department pursuant to this section. This provision shall not restrict or limit the discovery or subpoena of documents from such witnesses simply because a copy of a document was collected as part of a child mortality review. 7 (d) No local health department official or employee, and no members of technical committees established to perform case reviews of selected child deaths may be examined in any administrative, civil, or criminal proceeding as to the existence or contents of documents assembled, prepared, or maintained for purposes of a child mortality review. (e) This section shall not be construed to prohibit or restrict any person from reporting suspected child abuse or neglect under chapter 26.44 RCW nor to limit access to or use of any records, documents, information, or testimony in any civil or criminal action arising out of any report made pursuant to chapter 26.44 RCW. (4) The department shall assist local health departments to collect the reports of any child mortality reviews conducted by local health departments and assist with entering the reports into a database to the extent that the data is not protected under subsection (3) of this section. Notwithstanding subsection (3) of this section, the department shall respond to any requests for data from the database to the extent permitted for health care information under chapter 70.02 RCW. In addition, the department shall provide technical assistance to local health departments and child death review coordinators conducting child mortality reviews and encourage communication among child death review teams. The department shall conduct these activities using only federal and private funding. (5) This section does not prevent a local health department from publishing statistical compilations and reports related to the child mortality review. Any portions of such compilations and reports that identify individual cases and sources of information must be redacted. [2010 c 128 § 1; 2009 c 134 § 1; 1993 c 41 § 1; 1992 c 179 § 1.] 8 AppendixB HIPAA Required Elements to De-Identify Case Data· These data elements will be removed for all persons accessing de-identified case data, per the Data Use Agreement. The source of these data elements is the National Center for Review and Prevention of Child Deaths' Case Reporting System: Case Report Tool. 1IIII'tJl/III:0 01l : CIJ,t e Oe/jn/fina. Case number County of review Review team number Sequence of review Death certificate number Birth certificate number Medical examiner/Coroner number Child first name Child middle name Child last name Child name: unknown Date of birth : month , day , and year Date of birth : unknown Date of death: month and day Date of death: unknown Residential address: unknown Residential address: street Residential address: apartment Residential address: city Residential address: county Residential address: zip S !§d iU/I (): /lIddIJIJI/nB)l'lllIIfif)fl Date of incident Date of incident: same Date of incident: unknown Time of incident Time of incident: am or pm Time ofincident: unknown Incident County Death County • It lioll N: Fonll COIIIPleted BI! The names and contact information will be removed . • • Source: hl t p :l/ww~ .hhs .g o v/ocr!c lllnbincdr eg text ,ru!.!~ Section 164.5l4(b)(2)(i) of the rules . 9 Appendix C Holder Confidentiality Agreements Sample Confidentiality Statement for State and Local Users of the Child Death Review Case Reporting System By signing this Agreement, I agree to the following when I access any and all components of the Child Death Review Case Reporting System 1. I will comply with all laws, regulations, policies and procedures as set by the State of 2. I will safeguard the confidentiality of all confidential information to which I have access . I will not carelessly handle confidential information. I will not in any way divulge , copy, release , sell, loan, review, alter or destroy any confidential information except as within the scope of my duties. 3. I will only access confidential information for which I have a need to know and I will use that information only as needed to perform my duties. 4 . I will safeguard and will not disclose my user name and password unless authorized by the state administrator of the reporting system. I understand that my user name and password allows me to access confidential information for my team on the Child Death Review Case Reporting System. I understand that the State administrator may revoke my access to the data system if my responsibilities change. * 5. I will promptly report activities by any individual or entity that I suspect may compromise the availability, integrity, security, or privacy of confidential information. 6. I understand that the ownership in any confidential information referred to in this Agreement is defined by State statute. 7. I understand that violating applicable laws and regulations may lead to other legal penalties imposed by the judicial system. Signature: ________ =~ ______ Date: _______ _ Print Name: ------------------- * If your state already has confidentiality statements in place, you might consider replacing this form with your own, but adding statement four from above. 10 Appendix D MPHI Confidentiality Agreement Confidentiality Agreement for Michigan Public Health Institute Staff Assigned to Privacy-Sensitive Projects As described in the Michigan Public Health Institute (MPHI) Employee Handbook, all MPHI employees have the responsibility to maintain the accuracy, availability, completeness, and confidentiality of the business information, trade secrets, and data to which they have access. Due to the nature of its work, MPHI has access to, stores, uses, and discloses data (including Protected Health Information as defined by the HIPAA Privacy Rule). Any or all of the following factors may require that use and disclosure of these data be restricted in various ways: 1. Federal, tribal, state and local laws and regulations. Examples include: the HIPAA and HITECH, which govern the privacy and security of health information and the Common Rule that governs Institutional Review Boards and research with human subjects. 