USVI Public Records

Document text

DocuSign Envelope ID: F2888B58-5AE-4F52-8895-B5F17645A2FO Addendum Regarding Monkeypox to the Data Use and Sharing Agreement to Support the United States Government’s COVI D-19 Emergency Response Jurisdiction Immunization and Vaccine Administration Data Agreement This is an Addendum to the Data Use and Sharing Agreement to Support the United States Government’s COVID-19 Emergency Response, Jurisdiction Immunization and Vaccine Administration Data Agreement (DUA) that was entered into between the U.S. Virgin Islands Department of Health, Immunization Program and the Centers for Disease Control and Prevention (CDC), an agency of the Department of Health and Human Services (HHS) to describe the data use and sharing parameters for certain immunization and vaccine administration data. That DUA was entered into on 11/20/2020 . See attached. The purpose of this Addendum is to document the mutual agreement between the Jurisdiction and CDC to apply the same requirements and provisions of the DUA to vaccine administration data for the ongoing, multi-country monkeypox outbreak, in furtherance of federal government efforts to develop a comprehensive picture of monkeypox vaccine administration nationally. This Addendum is intended to facilitate the transmission of jurisdictional monkeypox vaccine administration data from various sources to CDC, and then to the Tiberius analytic platform. This Addendum relates exclusively to monkeypox vaccine administration data, and nothing in this Addendum is intended to otherwise alter or change the terms and conditions of the above-referenced DUA. All terms of the DUA remain in effect and apply to any continued or further activities undertaken consistent with its scope. HHS and CDC, through this Addendum, are requesting the same vaccine administration data elements, including monkeypox vaccine data available in jurisdictional immunization information systems prior to effective date of the Addendum, using the same data submission specifications, relevant systems, and technical architecture for monkeypox vaccine administration data as outlined in the DUA for COVID-19 vaccine administration data. All provisions of the DUA and its Appendices apply to this Addendum, except for as provided below. For purposes of this Addendum: - References to “response” or the “whole of government response” in the DUA should be interpreted as applying to the federal government’s monkeypox outbreak response. - References to COVID-19 and COVID-19 vaccination in the DUA should be interpreted to include monkeypox and monkeypox vaccination, as appropriate. Pagelof3 ) DUA/MOU: G070DOHT22 DocuSign Envelope ID: F2888B58-5AAE-4F52-8895-B5F1 7645A2F0 The data and technical infrastructure for monkeypox administration data will align to the extent possible with the data and technical infrastructure specifications in the DUA, with the following provisions: - The CVRS file will be used for monkeypox vaccine administration data without modification, unless otherwise specified by CDC. Should the CVRS file not be used, CDC will work with the Jurisdiction to determine a suitable alternate format. - For transmission of monkeypox vaccination administration data, CDC intends to rely on the COVID-19 Data Clearinghouse (DCH). Should the DCH not be available for inclusion in the data submission architecture for monkeypox vaccine administration data, CDC will work with the Jurisdiction to establish an alternate and similar capability (e.g., data submission portal directly to the Immunization Data Lake (IZDL)). CDC will communicate that determination to the Jurisdiction as soon as possible. - Should any other data or technical infrastructure referred to in DUA not be available for use for monkeypox vaccine administration data, CDC will work with the Jurisdiction as necessary to establish an alternate and similar capability. This Addendum shall end on the same date as the DUA or December 31, 2023, whichever is later. Any extensions of the DUA shall extend to this Addendum unless otherwise indicated. This Addendum may be renewed beyond the end of the DUA upon mutual written consent of the parties. Except as otherwise expressly provided herein, this Addendum may be amended only by the mutual written consent of the authorized representatives for each Party. However, the Parties acknowledge that changes and updates to the Appendices may occur during the term of the addendum; the Parties agree that such changes and updates are incorporated upon issuance. This Addendum may otherwise be terminated with ninety (90) days’ advance written notice by either party. This Addendum will become effective on the date of the last signatory to this Addendum agreement. CENTERS FOR DISEASE CONTROL AND PREVENTION AND JURISDICTION Ad G d’ 1 DgitaIIy signed by Adi Gundlapalli