All Interview Questions

Do the data contain information related to substance abuse diagnosis, referral, or treatment?

Were the data obtained from a federally assisted drug abuse program after March 20, 1972, or a federally assisted alcohol abuse program after May 13, 1974 (or if obtained before the pertinent date, were they maintained by a federally assisted alcohol or drug abuse program after that date as part of an ongoing treatment episode which extended past that date)?

Terms

• Federally assisted drug or alcohol abuse programs: An alcohol or drug abuse program is considered to be federally assisted if it is conducted by any federal agency or department, whether in whole or in part, directly or by contract. This includes programs carried out under a license, certification, registration, or authorization granted by a federal department or agency. Also included are programs that receive funding from any federal department or agency, programs conducted by a state or local government that receives any form of federal financial assistance, programs carried out under certification of provider status under the Medicare program, or programs that are allowed income tax deductions for contributions to the program or are granted tax exempt status by the Internal Revenue Service.

Do any of the substance abuse records contain patient identifying information, or information that would identify a patient as an alcohol or drug abuser either directly or by reference to other publicly available information?

Terms

• Patient identifying information: This means the name, address, Social Security number, fingerprints, photograph, or similar information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information. The term does not include a number assigned to a patient by a program, if that number does not consist of, or contain numbers, such as a Social Security, or driver’s license number, which could be used to identify a patient with reasonable accuracy and speed from sources external to the program.

Were the data maintained in connection with the US Department of Veterans Affairs or US Armed Services?

Were the data maintained by the Department of Veterans Affairs either shared with the patients’ consent for the purposes of scientific research, or shared without consent but in connection with a medical emergency or public health activity related to HIV?

Was the research funded, at least in part, but the federal government?

Does the research activity include any of the following:

• biomedical research
• behavioral research
• clinical research
• mental health research
• research on the use and effect of alcohol and other psychoactive drugs

And was identifiable, sensitive information is collected?

Does any of the following hold:

• Does the research involve Human Subjects as defined by 45 CFR Part 46?
• Are you collecting or using biospecimens that are identifiable to an individual as part of the research?
• If collecting or using biospecimens as part of the research, is there a small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual?
• Does the research involve the generation of individual level, human genomic data?

Do the data contain information from a covered entity or business associate of a covered entity?

Terms

• Covered entity: A covered entity is a health plan, health care clearinghouse, or health care provider that transmits any health information in electronic form.
  * Health plans include health insurance companies, health maintenance organizations [HMOs], company health plans, and government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans health care programs.
  * Health care providers include doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies.
  * Health care clearinghouses include entities that process nonstandard health information they receive from another entity into a standard, i.e. standard electronic format or data content, or vice versa.
• Business associate: A business associate is any person or organization, including a subcontractor, that acts on behalf of, or provides services to, a covered entity involving the use or disclosure of protected health information. This includes, but is not limited to, legal, actuarial, accounting, consulting, claim processing, data analysis, administration, utilization review, quality assurance, billing, benefit management, practice management, and re-pricing activities.

Have all direct identifiers been removed from the data?

Terms

• Direct identifiers: Refers to the following list of identifiers of the patient or of relatives, employers, or household members of the patient:
• Names
• Geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of the ZIP code if, (1) the geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; and (2) the initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000
• All elements of dates (except year) for dates that directly relate to an individual [e.g., birth date, admission date, discharge date, death date, and all ages over 89]
• Telephone or fax numbers
• Email addresses
• Social security numbers
• Medical record, health plan beneficiary, and all other account numbers
• Certificate/license numbers
• Vehicle identifiers and serial numbers, including license plate numbers
• Device identifiers and serial numbers
• Web universal resource locators (URLs)
• Internet Protocol [IP] address numbers
• Biometric identifiers, including finger and voice prints
• Full face photographic images and any comparable images
• Any other unique identifying number, characteristic, or code

Has an expert in statistical or scientific principles and methods for deidentification certified that the data have been deidentified?