2. MPHI policies, procedures and training, including project-specific protocols. I 3. Contractual agreements between MPHI and project partners and clients. MPHI employees must annually sign this agreement to demonstrate that they are aware of their obligations to protect the confidentiality and security of the data to which they have access. By signing this agreement, I agree to the following: 1. I will comply with all laws, regulations, contractual agreements, MPHI policies and procedures, and project-specific protocols related to my assigned duties. I understand that I may be required to complete additional training related to these obligations. 2. I will safeguard and will not disclose my work related password(s), access code(s), or any other work related authorization(s). I understand that MPHI may at any time revoke my password(s), access code(s), other authorization(s), or access. 3. At all times during my employment, I will safeguard the confidentiality of all information to which I have access. I will not carelessly handle information. I wil1 not in any way divulge, copy, release, sell, loan, review, alter, or destroy any information except as properly authorized within the scope of my assigned duties at MPH!. 4. I will only access information for which I have a need to know and I will use that information only as needed to perform my legitimate duties as an employee of MPH!. 5. I will not misuse information. 6. I will promptly report activities by any individual or entity that I suspect may compromise the availability, integrity, security, or privacy of information held by MPH!. I understand that reports made in good faith about suspect activities will be held in confidence to the extent permitted. 7. I understand that I have no right or ownership interest in any information referred to in this agreement. 11 8. I understand that my failure to comply with this Agreement may result in disciplinary action up to and including termination of my employment. I understand that violating applicable laws and regulations may lead to other legal penalties imposed by the judicial system, such as fines and/or imprisonment. 9. I understand and accept that signing this agreement is a condition of my employment and those obligations under this Agreement will continue after termination of my employment. Employee Signature: ________________ Date: ____ _ Print Employee Name: ______________ _ Supervisor Signature: ___ ~~ __________ Date: ____ _ Print Supervisor Name: ______________ _ 1 I understand that it is my responsibility to read the Privacy and Confidentiality Policy and any associated policies and understand its terms. If I have any questions concerning information contained in the policy, I will bring them to the attention of my supervisor, manager, or Privacy Officer. 12 Appendix E NCRPCD Data Dissemination Policy & Guidelines for Requesting De-identified Dataset DATA DISSEMINATION POLICY Mission The purpose of the Child Death Review (CDR) Case Reporting System of the National Center for the Review and Prevention of Child Deaths (NCRPCD) is to systematically collect, analyze, and report on information surrounding deaths of individual children around the country. The information can then be used at the local, state, and national levels to inform improvement in child health and safety and to prevent deaths . The data collected with the System includes the following: • information about the child, family, supervisor and perpetrator; • the types of action taken during the investigation ; • the scene, incident, and background information on the cause of death, including the risk and protective factors; . . • the services provided or needed as a result of the death; • a description of the teams' recommendations, as well as the policies, practices, and other actions taken to prevent other child deaths; and • factors affecting the quality of the case review. The web-based CDR Case Reporting System (CDR-CRS) was first implemented in May 2004 in 14 pilot states. Version 1 was made available for widespread use in January 2007; Version 2 was released in January 2008; and Version 3 was issued in October 2013. Updated information on the number of participating states, number of entered cases and number of cases migrated into the system from older state reporting systems is available from NCRPCD. The CDR-CRS is supported primarily by the HRSA Maternal and Child Health Bureau 1 and secondarily by the US Centers for Disease Control and Prevention2 • Data submitted by states resides on servers at the Michigan Public Health Institute (MPHI). Data Sources Data collected by the CDR-CRS are the result of multi-disciplinary processes that bring together state and/or community agencies to share information on child death events and to identify the risk factors in these deaths. Data entered into the System may include, but are not limited to, information gathered from the following data sources: birth certificates, death certificates, law enforcement records, medical records, autopsy reports, child protective services reports, and Emergency Medical Services run reports. I Grant No .1 U49 MC 00225 -11-00 from the Maternal and Child Health Bureau (Title V, Social Security Act), Health Resources and Services Administration, Department of Health and Human Services. 2 Number 200-20 12-M-51198 from the US Centers for Disease Control and Prevention . 