OPCMR



Data Sharing and Use Agreement

Between the Immunization Information Systems Support Branch

National Center for Immunization and Respiratory Diseases

Centers for Disease Control and Prevention

and



Virgin Islands Department of Health, Immunization Division



Purpose: This Data Sharing and Use Agreement (“Agreement”) between the Centers for Disease Control

and Prevention (CDC), National Center for Immunization and Respiratory Diseases (NCIRD),

Immunization Services Division (“ISD”), having its primary offices at 1600 Clifton Road, Atlanta, GA 30333

and the Virgin Islands Department of Health (“Jurisdiction”), through its Immunization Division having its

primary offices at 1303 Hospital Ground, Suite #10, St. Thomas, VI 00802, is to establish the basic terms and

conditions concerning the access, sharing, protection, and use of data submitted by the Jurisdiction and received

by [SD.



Background: Accurate vaccination data is critical for measuring vaccine uptake, monitoring trends during

shortages, assessing compliance with recommendations, and informing decision makers. Multiple data sources are

available for monitoring national vaccine administration, but IIS have shown to be a timely, accurate and complete

source for these purposes. The Centers for Disease Control and Prevention (CDC) has previously used

Immunization Information System (IIS) data to monitor vaccination coverage and evaluate vaccine usage within

Jurisdictions and is seeking to support innovation leading toward broader usage of [[S data for monitoring national

vaccination practices and for other public health purposes.



For example, IIS data can complement and improve national surveys and fill critical knowledge gaps. In addition,

in order to support national vaccination monitoring, I[S data can be used to support the development and

implementation of new approaches for assessing vaccination coverage.



To support these uses and critical public health purposes, CDC has developed an architecture to facilitate the

secure transmission of IIS data from Jurisdiction to CDC. In addition, CDC has set forth herein a description of

the requested vaccine administration data from Jurisdiction and the processes for submission to help ensure a

comprehensive, timely and accurate understanding of vaccine administration, uptake, and coverage.



DUA / MOU: GO30DOHT23



DU1 for Sharing Routine tmanmization Data with CDC

OPCMR



CDC intends to use these data for purposes to include:

e Monitoring vaccination coverage; and

e Aiding in development of methods for estimating national vaccination coverage; and



e Conducting program evaluations; and



e Aiding in development of methods for assessing the quality (e.g., completeness, timeliness, accuracy) of

IIS data; and



e Informing technical assistance provided to Jurisdictions.



Other U.S. Department of Health and Human Services (HHS) Operating Divisions will use these data for

purposes to include:



e Evaluating vaccine effectiveness; and

e Conducting safety monitoring; and



e Supporting communication to patient populations to encourage vaccination.



To support the development and enhancement of Jurisdiction IIS, CDC funds Jurisdictions through various

assistance mechanisms, such as Notice of Funding Opportunity (NOFO) CDC-RFA-IP19-1901. In part, those

funds are intended to enable jurisdictions to advance the use of IIS systems and data for monitoring vaccination

coverage and vaccine use. In addition, these assistance mechanisms may require, by their terms, Jurisdictions to

1) meet the requirements of CDC’s Immunization Program Operations Manual (IPOM); 2) implement privacy-

preserving record linkage (PPRL) by June 2023; and 3) sign this Agreement for data sharing and use. Where the

assistance mechanism requires the signing of this Agreement and the collection of data elements collected under

that mechanism, sharing of those data is governed by the terms of that assistance mechanism, including 45 CFR

75.322 and this Agreement. The terms of this Agreement are intended to be read to not conflict with the terms of

the underlying assistance mechanism.



This Agreement is intended to apply to activities set out in the following assistance mechanism: CDC-RFA-

IP19-1901.



Definitions: For purposes of this Agreement, the following definitions shall apply:



“Jurisdiction” means the local or state health jurisdiction operating under either statutory or regulatory



authority to obtain and use health-related data for population health protection, including vaccine

administration and other vaccine related data.



DUA / MoU: G030DOHT23



DUA for Sharing Routine tmmunization Data with CDC

OPCMR



“Immunization [Information System” or “IIS” means any confidential, population-based, computerized

database that records vaccine doses administered by participating healthcare providers to persons residing

within a given geopolitical area. This term may be used interchangeably with Jurisdiction.



