ATT010_ TGD028_DataManagement.pdf

Controlled Unclassified Information TGD 028 June 2024

General Contractor Technical Guidance Document TGD #028

Defining WTC Health Program Data ORIGINAL PUBLICATION: June 17, 2024 DATE LAST REVIEWED: June 17, 2024

Purpose The WTC Health Program works with many vendors and contractors responsible for the care of WTC Health Program members and the security of their protected health information.

The following guidance has been issued to define “WTC Health Program data” and help ensure such data are securely stored and transferred only between or among authorized parties.

Stakeholders Affected All WTC Health Program Data Center vendors and their subcontractors with access to WTC Health Program data.

Background Generally, WTC Health Program contracts refer to vendors' requirements for data collection, transfer, and reporting.1 This TGD defines the term “WTC Health Program data” to provide clarity when the WTC Health Program is communicating about these contract requirements with Program vendors and their subcontractors. Any working papers, interim reports, data provided by the Government, data produced by the Contractor under the contract or collected or otherwise obtained by the Contractor under the contract, or results obtained or developed by the Contractor (including subcontractor or consultants) pursuant to the fulfillment of this contract are “WTC Health Program data” and are to be delivered, documented, and formatted as directed by the Contracting Officer. These examples do not constitute and exclusive list of "WTC Health Program data."

It is important that all data recognized as WTC Health Program data are accounted for because it ensures data are collected and maintained securely and can be accessed only by individuals who are authorized to do so (e.g., ePHI and PII accessed only by those authorized to receive such data).

Technical Guidance

WTC Health Program data are defined as:

All administrative and medical records related to WTC Health Program members. These records include administration and medical information created, collected, received/transmitted, stored/maintained, and/or otherwise managed as part of the administration of the WTC Health Program. Data can consist of documents, media, or machine-readable materials, regardless of physical form or characteristics, that are created or obtained by the WTC Health Program

1 See generally WTC Health Program Data Center (DC) Contract Performance Work Statement (PWS) for the Fire Department of New York (FDNY), New York City Health and Health and Hospitals Corporation (H&H), and Icahn School of Medicine at Mount Sinai (ISMMS) Contractors. Requirements for data collection, transfer, and reporting can be found in PWS Section C.4.

(whether by the federal government or through Program business vendors/contractors) conducting official WTC Health Program business.

These data can be contained in any form, including, but not limited to the following:

Electronic Storage and Services Defined as Any storage of electronic user data on a computer, computer network, or computer system. This includes data saved on these devices the devices themselves, and scripts that run on such devices.

Examples include, but are not limited to

Databases, ETL (extract, transform, load) scripts, scripts/code for generating reports and any documentation, file plan for document repository, templates/examples of all generated documents/reports, and any source code used.

Frequency of WTC Health Program data collection

Annually, bi-annually, monthly, weekly, ad hoc

Operations and Logistics Defined as Plans and documentation that provide a high-level overview of processes and business functions used that concern government data.

Examples include, but are not limited to

Process flows, operational manuals, sample data files, data analysis plans, submitted data requests, data request results/findings, and other documentation used to accomplish work on behalf of the WTC Health Program, system security plans, plans of action and milestones, incident response plans, data flow diagrams, data flow dictionaries, entity relationship diagrams, data schema, data dictionaries, and records retention schedule.

Frequency of WTC Health Program data collection

Annually, bi-annually, ad hoc

Daily Work and Administration of WTC Health Program Defined as All administrative and medical records (paper and electronic) pertaining to WTC Health Program members (this includes data that were provided or collected and may not have been directly used by the vendor/contractor.

Examples include, but are not limited to

Files, reports, logs, templates, correspondence (incoming and outgoing, electronic and hard copy), transcripts, claims, denials, appeals, surveys, completed forms (electronic and hard copy), incident reports, rosters with defined roles and responsibilities, training records, signed rules of behavior, member contact information (address, phone number, email address), medical records (medical health questionnaires [MHQs], exposure questionnaires, attendance sheets, monitoring exam lab results, pulmonary function test results, physical exam results from the monitoring exam), images, member vital status (including date of death if deceased), Communication channel records: social media (comment logs and account archives), public website (files, code, web forms, and analytics), and marketing emails.

Frequency of WTC Health Program data collection

Annually, bi-annually, monthly, weekly, ad hoc

Revision History Rev # Changes Made to Document Date

1 New Document 06/17/2024

WTC Health Program Approval The undersigned acknowledges they have reviewed this WTC Health Program technical guidance document (TGD) and agree with the approach it presents. Changes to this TGD will be coordinated with and approved by the undersigned or their designated representative(s).

Signature: Date:

Date_2: 6/17/2024