Terms

• Certification: Means the expert has applied appropriate principles and methods and determined that the risk is very small that the information could be used, alone or in combination with other reasonably available information, to identify one of the data subjects, and has documented the methods and results of the analysis justifying such determination.

Do the data constitute a limited data set under the HIPAA Privacy Rule?

Terms

• Limited data set: A limited data set contains patient information that has been stripped of all of the following identifiers and is shared according to the terms of a data use agreement.
  * Names
  * Postal address information other than city or town, state, and ZIP code
  * Telephone or fax numbers
  * Email addresses
  * Social security numbers
  * Medical record, health plan beneficiary, or other account numbers
  * Certificate/license numbers
  * Vehicle identifiers or serial numbers, including license plate numbers
  * Device identifiers or serial numbers
  * Web universal resource locators [URLs]
  * Internet Protocol [IP] address numbers
  * Biometric identifiers including finger and voice prints
  * Full face photographic images or other comparable images

Do the data contain protected health information from medical records? In other words, do the data contain any health information that can be used to identify an individual? This includes, but is not limited to, demographic information or anything related to an individual’s past, present, or future health condition and related treatments or payments.

Terms

• Protected health information: Protected health information is defined as individually identifiable health information that is transmitted or maintained in any form of media. It excludes individually identifiable health information in education records covered by the Family Educational Rights and Privacy Act [FERPA] and employment records held by a covered entity in its role as an employer.
• Individually identifiable health information: Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual by a covered entity, that relates to an individual’s past, present, or future physical or mental health condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual. It often includes common identifiers such as name, address, birth date, Social Security number, or anything that can reasonably be used to identify the individual. When information relates to an individual’s past or current treatment for alcohol or drug abuse, this includes any information – recorded or unrecorded – that could be used to determine the patient’s identity directly or by reference to other publicly available information.

Do the data contain health information from patients who have provided written authorization for their information to be disclosed to or used by third parties?

Terms

• Authorization: Refers to an individual’s signed permission to allow a covered entity to use or disclose the individual's protected health information. It includes a detailed description of the information to be used or disclosed, specific persons authorized to use or disclose the information, a description of the purpose of use or disclosure of the information, and an expiration date. Authorization may be combined with a consent to participate in the research, or with any other legal permission related to the research study.

Has an oversight body such as an Institutional Review Board [IRB] or Privacy Board reviewed how the data will be used or disclosed and approved a request to alter or waive the Authorization requirement?

Terms

• Institutional review board - IRB: A board, committee or group formally designated by an institution to review research involving human subjects. Most universities and academic medical centers that receive federal funding often have designated IRBs.
• Privacy Board: An alternative to an IRB, comprised of members of varying backgrounds and appropriate professional competencies as necessary to review the effect of the research protocol on individual privacy rights and related interests. Privacy Boards must have at least one member who is not affiliated with the covered entity that will use or disclose the PHI involved in the research project, not affiliated with any entity conducting or sponsoring the research, and not related to any person who is affiliated with such entities, and members may not have conflicts of interest regarding the projects they review.
• Alterations / Waivers to Authorization: An IRB or Privacy Board may approve a waiver or alteration of the research participants’ authorization for use or disclosure of information about them for research purposes. This provision can be used to conduct records research when the research could not practicably be conducted if research participants’ authorization were required. A covered entity may use or disclose protected health information for research purposes pursuant to a waiver of authorization by an IRB or Privacy Board, provided it has obtained documentation describing the IRB or Privacy Board, the date of approval, a description of the information to be used or disclosed, and a statement that the use or disclosure has been reviewed and approved under either normal or expedited review procedures.

Were the data disclosed pursuant to a HIPAA business associate contract?

Terms

• Business associate contract: A covered entity is required to enter into a business associate contract when it discloses protected health information to a business associate, or an individual or entity providing claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, or similar functions or activities on behalf of the covered entity. A covered entity may also, but is not required to, enter in such a contract when disclosing protected health information to a researcher.