“Data” means the information that is being shared by the Jurisdiction with each relevant platform as further

described in Appendices C, D, F, and G. CDC acknowledges that the data to which it will have access is the

minimum amount of information necessary to accomplish its public health needs. A list of the requested elements

for each dataset is provided in Appendices C, D, and F.



‘‘Redacted’”* means the exclusion of direct identifiers of an individual, but with inclusion of specific elements

related to vaccine administration management. Exact data elements, including instructions and value definitions,

are outlined in the Data Dictionary (Appendices C and D).



“Privacy Preserving Record Linkage” or “PPRL” means the process whereby personally identifiable

information (PII) is redacted from a patient/customer record using a one-way, irreversible encryption algorithm

to create one or more unique tokens that replace PII elements and allow data systems to match patient/customer

records.



“Party” means State or Local Jurisdiction or CDC; “Parties” means State or Local Jurisdiction and CDC.

Agreement Principles:



1) Quarterly Routine Vaccine Administration Data: Jurisdiction agrees to submit redacted record-level data

for all ages (see Appendices C and D) to CDC quarterly. Submitted data should align with the calendar

year; an example schedule is provided further herein. Each Jurisdiction should submit redacted record-

level data at the end of the month for the period ending the prior quarter. For example, the quarterly data

submission due January 30, 2023 should include all records in the IIS through December 31, 2022.

Quarterly data submissions shall continue with the support of immunization funding for I[S provided under

the CDC-RFA-IP19-1901 NOFO, with the final submission occurring for record-level data through June

30, 2024 on July 31, 2024. CDC will use submitted data to calculate vaccination coverage estimates for

all those routinely administered vaccines listed in Appendices C and D.



2) Monthly Aggregate Seasonal Influenza Vaccine Data: Jurisdiction agrees to submit aggregate seasonal

influenza data for all ages monthly on the 9" of each month, beginning on August 9, 2022, or as soon as

this Agreement is in place. Each data submission should contain data from July | of the influenza season

(October to February) through the end of 30-day period prior to the data submission (e.g., the October 9,

2022 submission should include aggregate influenza data for all ages from July 1, 2022 through the

September 30, 2022). In addition, Jurisdiction shall provide an initial submission of aggregate monthly

data for the previous two influenza seasons as baseline monitoring data. During influenza season (October



5

P)



DUA for Sharing Routine Immunization Data with CDC

OPCMR



to February), Jurisdiction may be required to submit influenza data weekly. The Jurisdiction will be

notified of this requirement within a reasonable time before weekly reporting should begin. Specific

instructions for aggregate seasonal influenza reporting are included in Appendix B. CDC will use the

submitted data to calculate vaccination coverage estimates for all administered seasonal influenza

vaccines. Monthly data submissions shall continue, funded under CDC-RFA-IP19-1901 NOFO, through

the final submission occurring for data through June 30, 2024 on July 31, 2024.



3) Emergency Response Vaccine Date: Should unforeseen events occur, such as pandemics, vaccine

shortages, disease outbreaks, as determined by CDC, Jurisdiction agrees to submit, no-less than weekly,

emergency-related vaccination data to CDC for all ages. CDC will notify Jurisdiction in writing of this

requirement (including necessary data elements) and will work collaboratively with Jurisdiction to

determine the quality and acceptability of submitted data for analysis, recognizing that completeness will

vary between age groups. CDC intends to use these data submissions to monitor the particular emergency,

shortage or outbreak. Analysis by the CDC during peak transmission season, including the influenza

season, may result in a request by CDC of Jurisdiction for more frequent data submission from

jurisdictions. In the event that increased frequency of reporting is required, specific submission schedules

will be shared with Jurisdiction.



4) Jurisdiction agrees that record-level and aggregate vaccination data will be used by investigators for ad-

hoc vaccination analyses in furtherance of public health purposes. CDC will determine the feasibility and

appropriateness of I[S data for ad-hoc studies. Investigators will use the submitted data to monitor

vaccination coverage as identified in the ad-hoc requests approved by ISD. The Jurisdiction will be

notified of analyses utilizing IIS data within two weeks of analysis completion. Additional details about

data access, use, and analysis are included in Appendix A.