13 Child Death Review Programs in States Child death review programs vary by state with respect to the types of death reviewed (all deaths, non-natural deaths, all injuries, abuse and neglect, and/or near-deaths, etc.); the maximum age of children whose deaths are reviewed (0-14, 0-17, 0-25, etc.); and the average time between review and death (ranges from 1 to 36 months). Due to these variances, the data are not universally consistent from state to state. Because most states do not review or enter every child fatality into the System, the CDR-CRS should not be directly compared with vital statistics data nor should it be used to compute incidence rates. All of these distinctions among states and limitations must be accounted for and noted in any analysis of the data. More information about child death review programs and selection of cases by states for review can be found at http://www.childdeathreview.org/state.htm. Data Ownership Child death review data entered into the System are owned by the individual state that entered it (per the data use agreement executed between each state and MPHIINCRPCD). Requests for de- identified, individual case report data will be submitted to the NCPRCD Data Dissemination Committee, per guidelines contained in this document. NCRPCD will inform states participating in the CDR-CRS of all approved applications. For any research request that proposes to identify data by state in any published or publicly released analysis or results, states will be provided an opportunity to have their state's data excluded from the study. Removal of Identifiable Data Elements for Dataset No data file that includes HIPAA-defined personally identifiable elements is available to researchers. The complete Case Report tool contains more than 275 questions (approximately 2,200 data elements) about an individual fatality. (The Case Report form can be viewed and downloaded at www.childdealhreview.org .) Although states often enter HIPPA-defmed personally identifiable data elements (child's name, address, date of birth, date of death, date and time of incident, and incident county) into the CDR-CRS, all personally identifiable data elements will be removed from any dataset made available to researchers. The data elements that will be removed from the dataset are listed in Attachment I of the Application for Access to De-identified Dataset (Application for Data). The "Narrative" field contained in Section M of the Case Report form will only be released to researchers under special circumstances. To further protect anonymity of states, NCRPCD will create and provide a unique code for each state for each approved research project so that researchers can evaluate variation and control for potential bias in the dataset without identifying the individual states. NCRPCD will retain the coding key. Permitted Data Uses The NCRPCD may report aggregated, de-identified data identified by state to requested parties without state permission. Requests by researchers for de-identified datasets must be made in accordance with the Guidelines for Requesting De-identified Dataset (Guidelines), below, and NCRPCD will only release de-identified datasets in accordance with the Guidelines. The NCRPCD, in collaboration with other parties, may also conduct its own analysis/reporting on de- 14 identified CDR-CRS data without state permission. The NCRPCD will only report aggregated data with cell counts of six or more cases. Required Fees A fee will be charged to each applicant for preparation of the requested dataset. The amount of the fee will be determined by NCRPCD staff. An estimate of this fee will be provided to the applicant upon a preliminary review of the proposal by staff. Fees will be determined based on a price equal to the number of staffing hours estimated to prepare the dataset using the federally approved MPHI MOB US rates. Fees must be paid in full prior to the release of the dataset to the applicant. NCRPCD reserves the right to waive fees in certain situations. Data Quality In order to standardize the collection and interpretation of data elements, the CDR-CRS contains a comprehensive Data Dictionary that is readily available online when entering cases into the System or as a standalone PDF document that can be used by child death review teams during review meetings. Additionally, NCRPCD is readily available to provide technical assistance about the Case Report tool and is in constant communication with states about data and reporting questions. Since the data are owned by the individual participating states, states are responsible for cleaning data records, and states vary in the degree to which they review data for inconsistencies, incompleteness, or inaccuracies. NCRPCD has found that data quality appears to improve with increased time and training on the System. The Case Report tool contains by design some subjective questions to engage team discussion (e.g., "Was the death preventable?" or "Did an act of omission contribute to the death?"). The subjective nature of some of the questions can, however, make data analysis more problematic. Finally, although teams record in the CDR-CRS which agencies participated in the child death review, the primary data source for each data element is not collected as part of the Case Report tool. If there is a discrepancy in information shared by the different agencies at the review meeting, it is up to the CDR teams to determine the best answer and there is no set primacy rule for data sources. More information about the CDR-CRS and limitations on the use ofthe data can be found in the February 2011 Supplement to Injury Prevention (Covington TM. The US national child death review case reporting system. Injury Prevention 2011; 17 Suppl 1 :i34-i3 7). GUIDELINES FOR REQUESTING DE-IDENTIFIED DATASET Researchers affiliated with eligible Receiving Institutions may apply for access to a de-identified dataset. The Receiving Institution must be an institution of higher education, research organization, non-profit agency or government agency that either employs or contracts with the Investigator. The Institution must be registered with the U.S. Office for Human Research Protections. Any release of data will be subject to a signed Contract for Access to and Use of Data (Contract for Data) between NCRPCD and an authorized representative of the Receiving Institution. The Contract for Data is set out after these Guidelines. An Application for De-identified Dataset (Application for Data) must identify a principal investigator (PI). The PI serves as the primary point of contact for all communications