1. June 14, 2012 Brief History of DOE’s Comprehensive Epidemiologic Data Resource (CEDR) Dr. Cliff Strader, HS-13 CEDR Program Manager US Dept of Energy Phil Wallace Manager, Information Technology Oak Ridge Associated Universities

2. Formation of CEDR Recommendation from SPEERA report in 1990 Data providers were ORAU, Los Alamos, and Hanford. Decision made to house CEDR at LBNL Many working groups in the initial effort to establish and define CEDR Working group eventually reduced to LBNL staff, DOE staff, one representative each from the 3 data providers, and Jack Fix of PNNL Goal to combine all epidemiologic data from the 3 DOE epidemiologic groups (data providers) into one publicly accessible resource

3. Formation of CEDR – con’t Decisions included contents, data access and permissions, who is responsible, etc. Early decision made to ensure data were de-identified – protecting individuals’ privacy essential All data initially submitted to CEDR were processed at ORAU to establish a pseudo-ID number for each worker and insert that pseudo-ID in all records for that worker Each of the 3 data providers prepared their own files with this pseudo-ID number on every record and submitted to LBNL Documentation prepared to define all data fields and explain all codes

4. Formation of CEDR – con’t Measures taken to protect workers’ privacy included elimination of: Name SSN Date of birth (masked to July 1 plus the year) Date of death (masked to July 1 plus the year) Date of hire (day masked to 15 plus the year) Date of termination (day masked to 15 plus the year) Badge numbers Vital status date (masked to July 1 plus year)

5. Formation of CEDR – con’t State Co-operation: All states contacted in initial CEDR development to seek their consent to use their data without review NYC gave emphatic NO Pennsylvania, Rhode Island, and Alabama asked to review each account request All other states gave tacit approval So, forms were created……….

11. Formation of CEDR – con’t LBNL staff continually monitored CEDR for potential vulnerabilities and brought concerns to advisory group for consideration CEDR was established before Internet access, so catalog was published and data requests manually prepared by LBNL staff and furnished on acceptable medium (diskette, CD) CEDR publicized using brochures and online bulletin boards where possible Data made accessible online when Internet established Online access required development of new method to allow access Initially 2 types of users – “general” user could only view data, but “authorized” user could actually download data

12. Structure of CEDR Contained both “Working Data” and “Analytic Data” Analytic data only from some later studies (e.g., ORNL update by UNC) Surveillance data from Former Worker Programs Bibliographic section – epidemiologic studies, links to CDC documents, Los Alamos Historical Document Retrieval and Assessment Naval shipyard data – requires separate account approval

13. Cybersecurity and CEDR CEDR was migrated from LBNL to ORISE in January 2010 For this program to reside at ORISE, an Authority to Operate (ATO) is required. ATO was in place when migration began Before CEDR could be placed into production, a Software Application Risk Assessment (SARA) had to be performed internally by ORAU’s Cybersecurity group Privacy Impact Assessment also conducted to examine system for PII / PHI and assess impact should breach occur CEDR production version went online June 30, 2010

14. Cybersecurity and CEDR User Accounts: Account requests are treated as OUO information Passwords distributed according to NIST 800-53 guidelines; changed on annual basis Notice there is a one-way data flow from CEDR to user Viewing data shows only 15 records, not the entire file All web site access is recorded Physical Protection and CEDR: Locked facility; triple layer of locks Data stored on ORISE network; backups performed per schedule

15. CEDR: What’s new? Look and feel of website updated Redesigned web page Better organized Greater visual appeal Easier site navigation More data, information

16. CEDR now has Data on 1,045,968 individuals Extensive bibliographic holdings related to data Updates on 8,923 workers to determine mortality status completed just a few months ago Analysis files identical to those used by former researchers permit confirmation of their analyses as teaching tool Free data updates on many people, not yet analyzed Sandia cohort hasn't yet been examined So, 100s of thousands of untapped data await interested researchers

17. Browsing CEDR the old way:

18. CEDR as it appears today:

19. CEDR open webinar planned: Focus on increasing awareness of resource Use data as teaching tool Engage students now in training in public health Improve the program through feedback from users

20. CEDR resources for teaching Mail contact with schools of public health to introduce program Distribute updated CEDR brochures to encourage interest Emphasize opportunities for teaching data analysis techniques, conducting research on exceptional data sets, publication of as yet minimally explored topics Potential use for MPH and PhD level research

21. Questions?