CDC and other HHS Operating Divisions agree to a) use and disclose the data only in accordance with

this Agreement, or as otherwise required by applicable federal law; b) limit access to these data only to

those described and authorized in this Agreement, except as may be required by applicable federal law:

c) use appropriate safeguards to prevent use or disclosure of the information other than as provided by

this Agreement; d) ensure all investigators and data administrators are aware of and adhere to security

and confidentiality requirements that may apply to these data; e) consistent with CDC and HHS policies

and procedures, notify Jurisdiction of a use or disclosure of information that is not provided for by this

Agreement; and f) make no attempt to identify or contact the individuals, providers, or health plans within

the data, except as may be required by applicable federal law.



4}

DUA/ MOU: _G030DOHT23



DUA for Sharing Routine Immunization Data with CDC

OPCMR



Examples of Data Submission Date Expectations



Submission Date Data Type Data to Submit



November 9, 2022 Influenza July 1, 2022 — October 31, 2022

December 9, 2022 Influenza July 1, 2022 — November 30, 2022

January 9, 2023 Influenza July 1, 2022 — December 31, 2022

January 31, 2023 Routine All records through December 31, 2022

February 9, 2023 Influenza July 1, 2022 — January 31, 2023



March 9, 2023 Influenza July 1, 2022 — February 28, 2023



April 10, 2023 Influenza July t, 2022 — March 31, 2023



April 30, 2023 Routine All records through March 31, 2023



Dataset Description: For quarterly data submissions, [SD is requesting three tab-delimited files from the IIS,

including 1) record-level demographic information for all ages in the Jurisdiction’s geographic region at the time

of file submission; 2) record-level vaccination information on all doses of all vaccine administered for each

person who has at least one immunization record in the IIS at the time of file submission; and 3) a control file.

The record-level demographic and vaccination datasets must be linked using a unique identifier (ID), provided

by the IIS, which uniquely identifies each individual person in the dataset. This identifier can be the ID used by

the IIS, or it can be a masked [D number. Jurisdictions utilizing PPRL will submit an additional file including

the unique identifier to the PPRL engine for linking (details of PPRL submission are set out in Appendix E;

PPRL data specifications are set out in Appendix F). Demographic datasets for any quarterly data submissions

should include individuals of all ages in the [[S as of the period ending for the month of data submission (e.g.,

for December 31, 2022, data submitted on January 31, 2023).



For aggregate monthly seasonal influenza data submissions, each Jurisdiction must complete the monthly seasonal

influenza template (Appendix B). This Excel document has two worksheets: 1) a table shell for the number of

persons who receive I+ doses of the flu vaccine by age group; and 2) a table shell for the number of persons in the

IIS by age group ({I[S denominator). For each table shell, CDC has provided the date range for the data that should

be selected for inclusion in each month’s report, as well as the birth date range for the specified age cohorts.

Appendix B contains the table shell and instructions for aggregate monthly influenza data submission.



Since not all persons in an HS will have vaccinations, it is possible for a demographic record to exist with no

associated vaccination records. However, all vaccination records must be associated with a demographic record.



Data Elements: The specific control file data elements and instructions are listed in Attachments 2 and 3 (see

Appendices C and D). The specific demographic and vaccination data elements requested are listed in the Data



>



DUA /MOU: G030DOHT23



DUA for Sharing Routine Immunization Data with CDC

OPCMR



Dictionary (Appendices C and D). IIS must include all variables in the submitted file in the same order as is listed

in the Data Dictionary. In the event that values for a variable(s) are not routinely captured and stored in the IIS at

the record-level (e.g., Vaccines for Children (VFC) eligibility), the IIS should not try to derive this information

in order to complete the field prior to submitting data to CDC. More detailed information about each data element

can be found in the respective Data Dictionaries. Columns should be present for all variables, including variables

that are not populated. The Data Dictionary will be updated periodically to incorporate revisions to code sets,

such as when new vaccines are introduced. Specific data elements requested for redaction via the PPRL engine

are included in Appendix F.