Did the individuals provide written consent for the disclosure of their information?

Terms

• Written consent: Includes the specific name or a designation of the program or person permitted to disclose the information; the name or title of the individual or the name of the organization to which disclosure is to be made; the name of the patient; the purpose of the disclosure; how much and what kind of information is to be disclosed; the signature of the patient, or a person authorized to sign on behalf of the patient; and the date on which the consent is signed.

Were the data shared by the substance abuse program for scientific research purposes?

Terms

• Scientific research purposes: This refers to information from substance abuse patient records disclosed for the purpose of conducting scientific research. The director of the substance abuse program may decide to release information for this purpose if he or she determines that the recipient of the patient identifiable information is qualified to conduct the research and has a research protocol under which the information will be maintained in accordance with specific security requirements under the substance abuse confidentiality regulations

Do the data contain information collected from students in a survey or assessment concerning any of the covered categories?

Do the data from the survey or assessment contain any personally identifiable information about a student? Personally identifiable information about a student includes, but is not limited to, the following categories of information:
* A student’s name
* The name of a student’s parent or other family members
* The address of a student or a student’s family
* Other direct identifiers, defined as information that relates specifically to an individual, such as a student’s Social Security number, student number, other identifying number or code, telephone number, e-mail address, or biometric record
* Other indirect identifiers defined as information that can be combined with other information to identify specific individuals, such as the student’s gender, race, religion, date of birth, place of birth, other geographic indicator, weight, mother’s maiden name, activities, employment information, education information, financial information, and other descriptors
* Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty
* Information disclosed in response to a targeted request

Terms

• Deidentified information: Information that has been deidentified is considered not to contain personally identifiable information. The term deidentified is used to describe records that have enough personally identifiable information removed or obscured such that the remaining information does not identify an individual and there is no reasonable basis to believe that the information can be used to identify an individual. In making a determination that a student’s identity is not personally identifiable, both single and multiple data releases from the education records should be taken into account along with other information available from other sources.
• Biometric record: Refers to a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting.
• Targeted request: Refers to a request by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates. For example, if there was a rumor published in the local paper that a public official was disciplined for cheating during his senior year in high school, a request to the high school for the disciplinary records of students who were caught cheating during the year the public official was a senior would be considered a targeted request.

Was the survey or assessment funded, in whole or in part, by the US Department of Education?

Terms

• Funded by the US Department of Education: This means the survey or assessment received funds for any purpose from the US Department of Education. It includes any funds provided by grant, cooperative agreement, contract, subgrant, or subcontract to the program or institution that conducted the data collection.

Was written consent obtained from the parents of the students who participated in the survey or assessment, or from the students themselves if they are adults or emancipated minors, prior to the data collection?

Was any of the personal information in the data collected from students for the purpose of marketing or sale?

Terms

• Personal Information: Refers to individually identifiable information including, but not limited to:
  * a student or parent’s first and last name,
  * a home or other physical address, including street name and the name of the city or town,
  * a telephone number, or
  * a Social Security identification number.
• Marketing Purpose: This does not include the gathering and release of information for the following activities:
  * College, post-secondary education, or military recruitment
  * Book clubs, magazines, and low-cost literacy products
  * Curriculum and instructional materials used by elementary and secondary schools
  * Certain tests and assessments used by elementary and secondary schools
  * Sale by students of services and products for education or school-related, fundraising activities
  * Student recognition programs

Does the school in which the information was collected receive any funds from the US Department of Education?

Terms

• Funds from the US Department of Education: This means funds provided for any purpose by the US Department of Education to the elementary or secondary school in which the data were collected. It includes any funds provided by grant, cooperative agreement, contract, subgrant, or subcontract to the institution. The funds, alternatively, may have been provided to students attending the institution. For instance, the funds may have been paid to the institution by those students for educational purposes, such as under the Pell Grant Program and the Guaranteed Student Loan Program. Note that all public schools receive such funds, though most private and parochial schools at the elementary and secondary levels do not receive such funding.

