Worker Confidentiality Protection cont'd

DOE-STD-1187-2005

de-identified data, that is, names, addresses, and other personal identifying

information (such as social security numbers) are not included in the database.

The data are not available for use in research studies where investigators must

identify individuals. Please note that the Beryllium Registry is explicitly

exempt from Institutional Review Board review of research protocols under 10

CFR 745 section 101 (b)(4) that deals with Federal Policy for the Protection of

Human Subjects, as the subjects cannot be identified either directly or through

identifiers linked to subjects.

To maintain the confidentiality of Registry data, the Registry coordinator must

insure that a unique, encrypted identification number is assigned to every

worker included in the Registry. All information that is submitted to the

Registry regarding a specific worker must include his or her unique encrypted

identification number. As the health impact of beryllium exposure may not

occur until many years after employment, the Registry coordinator must insure

that a system is maintained that links a worker's identity to his or her unique

identification number, even after the worker terminates employment.

Unique encrypted identifiers should not be overly simplistic, such as reversing

the worker's social security number, and should not duplicate other existing

identifiers. The unique identifier should not be re-assigned to a different

worker, even if the first worker assigned to the identifier exits the workforce at

that respective site. Should this worker return to the workforce at this site, his

or her unique number should be restored to this specific individual. Sites that are

participating in the Illness and Injury Surveillance Program (IISP) should use

the previously assigned IISP identification number as the unique encrypted

identifier.

When a worker transfers from one DOE site to another, he or she will be

reassigned a new unique encrypted identifier, coded according to the current

site's encryption scheme. Former sites should advise the transferees to identify

themselves as a beryllium-associated worker to the site occupational medicine

director (SOMD) upon their arrival at the new site. The SOMD should also

determine if transferred workers were included in the Beryllium Registry at the

previous site. If so, the SOMD will contact the SOMD at the previous site to

obtain the old identification number so that linkages can be made.

To maintain the confidential nature of the Registry, 10 CFR 850.39 (e)(2)(i)

requires that the SOMD, or other designated site personnel within the

occupational medicine clinic, retain the encryption key that identifies an

individual worker to his or her unique identifier. Proper security, such as

restricted access and locked files, must be maintained.

Published reports using registry information will generally contain only

summary data. It is possible that descriptions of working conditions associated

with a specific case provide lessons that should be shared with others. Such