File Name:



Data files submitted to ISD should be named using the following format:



I[S_Date of end of reporting period Date of file submission_D (for Demographic file)

IIS_Date of end of reporting period_Date of file submission V (for Vaccination File)



IIS_Date of end of reporting period_Date of file submission C (for Control file)



The IIS code should be the three-letter code assigned to the program in User-Defined Table 0363 — Assigning



Authority of the HL7 Version 2.5.1 Implementation Guide.

(https://www.ede.gov/vaccines/programs/iis/technical-euidance/downloads/hl7guide-201 1-08.pdF).



All submitted dates should be in the yyyymmdd format. For example, if Alaska submits a demographic

dataset for December 31, 2022 on January 31, 2023, the file name should read



AKA_20221231_ 20230131 _D.



The accompanying vaccination dataset file name should read AKA_ 20221231 _20230131_V.



The accompanying control dataset file name should read AKA_20221231_20230131_C.



File Compression: Files should be compressed for transmission to CDC. Winzip is the preferred file compression

software that CDC is supporting.



Data Confidentiality, Access, and Security



1. File Transmission: Data files will be submitted electronically to ISD using secured methods of file

transmission that are approved for transporting moderate personally identifiable information (see

Appendix G for data submission scenarios). Approved methods include, but are not limited to:



DUA / Mou: G030DOHT23



DUA for Sharing Routine Immunization Data with CDC

OPCMR



e CDC Immunization Gateway (IZ Gateway): The [Z Gateway is a cloud-based message routing

service intended to enable data exchange between IISs, other provider systems, and the IZ Data

Lake. The IZ Gateway enables centralized data exchange and eliminates the need for multiple,

individual, point-to-point connections. Secure FTP (below) will be utilized until a jurisdiction is

onboarded to the IZ Gateway.



e Secure FTP: CDC’s Secure FTP site meets the FIPS 140-2 requirements for encryption. An

account and password are required to access this site. A third-party FTP client capable of

FTP over Secure Shell (SSH) is required.



e Additional automated methods for file transmission may be considered by CDC. Any such option

will be secured, encrypted, and deemed appropriately protected for moderate personally

identifiable information.



2. Data De-Identification and Redaction: Approved methods include, but are not limited to:



e PPRL: Jurisdiction uses this secure and irreversible method of de-identification/redaction within

the Jurisdiction’s firewall before sharing data with CDC or another Jurisdiction. Additional

instructions for data submission to the CDC-provided PPRL engine for de-identification are

included in Appendix E.



e Manual redaction: Jurisdiction manually redacts identifiable data from vaccine administration

and demographic files, specifications included in Appendices C and D.



3. Computing environments: [IS data will be housed and processed in CDC computing environments on

CDC-approved platforms configured for the storage and processing of data that contains Personally

Identifiable Information (PII). These include the Consolidated Statistical Platform (CSP), a CDC

computing environment, and/or the Immunization Data Lake (IZDL), a secure, cloud-hosted environment.

Limited HHS, CDC, and contract staff, listed below, have access to IIS data on these platforms. All HHS,

CDC, and contract staff with access to IS data on these platforms will be required to sign a data

confidentiality agreement, consistent with CDC policies and procedures.



4. HHS, CDC, and Contract Staff Access to ITS Data: The following HHS, CDC, and contract staff will

have access to IIS data in the CSP, IZDL; each staff member’s primary duties are listed. Contract staff

assigned to HHS and CDC in support of immunization data activities are held to the same security and

confidentiality standards that apply to CDC/ISD federal staff. Each HHS, CDC, and contract staff person

with access to the IIS data in the CSP or IZDL is required to sign a confidentiality agreement and adhere

to the requirements therein.



e [SD, NCIRD, CDC — Oversees review and approval of requests for analyses using IIS data to

determine feasibility and appropriateness of data use. Conducts vaccine-related assessments for

programmatic and publication purposes.



e Immunization Information Systems Support Branch (IISSB), NCIRD, CDC — Participates in

review and approval of requests for analyses using IIS data to determine feasibility and

appropriateness of data use.