I U fl 1apa ii Date: 2022 0725 1221:40 -0400 Signature _______________________________________ Name Adi V. Gundlapalli, MD, PhD Chief Public Health Informatics Off Title _____________________________________ Email agundlapalli©cdc.gov Date 7/25/22 I Page2of3 ‘ DUA/MOU: G070DOHT22 DocuSign Envelope ID: F2888B58-5AAE-4F528895-B5F1 7645A2F0 JURISDICTION Signature Justa E. Encarnacion, RN, BSN, MBA, Name HCM Commissioner of the Department of Title Health Email justa.encarnaciondoh .vi .gov Date 8/4/2022 Signature Name Anthony D. Thomas, MBA Commissioner of the Department of Title Property and Procurement Email anthony.thomasdpp.vigov Date APPROVED AS TO LEGAL SUFFICIENCY AT THE DEPARTMENT OF JUSTICE BY: Signatu Name Carol E. McDonald Title Assistant Attorney General Email caroI.mcdonalddoj .vi.gov Date 8/12/2022 Page 3 of3 ____________________ 8/12/2022 DUA/MOU: G070DOHT22 Original MOU/DUA ‘S. I PathData Use and Sharing Agreement to Support the United States Government’s COVID-19 Emergency Response Jurisdiction Immunization and Vaccine Administration Data Agreement This Data Use and Sharing Agreement (“DUA”) is made between U.S. Virgin Islands Department of Health, Immunization Division (“Data Source” or “Jurisdiction”) and the Centers for Disease Control and Prevention (CDC), an agency of the Department of Health and Human Services (“HHS”), to describe the data use and sharing parameters for certain immunization and vaccine administration data, as further described herein. This DUA: 1) describes platforms for the rapid collection, transmission, use, storage, and maintenance of these data available to data sources, CDC, and other users; 2) establishes the terms and conditions for the sharing, protection, and use of these with CDC, HHS and other federal partners; and 3) sets forth the roles and responsibilities of each party. The DUA is effective as of 20th Day of November, 2020 (“Effective Date”) Background and Purpose Access to immunization and vaccine administration data is critical to the whole of government response to the Coronavirus Disease 2019 (COVID- 19) public health emergency. In furtherance of federal government response efforts, HHS and CDC seek to obtain and utilize these data from various immunization and vaccine data sources, including a jurisdiction’s immunization information system (uS), pharmacies, federal Provider Organizations, and other relevant parties for a range ofpurposes, including but not limited to rapidly assessing patterns of vaccination among the population; identifying pockets of under vaccination ; assisting in determining vaccine resource allocation to address the needs of jurisdictions; monitoring vaccine effectiveness and safety; assessing spectrum of illness, disease burden, risk factors for severe disease and outcomes; and helping to understand the impact of COVID- 19 on the healthcare system and communities. To support these purposes, HHS and CDC: 1) have made available a platform for use by data sources to manage, share, and store their immunization data; 2) have developed platforms for use by HHS, CDC, and other federal partners to extract, accept, manage, share, and store relevant immunization data in furtherance of the response; 3) will, consistent with applicable law, enable the secure transmission of extracted data from and across these platforms for further use by a jurisdiction, CDC, HHS, and other federal partners in furtherance of the response; 4) as applicable, will assure compliance of these platforms with the Federal Information Security Management Act (FISMA) and other federal data security policies; and 5) will provide operational support to the data sources and other authorized users of the various platforms, as appropriate. Authority HHS and CDC are authorized by Sections 301 and 31 9D ofthe Public Health Service Act [42 U.S.C. § 241 and 247d-4], as amended, to maintain active surveillance of diseases through epidemiologic and laboratory investigations and data collection, analysis, and distribution. The Jurisdiction entering this DUA agrees that it is authorized to send the Covered Data to and through the COVID-1 9 Clearinghouse, the Immunization (IZ) Data Lake, the Vaccine Administration Management System (yAMS), and HHS Protectfriberius, as those platforms and systems are further defined herein, ii Page DUAJMOU: GOO4DOHT21 - 1 f and/or will obtain consent from any external entities or individuals from whom it collects data to allow for such sharing and use. In addition, HHS and CDC each is a “public health authority” as defined at 45 C.F.R. § 164.501 and as used in 45 C.F.R. §164.512(b), Standards for Privacy of Individually Identifiable Health Information, promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and, as such, are authorized by 45 CFR 164.5 12(b) to receive Protected Health Information (“PHI”). As applicable, the Parties acknowledge that Jurisdiction may be a hybrid entity for purposes of HIPAA. Jurisdiction’s healthcare component is neither involved nor implicated in this DUA. For purposes of this DUA, Jurisdiction is a public health authority under 45 CFR § 164.512 and is neither a covered entity nor a business associate, as defined under 45 CFR §160.103. The Parties expressly do not intend to create a 1-IIPAA business associate relationship, and nothing in this DUA may be construed to make Jurisdiction a covered entity or business associate for purposes of this agreement. Data Use and Sharing Terms 1. Platforms In furtherance of the activities set out in this DUA, HHS and CDC, either directly or by and through a service provider, have stood up. are supporting, and or are expanding the capacity of the following secure, certified, cloud-based data management platforms: a. Immunization (IZ) Gateway: The IZ Gateway is a cloud-hosted message routing service offered by the Association for Public Health Laboratories (APHL) and is intended to enable data exchange across liSs, other provider systems, the COVID-19 Clearinghouse, and the IZ Data Lake. A jurisdiction may enter into appropriate agreements with APHL to enable its uS to update, query, and report immunization data to and through the lZ Gateway. The IZ Gateway is intended to allow a jurisdiction to connect its uS and other provider systems to the COVID-19 Clearinghouse and the IZ Data Lake; connect its uS to VAMS data, where applicable; enable queries and route messages to/from its uS; and route secured, standardized HL7 messages from its [IS, yAMS, or other provider organizations to the COVID-19 Clearinghouse and the IZ Data Lake. A jurisdiction choosing to use the IZ Gateway will enter into relevant agreements with APHL with respect to use of the 1Z Gateway. b. COVID-19 Clearinghouse: The COVID-19 Clearinghouse is a cloud-hosted data repository provided and managed by HHS that, as a functional tool, provides a secure space for a jurisdiction to upload and store COVID-19 vaccination data collected from provider organizations via electronic health records (EHRs) and from pharmacy systems. The COVID-19 Clearinghouse is intended to allow a jurisdiction to upload, store, reconcile, and manage data for general COVID 19 vaccine administration, to meet reporting requirements and needs, and to allow providers to search for a patient, see what brand of COVID-l9 vaccine they received, and when they received their first dose of COVID-19 vaccine to ensure dose matching to complete the vaccine series (see Appendix A). The COVID-19 Clearinghouse will be able to receive data from VAMS and other vaccination sources not already onboarded as providers to an immunization registry and will allow the data to 2Page DUAJMOU: GOO4DOHT2I ‘ 1 ) be shared across relevant jurisdictions for reconciliation of patient registry records. Neither CDC nor HHS, either_directly or by and through the cloud service provider, will have access to personally identifiable vaccination data submitted by a jurisdiction’s uS, yAMS, or other vaccine source record system during transport or record processing or while in storage without the express consent of the jurisdiction. HHS and CDC, either directly or by and through the service provider, vill take all reasonable measures to secure the data residing in the COVID-l 9 Clearinghouse and, except as may be required by applicable federal law, will not, ‘ithout the prior written authorization from the jurisdiction, further use, disclose, or transmit the data beyond what is described within this DUA. Should disclosure or transmission ofa jurisdiction’s data be required by federal law, HHS and/or CDC will promptly notify the jurisdiction in writing of the required release. c. Immunization (IZ) Data Lake: The IZ Data Lake is a CDC secure, cloud-hosted data repository created to receive and store redacted COVID-19 vaccination data for doses administered, coverage, inventory, and distribution. The IZ Data Lake will receive the data from various data flows, including internal CDC sources (VTrckS), Provider Agreement data via an upload portal, VaccineFinder, and the COVID-19 Clearinghouse. These data will be used by CDC to provide aggregate-level reports for COVID-l9 vaccine administration, ordering, inventory, and provider information. The IZ Data Lake will also aggregate and analyze data and provide data summaries and analytics via platforms such as the Data Storefront HHS Protect, and HHS Tiberius. d. VaccineFinder: The VaccineFinder website vaccinehiidei.or) helps people find providers who offer specific vaccines. VaccineFinder will serve two roles during the COVID-19 Vaccination Program: 1. Inventory reporting: Approved COVID-l9 vaccination providers will report on-hand COVID-l9 vaccine inventory daily. 