involving the Contract for Data. The PI must sign the Contract for Data, by which the PI assumes 15 responsibility for compliance with all terms of the Contract for Data by employees of the Receiving Institution, including the day-to-day security of the electronic data and all printed output derived from the files. Each additional researcher who will have access to the NCRPCD dataset must be identified on the Application for Data and must sign the Confidentiality Agreement attached (Attachment 3). The applicants may not release or permit others to release the dataset in whole or in part to any persons other than those identified in the Application for Data. Access to the dataset is also subject to the following requirements: 1. The researchers given access to the Center's dataset may not conduct analyses of the data for purposes other than those described in the approved Application for Data. Applicants will not alter the approved use of the data in the research design unless they have notified and obtained written permission for the alteration from NCRPCD. 2 . The PI must obtain IRB approval for the proposed research. Letters of approval must be submitted to NCRPCD prior to release of data for approved analyses. 3. All data shared are and shall at all times remain the sole property of the state and local county teams which performed the child death reviews that are the source of the data. States have the right of first refusal to participate in this research project if the PI plans to publish or publicly release any analysis or results that identifies individual states. It is permissible, however, to list the states included in the dataset, as long as no data are attributed to specific states, and the states have authorized this acknowledgement. States will be asked whether they wish to be specifically acknowledged in any project publication or presentation. 4. The researchers must not attempt nor permit others to attempt to use the dataset to learn the identity of any decedent. If the identity of a decedent should be inadvertently discovered by the PI or any other individual, the PI must make no use of this knowledge, permit others to use the knowledge, or inform anyone else of this knowledge, and must inform NCRPCD of the discovery so it can prevent future discoveries of this nature. 5. No data will be released that identifies data by state jurisdiction without the explicit approval of the state(s). 6. Only aggregated data with cell counts of six or more cases will be released and reported in any analysis. Cells less than six cases will be aggregated with other like cells. 7. All oral and written presentations or other distribution of information resulting from the use of this dataset must be developed with adequate provision for the accuracy, reliability and integrity of the data. 8. All oral and written presentations or other distribution of information resulting from the use of the requested data must be submitted to NCRPCD for review at least two weeks prior to presentation or submission to ajournal or other source of publication. The purpose of this review is to determine whether the research was completed in the manner specified in the Application and whether the analysis is in the spirit of Child Death Review and the NCRPCD mission, and to permit NCRPCD to have advance notice of potential issues pertaining to the analysis and/or results. Any additional or other use of these data will be considered a breach of the Contract for Data, unless agreed upon in writing by both parties beforehand. 16 9. NCRPCD may tenninate its contract with the recipient if the recipient is in violation of any condition of the contract and such violation is not remedied within 30 days after the date of written notice of the violation. Furthennore, failure to comply with the contract tenns will result in the disqualification of the PI, along with any collaborators implicated in the violation, from receiving additional NCRPCD data. 10. All presentations and publications making use of this dataset must be provided to NCRPCD in a timely manner so that it is a repository of the various uses of the data. 11. All presentations or other distribution resulting from use of the requested dataset must include an acknowledgement of the participating states and NCRPCD. They must include the following language: "This dataset was provided by the NCRPCD, which is funded in part by Grant Number U49MC00225 from the U.S. Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) and in part by the US Centers for Disease Control and Prevention Division of Reproductive Health. The contents are solely the responsibility of the authors and do not necessarily represent the official views ofNCRPCD, HHS or the participating states. The following states contributed data from their child death review: (list states)." 12. Within three years of completion of the project, all hard copies of the dataset generated by the researchers must be destroyed with a cross-cut shredder or returned to NCRPCD, and all electronic data must be destroyed/deleted within the same time frame. Written confinnation that the dataset has been destroyed is required. 