Were parents provided with notice and an opportunity to opt out of the collection and disclosure of the information?

Do the data contain any information derived from institutional records directly related to a student?

Do the data include personally identifiable information about a student? Personally identifiable information about a student includes, but is not limited to, the following categories of information:
* A student’s name
* The name of a student’s parent or other family members
* The address of a student or a student’s family
* Other direct identifiers, defined as information that relates specifically to an individual, such as a student’s Social Security number, student number, other identifying number or code, telephone number, e-mail address, or biometric record
* Other indirect identifiers, defined as information that can be combined with other information to identify specific individuals, such as the student’s gender, race, religion, date of birth, place of birth, other geographic indicators, height, weight, mother’s maiden name, activities, employment information, education information, financial information, and other descriptors
* Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty
* Information disclosed in response to a targeted request

Terms

• Deidentified information: Information that has been deidentified is considered not to contain personally identifiable information. The term deidentified is used to describe records that have enough personally identifiable information removed or obscured such that the remaining information does not identify an individual and there is no reasonable basis to believe that the information can be used to identify an individual. In making a determination that a student’s identity is not personally identifiable, both single and multiple data releases from the education records should be taken into account along with other information available from other sources.
• Biometric record: Refers to a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting.
• Targeted request: Refers to a request by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates. For example, if there was a rumor published in the local paper that a public official was disciplined for cheating during his senior year in high school, a request to the high school for the disciplinary records of students who were caught cheating during the year the public official was a senior would be considered a targeted request.

Did the educational agency or institution designate all of the personally identifiable information in the data as directory information? The educational agency or institution provides notice to students and parents of the types of information it has designated as directory information.

Terms

• Directory information: Refers to information that is generally not considered harmful or an invasion of privacy if released and can be disclosed to outside organizations without a parent's prior written consent.

  * Types of information frequently designated as directory information include:
  * Name, address, telephone listing, or e-mail address
  * Photograph
  * Date or place of birth
  * Major field of study
  * Dates of attendance
  * Enrollment status, e.g., undergraduate or graduate, full-time or part-time
  * Grade level or class year
  * Participation in officially recognized activities and sports
  * Height and weight of members of athletic teams
  * Degrees, honors, and awards received
  * Publication titles
  * The most recent educational agency or institution attended
  
  Directory information never includes a student’s Social Security number or identification number that is used to access a student’s education record.
  

Did any of the students in the data, or their parents, if the students are under 18, request to opt out of the release of their information as directory information?

Did the parents or guardians of the students, or the students themselves if they were adults or emancipated minors at the time of the data collection, provide written consent authorizing disclosure of their information?

Terms

• Written consent: Refers to signed and dated written permission from the parents or students that specifies the records to be disclosed, the purpose of the disclosure, and to whom the records may be disclosed. The form of the consent and the other elements it may contain vary between institutions.

Are the data being disclosed to a school official or contractor with a legitimate educational interest?

Terms

• School official or contractor: This includes professors; instructors; administrators; health staff; counselors; attorneys; clerical staff; trustees; members of committees and disciplinary boards; and contractors, consultants, volunteers or other parties to whom the school has outsourced institutional services or functions.
• Legitimate educational interest: A school official generally has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility. Legitimate educational interests include, but are not limited to, performing a task related to the regular duties of the employee or agent, the student’s education, or a service or benefit for the student.

Are the data being disclosed for the purpose of conducting a study for, or on behalf of, the educational agency or institution in order to develop, validate, or administer predictive tests, or improve instruction?

Are the data being disclosed for the purpose of conducting an audit or evaluation of a federal- or state-supported education program?

Terms

• Education program: Refers to a program principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution.

Were the data collected by a federal agency or a researcher under contract with or with funds from a federal agency?

Are you an employee or an agent, such as a contractor, consultant, researcher, or employee of a private organization, operating under a contract, grant, or other agreement with the agency that collected the data?

Were the data collected by the US Census Bureau?