2. Increase access to COVID-19 vaccines: COVID-19 vaccination providers may choose to make their location(s) visible on VaccineFinderto increase access to COVID-19 vaccines once supply is available for the general population. VaccineFinder will exchange data with the IZ Data Lake for the purposes of provider pre-enrollment, data analysis, and summaries via platforms such as the Data Storefront, HHS Protect, and HHS Tiberius. e. VTrckS: CDC’s Vaccine Tracking System is the platform for ordering all COVID-19 vaccines. VTrckS users will use the system to: • View vaccine allocations allotted to each program. • Place and/or manage vaccine orders for their providers. • Generate reports throughout the vaccine distribution process, from placing vaccine orders through distribution. VTrckS receives data from jurisdiction immunization registries and transmits data to these regisfries, VaccineFinder, and the IZ Data Lake. f. Provider system: A provider system is any platform used by a vaccination provider to track the administration and uptake of vaccine among their patient populations. Vaccination providers generally utilize an Electronic Health Record (EHR) to connect directly to liSs for vaccine uptake tracking. In some instances, vaccination providers will utilize a direct user interface (UI) to enter vaccination information directly into an uS UI portal. g. Other vaccine source: These are alternative sources (in addition to liSs and EHRs) that may store vaccination information about an individual. Examples include travel vaccination records, passports, vital records/birth records, Medicaid records, insurance claim information, etc. and their corresponding systems. 31 Page DUA/MOU: GOO4DOHT21 h. HHS Tiberius: Tiberius provides a COVID.19 vaccine distribution planning, tracking, modeling, and analysis ecosystem. Tiberius leverages the same technologies as the HHS Protect Platform (“HHS Protect”) and integrates data sources from federal agencies, state and local partners, private sector partners, and open data providers to create a comprehensive common operating picture for the COVID-19 vaccine planning, distribution, and administration effort. 2. Definitions: For purposes of this Agreement, the following definitions shall apply and may be used in the main body of the DUA and/or in relevant appendices: “Authorized User,” for purposes of this DUA, means an individual who, as part of directly supporting the ‘hole of government response efforts, has a need for data stored in the COVID- 19 Clearinghouse, the IZ Data Lake and/or the Tiberius platforms in furtherance of the purposes and uses set forth herein. Authorized Users will generally be employees, contractors, and/or other agents specified by Jurisdiction or federal agencies engaged in the response for purposes of addressing critical public health and emergency response activities, including assessing infrastructure needs and resource allocation. Authorized Users must adhere to applicable federal law and, as consistent and applicable the provisions set out in this DUA with respect to the data stored in the respective platforms. “Data Source,” for purposes of this DUA, is a Jurisdiction which, by and through an lIS and/or similar system(s) created to serve a range of administrative functions related to vaccines, provides Covered Data as set forth herein. Generally, the lIS or related system(s) will collect data from public and private health care provider organization e.g. EHRs, health information systems, (e.g., vital statistics, state Medicaid agencies, etc.), and pharmacies. “Covered Data” means the information that is being shared by the Data Source with each relevant platform as further described in Appendices A-D, but that is generally categorized into four primary datasets: the VAMS data, the COVID-19 Clearinghouse Data, the IZ Data Lake Data, and the Tiberius Data. FIHS and CDC acknowledge that the Covered Data to which each agency will have access is the mininium amount of information necessary to accomplish public health or emergency response needs. A list of Covered Data elements for each dataset is provided in Appendices A-D. Covered Data may be used by Authorized Users within the parameters set forth in this DUA. The data elements listed in Appendices A-D will be updated periodically as more information on COVID-19 immunization is available. The overall DUA will remain unaffected by subsequent updates. Appendices A-D also provide the mode and method of secure transmission of the data from the Jurisdiction’s uS or similar system(s) directly to the COVID-19 Clearinghouse; from the COVID-19 Clearinghouse to the IZ Data Lake; and from the IZ Data Lake to Tiberius. This information includes the potential availability and use of a privacy-preserving record linkage (PPRL) tool, which may be made available by HHS or CDC, either directly or by and through a contractor (Appendix E). Of note, data entering the COVID-19 Clearinghouse through the IZ Gateway will be governed by agreements between the uS jurisdiction and APHL. “Jurisdiction” means the state, territorial or local health jurisdiction operating under either statutory or regulatory authority to obtain and use health-related data for population health protection. For the purposes of this document, Jurisdictions are funded under CDC-RFA-1P19-1901 317 Notice of Funding Opportunity. 