13. All installations of the data must have electronic security measures in place to prevent unauthorized access, by electronic or physical means, to the confidential data provided or to output from that data. Data Quality Only cases that have been identified and agreed by the states as being approved for release will be included in the de-identified dataset. The NCRPCD will survey states on an annual basis to make this determination. Application Process To request a de-identified dataset from the NCRPCD, the PI must complete the Application for Data, including a detailed proposal to NCRPCD describing the purpose ofthe data request, methods for study, and mechanisms that will be used to keep the data secure (see Application fonn). Upon receipt, the Data Dissemination Committee (consisting of representatives of participating states, scientists, members of the NCRPCD National Center Steering Committee, and other relevant individuals) will evaluate the application on the basis of the following criteria: • Quality of the research question(s) and objectives for use of the dataset; • Whether the requested data elements are clearly described and whether access to those elements is necessary for the research questions; • Applicant's understanding of the strengths and limitations of the database and analysis plan that is appropriate for this type of dataset; • Qualifications of researchers who will have access to the dataset; • Sufficiency of safeguards in place to maintain the data security, confidentiality, and prevent unauthorized access to data and evidence that the institution is registered with the U.S. Office for Human Research Protections; 17 • Extent to which the proposal is in accordance with the mission of CDR, which is to better understand how and why children die and use the findings to take action that can prevent other deaths and improve the health and safety of children; • Whether NCRPCD is conducting similar research or has plans to do so; and • Whether anticipated presentations , publications , or other dissemination of results from the research is consistent with the NCRPCD mission. At a minimum, the Committee will review applications on a quarterly basis. All applicants will be notified in writing by NCRPCD of the Committee's decision. Proposals will be scored using the above criteria and given one of three grades : 1. Rejected for not meeting the criteria 2 . Preliminary approval but requesting revision 3 . Approved After approval by the Committee, NCRPCD will infonn the states participating in the CDR-CRS of the Committee's decision. For any research request that proposes to identify data by state in any published or publicly released analysis or results, states will be notified and given the opportunity to have their state's data excluded from the study (Attachment 2). States will also be asked whether they wish to be specifically acknowledged in any project publication or presentation. Requests for more information about the data file and the process for obtaining permission to access the dataset should be directed to: Linda Potter JD Policy Director National Center for the Review and Prevention of Child Deaths 2455 Woodlake Circle Okemos, MI 48864 Phone: (800) 656-2434 Fax: (517) 324-7365 Email: in fo @ chi ld death revi e w.org 18 NATIONAL CENTER FOR THE REVIEW AND PREVENTION OF CHILD DEATHS CASE REPORTING SYSTEM Application for De-identified Dataset Please complete information electronically. 1. Data A. For what year or years of the NCRPCD Case Reporting System are data requested? 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 Note: States have different timeframes for when cases are reviewed and entered into the CDR Case Reporting System. Only cases that have been identified and approved by the states as being complete and clean will be included in the de-identified dataset. NCRPCD will survey states on an annual basis to make this determination. Cases migrated from previous child death review reporting systems into the CDR Case Reporting System will not be included in a standard dataset, but may be provided upon further consultation between the researcher and NCRPCD. IL Investigator/researchers A. Identify the Principal Investigator who will carry out the duties described in the Guidelines and provide hislher curriculum vitae as an attachment: Name: Title: Institution: Department: Street address: City: State: Zip: Phone: Email address: 19 B. Identify each additional researcher/collaborator/co-investigator that will have access to the dataset and provide the curriculum vitae for each: Name: Title: Institution: Department: Street address: City: State: Zip: Phone: Email address: c. Describe the specific responsibilities the PI and other investigator(s) will have in conducting and completing the proposed research: PI role: -------------------------------------------------------- Investigator 2: __________________________________________ _ Investigator 3 : ___________________________________________ _ [Add additional description for additional investigators.] IlL Description of proposed research project In no more than five pages (excluding the list of variables), provide a detailed study protocol that includes the following: A. Title of project. B. Describe the research question(s) and objectives for the study. c. Describe the significance and rationale for the research. D. Describe the funding source(s) for the research. E. Describe the study design and methods. The response should be a coherent narrative that links the sample, the variables requested, and the analysis plan to the research questions. The response is expected to be at least one page long, and it must include the following: 20 1. Description of the sample set requested using the Case Report form as a guide (for example, "infants only," or "children ages 0-4 with motor vehicle as cause of death"). 2. List of variables needed to carry out the study using the Case Report form (attached to Application Packet) as the guide. 3. Analysis plan and software that will be used . 4. Discussion of how limitations of the data and data quality issues will be addressed and will likely impact the study and your conclusions. The NCRPCD database is a unique set of information, and researchers are urged to read the attached article from Injury Prevention, in particular the sections that describe in detail the "Limitations" and "Strengths" of the data. 5. Discussion of how the study will handle small data numbers and missing and incomplete data. F. Estimated timeframe for study start and completion. G. Anticipated presentations, publications, or other dissemination of results. Please be as specific as possible. (Reminder: Per the Guidelines for Use of Data, all oral and written presentations or other distribution of information resulting from the use of the requested data must be submitted to NCRPCD for review at least two weeks prior to presentation or submission to a journal or other source of publication to determine whether the research was completed in the manner specified in the Application, whether the analysis is in the spirit of Child Death Review and the NCRPCD mission, and to permit NCRPCD to have advance notice of potential issues pertaining to the analysis and/or results .) 