Were the data published by the Census Bureau?

Do the data contain information from an education research project that receives funding from the Institute of Education Sciences? Examples of funded projects are included on the following web sites:
* National Center for Education Research [NCER] - http://ies.ed.gov/ncer/projects/
* National Center for Education Evaluation and Regional Assistance [NCEE] - http://ies.ed.gov/ncee/projects/
* What Works Clearinghouse [WWC] - http://ies.ed.gov/ncee/wwc/
* Regional Educational Laboratory Program - http://ies.ed.gov/ncee/edlabs/index.asp
* Education Resources Information Center [ERIC] - http://ies.ed.gov/ncee/projects/eric.asp
* National Library of Education [NLE] - http://ies.ed.gov/ncee/projects/nle/
* National Center for Special Education Research [NCSER] - http://ies.ed.gov/ncser/projects/
* National Center for Education Statistics [NCES] - http://nces.ed.gov/surveys/

Have the data been published previously, or did you submit a copy of the data to the Institute of Education Sciences (IES) Data Security Office and receive its authorization to disclose the data?

Has the IES Data Security Office limited access to the data to individuals authorized by an IES license agreement or individuals who have executed an affidavit of nondisclosure?

Were the data collected directly from respondents for exclusively statistical purposes under a pledge of confidentiality?

Is the agency that collected the data a statistical agency or unit from this list: USDA Economic Research Service, National Agricultural Statistics Service, Bureau of Economic Analysis, Census Bureau, National Center for Education Statistics, Energy Information Administration, National Center for Health Statistics, Bureau of Justice Statistics, Bureau of Labor Statistics, Bureau of Transportation Statistics, Statistics of Income Division of the Internal Revenue Service, or NSF Division of Science Resources Statistics?

Are the data being shared in identifiable form?

Terms

• Identifiable form: Identifiable form refers to any representation of information that permits the identity of the respondent to whom the information applies to be reasonably inferred by either direct or indirect means.

Are the data maintained by the agency in a system of records?

Terms

• System of records: A system of records is a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.
• Record: A record is any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history, and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.

Do the data contain personally identifiable information?

Terms

• Personally identifiable information: Any information about an individual that can be used to distinguish or trace an individual's identity - such as name, address, or Social Security number - either by itself or in combination with any other information that is linked or linkable to an individual, such as medical, educational, financial, criminal or employment history.

Has a Census Bureau Disclosure Review Board issued an approval memorandum granting formal permission for the data to be published?

Do the data contain personal information obtained from a state department of motor vehicles?

Terms

• Personal information: Information that identifies an individual, including, but not limited to, an individual's photograph, Social Security number, driver identification number, name, address [not including the 5-digit ZIP code], telephone number, or medical or disability information. It does not include information on vehicular accidents, driving violations, or a driver's status (including whether the driver's license is valid, suspended, or revoked)

Do the department of motor vehicles records contain an individual's photograph or image, Social Security number, or medical or disability information?

Has express consent been obtained from each person whose photograph, Social Security number, or medical or disability information appears in the data?

Is disclosure of the personal information required by the Driver's Privacy Protection Act? Disclosure is required, among other reasons, in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; and performance monitoring of motor vehicles and dealers by motor vehicle manufacturers.

Is the disclosure of these records made in accordance with the driver's license record disclosure law of the state from which the records were obtained?

Was consent obtained from the person about whom the information pertains by the State DMV in response to a request for an individual record?

Was the obtained consent limited in any way, such as purpose, duration, parties that may receive the data?

Was consent obtained from the individuals whose information is contained in the data by the requester of the records?

Was the obtained consent limited in any way, such as purpose, duration, parties that may receive the data?

Were the data obtained for use in research activities?

Was the personal information obtained under one of the other fourteen permissible uses for the disclosure of drivers' records, including:
* for use by any government agency, or any person acting on behalf of a government agency, in carrying out its functions;
* for use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and removal of non-owner records from the original owner records of motor vehicle manufacturers; or
* for bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.