4Page DUA/MOU: GOO4DOHT2I “Immunization Information System” or “uS are confidential, population-based, computerized databases that record all immunization doses administered by participating providers to persons residing within a given geopolitical area. “Deidentified Data” means data that do not identif’ an individual and there is no reasonable basis to believe the information can be used to identi1’ an individual because the data have been rendered not identifiable in accordance with the HIPAA standards set forth in 45 CFR § 164.514. “Party” means a state, territorial or local jurisdiction or CDC; “Parties” means state, territorial, or local jurisdiction and CDC. “Privacy-Preserving Record Linkage (PPRL)” means the process whereby personally identifiable information (P11) is redacted from a patient/customer record using a one-way, irreversible encryption algorithm to create one or more unique tokens that replace P11 elements and allow data systems to match patient/customer records. PPRL is an industry standard that has been implemented and integrated across several data collection sectors where an individual’s privacy must be maintained (e.g., health care, biomedical research, payment and claims, retail, intelligence, social research, and public health). For COVID-19 immunization reporting, PPRL offers jurisdictions a mechanism to meet applicable jurisdiction regulations where data sharing with partners such as HHS and CDC may be limited. “Vaccine Administration Management System” or “yAMS” means the CDC-provided and supported web-based application that provides an option for a jurisdiction to plan and execute COVID-19 vaccine administration in a mass vaccination setting. VAMS has four users with multiple roles within each user module: l)jurisdictions can provide end-to-end mass vaccination capability and manage mass vaccination clinics; 2) healthcare providers can manage patient scheduling, vaccine administration workflow, and patient monitoring, support social distancing requirements with a scheduling feature, track vaccine inventory and usage, and include warnings when inventory is low; 3) employers/organizations can bulk input employees who will receive an email to register in VAMS; and 4) vaccine recipients can schedule vaccination appointments and receive appointment reminders. For purposes of this DUA, VAMS may be used to send data directly to the COVID-19 Clearinghouse or through the IZ Gateway either back to the Jurisdiction uS and/or to the COVID-19 Clearinghouse. The Jurisdiction lIS may choose to use VAMS or an alternate mechanism (e.g., state- based vaccination clinic solution) to transmit the data to the IZ Gateway and/or the COVID-19 Clearinghouse. 3. Description of Data Requested and Transmission Data Source agrees to provide data as described in Appendices A-D to and through platforms as indicated therein, subject to the terms and conditions included in this DUA and applicable to that option. 4. Data Use Terms The Data Source acknowledges and agrees that HHS, CDC, and Authorized Users may use the Covered Data transmitted to the various platforms as described in this DUA and Appendices A-D in furtherance of response activities related to the COVID-19 pandemic. This includes, at a minimum, the following activities: a. Analyze and visualize the Covered Data to which they have accessto improve the monitoring of vaccine and vaccine-related activities related to the COVID-19 pandemic response including vaccine safety and assessment of vaccine effectiveness; 5IPage DUAJMOU: GOO4DOHT21 b. Analyze and visualize the Covered Data to improve the monitoring of vaccine safety and assessment of vaccine effectiveness; c. As applicable to the platform, share the Covered Data and analyses thereof with official federal, state, local, tribal, and territorial government health agencies or other agencies and entities conducting their public health and vaccine response responsibilities consistent with applicable federal law and the terms of this DUA; d. Develop analytic methods using the Covered Data to identify immediate public health events or concerns at the federal, state, territorial and local level that warrant further public health investigation or immediate public health intervention actions; e. Enable Authorized Users, including public health and emergency response officials, to query the Covered Data within the HHS and CDC-provided data platforms as may be necessary to carry out critical public health functions; f. Share specified data elements with HHS Tiberius for the visualization of Vaccine Administration Data; and g. Publish findings and conclusions related to their analyses of the data provided. As appropriate, publications will acknowledge Data Source as the source of the data in any such publication. Given the emergent nature of the response, HI-IS and CDC may not be able to infonn or seek approval from Data Source for such publications but will coordinate as soon as possible and practicable. 