21 IV. Data Security All users of the NCRPCD dataset must have electronic security measures in place to prevent access to the confidential dataset from unauthorized individuals. A. Where will the data reside and how will data be shared among researchers? Describe the physical transmission. B. Security details: In the table below, provide a comprehensive list of all devices on which the dataset will be installed and indicate the electronic security measures that will be applied to each device . For those devices that have access to the Internet, all four of the electronic security measures must be in place for this data request to be approved. For non-Internet devices , firewall protection is not required. ID 1 2 3 4 If co-investigators at different institutions from the PI will also have physical control of the data, complete a table for each such co-investigator's institution. Device type Internet Indicate Does the workstation, device have Electronic security measures laptop , server, access to the portable media, or Intemet?(Y IN) other device Password Restricted Virus Firewall login directory protection protection The device access Anti-virus Firewall requires a The software is technology login ID and directories installed on is in place password at containing the device. for devices startup and the data are (YIN) that are after a period restricted to connected to of inactivity. authorized the Internet. (YIN) users who (YIN) have logged in to the device. (YIN) 22 C. Physical security: In addition to electronic security, the devices on which the dataset have been copied must be physically secured to prevent theft of the device. Describe below the physical security measure in place for each device. ID If co-investigators at different institutions from the PI will also have physical control of the data, complete the table for each such co-investigator's institution and describe how data will be securely transferred between institutions. Location of Device Description of physical security Indicate building name and office Examples are offices are locked when unoccupied; storage in secure number cabinets when the device is not in use; and monitored access to the building where the data are stored. --. 1 2 3 4 V. Receiving Institution A. Identify the Receiving Institution, as that term is described in the Guidelines. B. Provide the IRB assurance number. C. Describe your Institution in detail. What kind of work does it do? Include the type of organization, its profit/non-profit status, and primary sources of revenue. D. Provide evidence in an attachment that your institution is registered with the U.S. Office for Human Research Protections. E. Describe your plans to obtain IRB approval for this study using the NCRPCD data. F. Describe your Institution's experience in overseeing the use of sensitive research data by its staff. Please give specific examples. G. Describe any known breaches of sensitive research data by your organization and the steps taken to remedy the breach. 23 Application signatures: Signature of Principal Investigator Date Signature of Representative of Receiving Institution Date Title 24 TEMPLATE MICHIGAN PUBLIC HEALTH INSTITUTE National Center for the Review and Prevention of Child Deaths Contract for Access to and Use of Data This contract specifies the conditions for release of National Center for the Review and Prevention of Child Deaths (NCRPCD) CDR Case Reporting System data, research, and reports for legitimate public health or related research. The intent of this contract is to foster such research and to prevent misrepresentation of the data. This Contract for Access to and Use of Data (Contract for Data) is between [,-_-, (Investigators), and Michigan Public Health InstitutelNational Center for the Review and Prevention of Child Deaths (NCRPCD). This Contract for Data is for the study entitled [ ], as described in the Application for De- identified Dataset, dated [ ], which is attached hereto and made part of this contract as Appendix A. The Investigators are responsible for ensuring that all work under this study including the work of additional researchers, collaborators, and co-investigators complies with all applicable federal, state, local and international laws and regulations; and that the work is performed in a professional manner to the highest academic standards. Investigators agree to the following requirements for the use ofthe dataset and assure compliance with the requirements. 1. This agreement applies to all activities occurring between the date of signing and 18 months after that date. 2. No one will be permitted to use this dataset to conduct analyses other than those described in the Application for Access to and Use of Data that accompanies this statement. 3. IRB approval of the Receiving Institution will be obtained, and documentation of that approval will be provided to NCRPCD prior to release of any dataset. 4. Investigators understand that all data shared are and shall at all times remain the sole property of the state and local teams which performed the child death reviews that are the source of the data. 5. NCRPCD will seek permission from the participating states for release of the data for the project described in the Application for Data if said states are to be named in the analysis or results. States have the right of first refusal to participate in this research project if applicant intends to identify state jurisdiction in any published or publicly released analysis or results. 