OMS COVID-19 Screening Privacy Notice
Privacy Notice for NIH Staff Regarding Collection of Information in CRIS related to COVID-19 Testing
Introduction
The National Institutes of Health (NIH) is committed to protecting your privacy. This Privacy Notice explains the collection and use of Personally Identifiable Information (PII) about you retained in the NIH Clinical Center’s (CC’s) electronic health record (CRIS). Beginning May 22, 2020, NIH will utilize the functionality in CRIS to order and process COVID-19 laboratory tests for designated Clinical Center staff (e.g., NIH Institute or Center employees, contractors, volunteers, trainees) through this voluntary testing program. The CC Department of Laboratory Medicine will run the samples and enter results into your CRIS record. If you grant approval in the COVID-19 screening questionnaire, the CC Department of Laboratory Medicine will also retain your samples for future needs described in this notice.
Your PII such as lab results will be stored in a segregated section of CRIS accessible only to NIH Occupational Medical Service (OMS) employees and those working directly on their behalf. Your information will not be transferred to or stored in Biomedical Translational Research Information System (BTRIS) or NIH research records. Your information or samples will not be used in identifiable form for research purposes but may be used in de-identified form for research purposes if you provide consent in the COVID-19 screening questionnaire. You may, however, be asked to join research at a later time that requests your authorization to release your identifiable information and/or samples to the researchers and possibly into different NIH records systems. That research is separate from this testing, is voluntary, and you may choose at the time whether to participate in the research.
In the course of its employee health activities, your identifiable medical record information may need to be released outside of NIH and HHS, these situations are described in the System of Records Notice routine uses available here: https://www.federalregister.gov/d/02-23965/p-29 The CC offers a secure, internet-accessible patient portal called FollowMyHealth. The FollowMyHealth patient portal enables NIH workers to electronically view selected information contained in their electronic occupational health record within CRIS including your COVID-19 test results. By providing a personal email address, you will receive instructions for the creation of your patient portal account.
Please note that after reading the purpose of the registry and this Privacy Notice you are acknowledging receipt of information about the practices described in this Privacy Notice, including the collection, storage and use of personal information about you as described in this Notice.
The NIH Privacy Policy applies and is located at https://www.nih.gov/web-policies-notices.
IF YOU HAVE SYMPTOMS OF COVID-19 OR MAY HAVE HAD CONTACT WITH A PERSON WITH COVID-19 IN THE PAST 14 DAYS, NOTIFY YOUR SUPERVISOR AND DO NOT COME TO WORK.
Purposes and Use of Information We Collect from You
The primary use of your information is for creation of an OMS patient record in CRIS for workplace safety purposes and surveillance due to the COVID-19 pandemic. This information will be collected from you through the following website:
https://clinweb.cc.nih.gov/cct. Demographic information collected includes: full name; contact information (personal phone number and personal email); date of birth; gender; work location; and NIH Enterprise Directory (NED) ID. Additionally, your home address will be collected from NED and placed in this record.
Providing your demographic information is voluntary. If you decline to provide this demographic information, you may not be able to complete the testing process here at the NIH and may seek testing elsewhere. The results from the outside testing may be provided to the OMS if you authorize it.
Protecting the Confidentiality and Safety of Information
The CC maintains physical, electronic, and procedural safeguards to comply with the Privacy Act of 1974 (5 U.S.C. 552a as amended). We do not use your personally identifiable information for any other purpose except as explained in this Notice.
OMS or the CC’s Hospital Epidemiology Service (HES) must report all test results (positive and negative) to the Maryland Department of Health. If you reside outside of Maryland, the Maryland Department of Health will transmit your information (including test results) to the local or state Department of Health where you live. If you test positive, OMS will also notify the staff member’s supervisor that the individual is sick with a health condition and is advised to stay at home. OMS will not confirm whether a specific staff member tested positive for COVID-19 to protect privacy.
Security of Information
At all times, security maintenance and administration is an important part of the Clinical Center Employee Test Scheduling website operation and CRIS. The CC CRIS system uses appropriate administrative, technical and physical controls outlined in NIST SP 800-53 for protection of information contained therein. CRIS is protected by multiple firewalls, vulnerability scanning, and advanced encryption technology. Occupational health electronic records are stored in a segregated section of CRIS accessible only to OMS and those working directly on their behalf.
Acknowledgement
By accepting this notification, I acknowledge that I have read this Privacy Notice and agree to the use of my information and samples in this manner. I understand that I may contact the office listed below if I have any questions or concerns about the use or release of my information.
Authority
The legal authority to operate and maintain this Privacy act records system is 42 U.S.C. 241, 248, 282 and 2421.
Contact Us
You may contact
cc-dcriprivacy@cc.nih.gov with questions regarding this Privacy Notice
An additional question has been added to the COVID-19 screening questionnaire which is used to evaluate testing needs for persons with symptoms suggestive of COVID-19 infection. This question requests permission to use your sample for further evaluation to learn more about SARS-CoV-2, the virus that causes COVID-19, including information concerning workplace safety. The purpose of this question is to support work intended to learn more about how SARS-CoV-2 is transmitted between people, and hopefully how to prevent its spread in the workplace or elsewhere. We will do this by studying the viral sequences of different specimens. Using established, scientific tracking methods (such as viral sequencing) of studying viruses and other organisms that cause disease, will allow the program to remain effective over time in keeping the risk to staff from COVID-19 as low as possible. Samples or data may also be used for other COVID-19 studies or to understand other viruses, diseases or conditions, and for workforce planning or employee safety programs.
If you provide authorization, and your samples are used for this purpose, your privacy will remain fully protected. The Clinical Center (CC) Department of Laboratory Medicine (DLM) is the group that stores your samples. To protect your privacy, DLM will remove all your personal identifiers (like name, address, NIH division) from your samples if they’ll be used for study. This makes your samples de-identified. This will happen before your samples are used for any of the reasons explained above. Once de-identified, samples and limited data associated with them, e.g., test results, may be shared with researchers at the NIH or other places. The use of samples and associated data will remain subject to the same privacy protections and limitations as outlined by the Office of Human Subject Research Protections.
IF YOU HAVE SYMPTOMS OF COVID-19 OR MAY HAVE HAD CONTACT WITH A PERSON WITH COVID-19 IN THE PAST 14 DAYS, NOTIFY YOUR SUPERVISOR AND DO NOT COME TO WORK.