5. Data Confidentiality and Security As applicable to the platform, HHS and CDC will establish appropriate administrative, technical, procedural, and physical safeguards to assure the confidentiality and security of Covered Data in their custody and control, consistent with federal requirements under the FISMA) and other applicable federal laws. The safeguards shall provide a level and scope of security that is not less than the level and scope of security established by applicable law for the type of data provided under this DUA. Where Covered Data provided pursuant to this DUA are identifiable or potentially identifiable, CDC agrees to maintain the confidentiality of the Covered Data to the fullest extent required by applicable law, which includes, as applicable, the Privacy Act of 1974; standards promulgated pursuant to), and the Freedom of Information Act (FOIA), including exemptions provided thereunder. Where required by law andlor where practicable, HHS and CDC agree to notify Data Source before releasing Covered Data to a third party pursuant to a judicial, governmental, or other request under law, to allow Data Source the opportunity to state any objection to the disclosure of the Covered Data. Transmission of the Covered Data by and through the various platfonns in the control of FIHS and CDC shall be done in accordance with acceptable practices for ensuring the protection, confidentiality, and integrity of the contents. Covered Data will be maintained and stored in compliance with CDC’s security policies and procedures and consistent with applicable law. Miscellaneous 1. Data Disposition: Data that havc bccn provided to HHS and CDC under this DUA will be archived, stored, protected, or disposed of in accordance with relevant federal records retention requirements. 2. Funding: This DUA is not an obligation or a commitment of funds, or a basis for a transfer of funds, and does not create an obligation or commitment to transfer data, but rather is a statement of understanding between the parties concerning the sharing and use of covered data. Expenditures by 61 Page DUA/MOU: GOO4DOHT21 ) each party are subject to its budgetary processes and to the availability of funds and resources pursuant to applicable laws, regulations, and policies. 3. Settlement of Disputes: Disagreements between the parties arising under or relating to this DUA will be resolved by consultation between the parties and referral of the dispute to appropriate management officials of the parties whenever possible. 4. Applicable Laws: U.S. federal law shall govern the construction, interpretation, and performance of this Agreement. Term of Agreement, Amendment, and Termination: I. The term of this DUA shall be one year commencing from the date of the final signature or the duration of the national emergency. The DUA may be renewed upon mutual written consent of the parties. 2. Except as otherwise expressly provided herein, this DUA may be amended only by the mutual written consent of the authorized representatives for each party. 3. This DUA may otherwise be terminated with ninety days’ advance notice upon written notice by either party. 4. Any notice required under this DUA nuist be in writing and sent by electronic mail with written acknowledgement of receipt to the email address for each party provided below. 5. Each party represents that the individual signing below on behalf of the party has the authorization to bind the party indicated to this DUA. This DUA may be signed in counterparts and signatures provided electronically will be deemed originals. CENTERS FOR DISEASE CONTROL AND PREVENTION AND DATA SOURCE By: Name: _Megan C. Lindley Title: Acting Associate Director for Science, CDCINCIRD/ISD Date: 11/06/2020 ______________ Email: MLindley@cdc.gov_____ WITNESSES 42d / 11/12/2020 2c 4 D-U4 >7/J ______ J.[sta E. Encarnacion, Commissioner Date Department of Health __________ b. 11/20/2020 Anthony9 Thomas, Commissioner Date Department of Property and Procurement APPROVED AS TO LEGAL SUFFICIENCY DEPARTMENT OF USTICE BY: _____________________________ 1 1/20/2020 7IPage DUAJMOU: GOO4DOHT21