25 6. Neither the dataset nor any part of it will be released to any persons other than those identified in the approved Application for Data. 7. Investigators and all other researchers with access to the dataset will not attempt nor pennit others to attempt to use the dataset to learn the identity of any decedent. If the identity of a decedent should be inadvertently discovered, Investigators will make no use of this knowledge, nor will they permit others to use the knowledge. Investigators will inform NCRPCD of the discovery so it can prevent future discoveries. Investigators will not inform anyone else of the discovery of identity. 8. Investigators understand that not all deaths of children in the states have been reviewed by child death review teams and that not every child death review team in the country participates in the CDR Case Reporting System. 9. Investigators understand that data will only be reported at an aggregated level and no data will be released that identifies data by state jurisdiction without explicit state permission. Aggregated data must have cell counts of six or more cases in order to be reported. 10. Investigators will not alter the approved research design without written permission from NCRPCD . 11. All oral and written presentations or other distribution of information resulting from the use of this dataset shall be developed with adequate provision for the accuracy, reliability and integrity of the data. 12. All oral and written presentations or other distribution of information resulting from the use of the requested dataset will be submitted to the NCRPCD for review at least two weeks prior to presentation or submission to a journal or other source of pUblication. 13. All oral and written presentations or other distribution of information resulting from use of the requested dataset will include an acknowledgement of the participating states and NCRPCD. 14. All presentations and publications will include the following language: "This dataset was provided by the NCRPCD, which is funded in part by Grant Number U49MC00225 from the u.S. Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) and in part by the US Centers for Disease Control and Prevention Division of Reproductive Health. The contents are solely the responsibility of the authors and do not necessarily represent the official views ofNCRPCD, HHS or the participating states. The following states contributed data from their child death review (list states)." 15. All presentations and publications making use of this dataset shall be provided to NCRPCD in a timely manner so that it is a repository of the various uses of the data. 26 16. Investigators understand that once a proposal for use of the dataset is approved, NCRPCD may acknowledge publicly the investigators ' names, institution, and name of the study as partners working with the CDR Case Reporting System data. 17. The sharing of this dataset for the purposes stated in the approved project does not imply, in whole or in part, that the topic of the approved project has not been investigated before, or will not be investigated now or in the future, by other investigators interested in this topic. 18. Any additional or other use of this dataset except as described in Investigators' Application for Data will be considered a breach of this contract, unless agreed upon in writing by both parties beforehand. 19. Investigators will assure compliance with the security measures described in the Application for Data. 20. When the proposed analyses are completed, all copies of the dataset will be destroyed with a cross-cut shredder or returned to the NCRPCD upon completion of project plus three years. All electronic versions of the dataset will be deleted. Written confirmation that the dataset has been destroyed or deleted is required. 21. By signing this document, Investigators agree to be responsible for compliance with the conditions of this agreement and agree to these conditions by their signatures below. 22. Cost-reimbursement for the time and expenses spent by MPHI staff to compile the data file requested by Investigators will be invoiced to Investigators after the work is complete. The invoice must be paid in full to Michigan Public Health Institute prior to release of the data file. 23 . NCRPCD may terminate the Contract for Data if the Investigator is in violation of any condition of the agreement and such violation is not remedied within 30 days after the date of written notice of the violation. Principal Investigator: Name: ___________ Title : ______________________ _ Organization: __________________________ _ Admess: ___________________________________ _ Email address: Phone : --------------------------- Signature: ___________ _ Date: 27 For Receiving Ins ti tution: Name: ~\;ll ~V1 ¥Lw4 Title : ------------------------ :::ti°5~:~~UllW1 ~lfi7. 6~~W~ m\AAt2-0 Email address: __________ Phone :e2l)Q lP!l -,S I Vi Signature: ~-»\~ Date : ·.tt l611W- For MPm: Name: ____________________ __ Title: ------------------------ Organization: _~M=ic=hi~' g::.:an=-"'P..::ub=l=ic:....;::H....,ea=lth~1 n=sl=il=ut:..::;e ___ _ Address : 2455 Woodlake Circle. Okemos MI 48864 E mail address : _____________________ .Phone: L-J ____ __ Signature : __________________ _ Date: ------------- 28 Attachment 1 HIP AA Required Elements to De-identify Case Data * These data elements will be removed for all persons accessing de-identified case data, per the Data Use Agreement. The source ofthese data elements is the National Center for Child Death Review Case Reporting System: Case Report Tool. II/trod/wllon: '(I .I't'Definirioll Case number County of review Review team number Sequence of review Death certificate number Birth certificate number ME/Coroner number Scc;lirJtlli; Chlltllll(br/ll(l lirm Child first name Child middle name Child last name Child name : unknown Date of birth: month, day, year Date of birth: unknown Date of death : month and day Date of death: unknown Residential address: unknown Residential address : street Residential address : apartment Residential address : city Residential address : county Residential address : zip .