G030DOHT23



DUA / MOU:



DUA for Sharing Routine Immunization Data with CDC

OPCMR



e CDC Analytics Project Lead, ISSB, NCIRD, CDC — Serves as the primary point of contact for

CDC Analytics operations, including system development, testing, and analyses.



e CDC Analytics IT Project Manager — Oversees CDC Analytics, including SAS code

development and system testing for system accuracy and efficiency.



e Additional HHS and contract staff including developers, quality assurance specialists, business

analysts, system architects, analysts, data modelers, data provisioners, basis administrators whose

duties include support of programmatic and scientific activities.



Miscellaneous Provisions



l.



2.



DUA / MOU:



Human Subjects: The data submitted under this Agreement have been designated by CDC as “Public

Health: Non-Research” and are exempt from further human subjects review.



Ownership of Data. Jurisdiction shall retain ownership of the data it contributes to ISD under this

Agreement. However, the Parties agree that the data provided under this Agreement and in the custody



and control of CDC is subject to the laws applicable to the CDC.



Publication. Notwithstanding any other provision of this Agreement, CDC may release data provided to

ISD or publish the results of any study or analysis conducted using that data, but only in forms that do

not identify any individual, except as may be required by law.



Government Data Practices. Jurisdiction acknowledges that CDC is a federal agency subject to applicable

federal laws. As such, with respect to data provided to CDC under this Agreement, CDC will protect the

privacy and confidentiality of the data consistent, where applicable, with federal laws, including the

Privacy Act of 1974 and the Freedom of Information Act (FOIA). Where other more specific federal laws

apply to the data, CDC will comply with those laws, as well. CDC will seek to assert relevant exemptions

to disclosure available under federal law, most critically, where applicable, for personal and/or private

information, the disclosure of which would constitute an invasion of privacy; trade secret and commercial

or financial information that is private and confidential; or information exempted from release by federal

statute.



a. Consistent with applicable federal law, the CDC agrees to promptly notify Jurisdiction if it receives a

legal request to release the data covered by this Agreement. CDC and Jurisdiction will confer concerning

the release of the data to the requesting party before the data are released. Jurisdiction acknowledges that

as a federal agency, CDC is subject to applicable federal law with respect to the disclosure of data in its

custody and control.



b. CDC agrees, to the extent consistent with applicable federal law and this Agreement, to adhere to

Jurisdiction’s Government Data Practices, as it applies to all data provided by Jurisdictions’ I[S to CDC

under this Agreement.



Disposition of Records. |SD will dispose of data files received from Jurisdiction under this Agreement



in accordance with the terms of the applicable Federal Records Act record control schedules (e.g., CDC

Scientific and Research Project Records Control Schedule (N1-442-2009-1).Liability. Each party will

be responsible for its own acts and behaviors and the results thereof. If any claim or cause of action is

asserted against a party in connection with the performance of this Agreement, that party shall,

consistent with applicable law, promptly notify the other party of the claim or cause of action. As may



G030DOHT23 8



DUA for Sharing Routine fmmunization Data with CDC

OPCMR



be permitted by applicable law, the parties shall cooperate with each other in the defense of claims and

causes of action arising out of the performance of this Agreement.



6. Authorized Representatives. CDC’s Authorized Representative for purposes of this Agreement is

Nicole Dowling, Associate Director for Science. 1600 Clifton Road, Atlanta, GA 30333,

nedSi@cdc.gov.



7, Agreement. This Agreement includes the following Appendices: Appendix A — Data Access, Analysis,

and Publication; Appendix B — Monthly Influenza Reporting Template; Appendix C & D — Routine

Data Submission Vaccine Administration and Demographic Data Dictionaries; Appendix E —

Description of Privacy-Preserving Record Linkage (PPRL); Appendix F — Generic PPRL

Specification; Appendix G — Jurisdiction Submission Scenarios.



8. Effective Period. This Agreement shall become effective on the date all required signatures are obtained.

This Agreement is intended to remain in place throughout the project period of NOFO CDC-RFA-

IP19-1901 or until one or both Parties decide to terminate. The Parties acknowledge that termination

of this Agreement may have an impact on the terms of the above-cited assistance mechanism.



{INTENTIONALLY LEFT BLANK}



pua / MouG030DOHT23



DUA for Sharing Routine Immunization Data with CDC

Lisa M. Alejandro, Commissioner Nominee
____________________________________
Department of Property and Procurement
5/31/2023
G030DOHT23