~'(!cli(J1/ 0 : Im:idem IlIlimIJatilm Date of incident Date of incident: same Date of incident: unknown Time of incident Time of incident: am or pm Time of incident: unknown Incident County Death County SI/{J/ iOIl N:' ':(>rI1I ()IIlP/el l.Jd B y The names and contact information will be removed . • • Source: MP.;J/www .hlrs.gov /ocricombiniUlreg IQ;i l.ml.f. Section 164.514(b )(2)(i) ofthe rules. 29 Attachment 2 A Request for the Release of CDR Case Report Data when Research Applicant Intends to Identify State(s) in Proposed Published Analysis or Results The following template will be used by NCRPCD to request written authorization from states participating with the CDR Case Reporting System for permission to release individual case report data to research applicants that intend to identify state jurisdiction in published analysis or results. State permission will be sought once the Data Dissemination Committee has approved the project. Dear State of (insert state) Data Holder: This letter is to infonn you that the National Center for Review and Prevention of Child Deaths (NCRPCD) has received a request to release de-identified individual case report data. The request was submitted by (insert name of requestor and organization) on (insert date). The requester will be using the data for the purpose of (insert purpose). If the requester intends to use the data for a purpose other than what is stated here, they must submit a new request. Per the National Center for the Review and Prevention of Child Deaths' Guidelines for Requesting De-identified Dataset, written permission is necessary from each state where the research applicant intends to identify state jurisdictions in published or publicly released analysis or results of CDR data. As a reminder, de-identified individual case report data released by the NCRPCD will not include the list of data elements found in Appendix B of the NCRPCD Data Dissemination Policy and Guidelines. Please verify that your state is not precluded from releasing this data by any rules or statutes before signing this agreement. If you approve this data request, please sign both copies of the attached contract. Mail both copies to the National Center for Review and Prevention of Child Deaths for signature. 30 Attachment 3 Confidentiality Agreement to be Signed by All Researchers with Access to NCRPCD Data By signing this Agreement, I agree to the following: 1. I will safeguard the confidentiality of all confidential information contained in the National CDR dataset to which I have been given access . I will not carelessly handle confidential information. I will not in any way divulge copy, release, sell, loan, review, or alter any confidential information except as within the scope of my duties. 2 . I will only access confidential infonnation for which I have a need to know and I will use that infonnation only as needed to perform my duties. 3. I will not attempt nor permit others to attempt to use the dataset to learn the identity of any decedent. If I inadvertently discover the identity of a decedent, I will make no use of this knowledge, will not permit others to use the knowledge, will not inform anyone else of this knowledge, and will inform NCRPCD of the discovery so it can prevent future discoveries. 4. I will transmit and store all electronic and hard copy data in a secure and confidential manner and location at all times. 5 . Upon completion of the perfonnance of my duties, the identifiable dataset will be destroyed and no opportunities will be available to access that data on the network or computer systems . 6. I will promptly report activities by any individual or entity that I suspect may compromise the availability, integrity, security, or privacy of confidential infonnation. 7. I understand that the ownership of any confidential infonnation referred to in this Agreement is defined by State statutes. 8. I understand that violating applicable laws and regulations may lead to other legal penalties imposed by the judicial system. Signature: ________________ Date: _______ _ Print Name: ----------------- 31 Kittitas County Review Form Grants & Contract Agreement :1t~eq ~ Today's Date Agenda Date ,--, "{ } 3 I I IT 07/14/2017 Fund/Department 116-Public Health Contract/Grant Information Contract /Grant Agency: Child Death Review Case Reporting Data Use Agreement Addendum Period Begin Date: May 1, 2017 I I Per i od End Date: December 31,2020 Total Grant/Contract Amount: None Grant/Contract Number: Contract/Grant Summary: The Child Death Review Case Reporting System Data Use Agreement between the Michigan Public Health Institute and the Kittitas County Public Health Department establishes the terms and conditions for the collection, storage, and use of data obtained from the case reviews of child deaths. The Addendum amends the introductory paragraphs of Appendix B to explicitly list all 18 HIPPA identifiers. Recommendation for Board of Health and Board of Health Review on Department Head Signatur ~<N . Administrator Date : c:,\ 8, \ \1 Kittitas County Prosecutor, Auditor, and Board of Health Review and Comment: APPROVE D AS TO FORM : ~,a~ 1 -1 '1 -/1- Date ~/to /(/ Date Signature of Board of Health member Date Financial Information Total Amount $ State Funds $ Federal Funds $ Percentage County Funds Matching Funds $ CFDA# Grant/Contract Review Page 1 In-Kind $ Explain Is Equipment being purchased? Who owns equipment? New Personnel being hired? Contact HR hiring -reporting requirements Future impacts or liability to Kittitas County: Budget Information Budget Amendment Needed? YesD attach budget form No D Why not New Division Created? Revenue Code Pass Th rou gh Information Agency to Pass Through Amount to Pass Through $ Sub-Contract Approved Date: Prosecutor Review I Has the Prosecutor reviewed this agreement? I Yes 0 No D County De partments Impacted Auditor Facilities Maintenance Information Services Human Resource Prosecutor Treasurer Submitted I Signature : Department: I Date : Assignment of Tracking Information Auditor's Office Human Resource Prosecutor's Office Who Signed the grant application I Reviewer I Date Grant/Contract Review Page 2