Applying for Secure Deduplication Tool for HIV Surveillance CDC-RFA-PS-24-0121

Please access the NOFO by searching “CDC-RFA-PS-24-0121” to complete your application package using


CDC monitors trends in HIV infection, evidence of HIV medical care, and viral suppression through the National HIV Surveillance System (NHSS). Due to migration, people living with diagnosed HIV may be reported to CDC by multiple states. Since NHSS is designed for redundancy of reporting from multiple sources to ensure complete reporting, deduplication of cases is a crucial activity to ensure accuracy of case counts. The purpose of this NOFO is to support a more efficient method for HIV surveillance jurisdictions to identify potential interstate duplicates. The recipient will develop and provide a secure, encrypted, ongoing secure data-sharing tool capable of identifying potential duplicates across jurisdictions. Developing this tool includes implementing necessary data security, confidentiality and privacy protections according to CDC standards, obtaining participation agreements with 59 state and local health department HIV surveillance programs, and reporting back to jurisdictions on matching levels in formats that are importable into state/local HIV surveillance data systems. This NOFO supports efforts to use HIV surveillance data to improve the health of populations disproportionately affected by HIV by improving the accuracy and completeness of the data. Accurate and complete data will maximize the health impact of public health services to reduce disease prevalence and promote health equity.


Timely resolution of duplicates is important because of the increased emphasis on using HIV surveillance data to link/re-engage people in HIV medical care. Delays in identification and resolution of duplicates can CDC supports state and local health departments to collect the surveillance data, which use the Enhanced HIV/AIDS Reporting System (eHARS) to submit de-identified surveillance data to CDC. Due to migration, people living with diagnosed HIV (PLWDH) may be reported to CDC by multiple states. To ensure complete reporting NHSS is designed for redundancy of reporting from multiple sources. To get accurate information on PLWDH, deduplication of the data must be conducted. A routine effort known as Routine Interstate Duplicate Review (RIDR) involves a jurisdiction-to-jurisdiction deduplication process based on a list of cases provided by CDC. Each jurisdiction conducts case-by-case reviews by phone with other jurisdictions and information for confirmed duplicates is entered in the case records and duplicate pairs are identified for merging during NHSS’s national data processing. Depending on the number of potential duplicates, the RIDR process can take months to complete and lead to wasted efforts in implementing and completing activities focused on linking and/or retaining people in care if a jurisdiction does not know that a person with diagnosed HIV has relocated to another jurisdiction. Given the urgent need for high quality and timely HIV case surveillance data, CDC is seeking to develop and implement efficient electronic tools for data sharing to enhance the deduplication process.

This work expands on a 2015 pilot project with health departments in three jurisdictions to develop a proof of concept for a secure, automated tool for matching HIV surveillance records NHSS. This tool used HIV surveillance data and a person-matching algorithm to determine the level of matching for a case-pair, comprised of a record from one jurisdiction paired with a record from another jurisdiction. The algorithm determined whether each case-pair was an ‘exact’, ‘high’, ‘medium’, or ‘low’ match. Based on the matching report, the pairs identified as ‘exact’ and ‘high’ matches could be resolved quickly. For the three jurisdictions, the algorithm identified over 80% of the potential duplicates in less than 30 minutes. In addition, the tool was able to identify duplicates across jurisdictions that had not been previously identified through the RIDR process. In 2016, eight jurisdictions participated in a second pilot to prove scalability of the tool, and CDC has continued to support the work for the last five years through PS18-1805.

The goal of NOFO PS24-0121 is to continue the successes of PS18-1805 to improve HIV surveillance data quality and to continue to support access to a secure, ongoing, automated data-sharing tool developed and implemented by the recipient that identifies duplicate HIV cases across HIV surveillance jurisdictions. In addition, PS-24-0121 aims to provide a proof a concept for a secure, server-to-server data sharing method to approximate data sharing between HIV surveillance data servers used by state and local health departments.

Bold indicates period of performance outcome.

Component A

Strategy 1: Comply with CDC policies and standards related to security and confidentiality.

Adoption and familiarity of the data security and confidentiality guidelines


Strategy 2: Support deduplication of cases.

– Collaborate with health departments for participation in a secure data sharing tool and provide training as needed.

– Provide a data sharing tool to allow for secure submission and matching of person-level HIV case surveillance data.

– Provide a matching algorithm based on HIV surveillance variables to determine the level of matching.


Strategy 3: Facilitate processing of results of duplicate review. 

– Provide feedback reports to jurisdictions on the matching levels of case pairs.

– Develop and deliver tab-delimited files with required case information for pairs determined to be “exact” matches.


Strategy 4: Monitor and evaluate

– Conduct routine monitoring of the matching process and outcomes and use to improve the efficiency of the matching process


Component B

Develop real-time novel method to identify duplicate cases.

– Develop a proof of concept for a secure, server-to-server data sharing application to approximate data sharing between data servers in local health departments.

– Assess feasibility for use of the application by health departments.

– Develop a plan to scale-up and deploy the application for potential widespread use by health departments.

– Develop a plan for ongoing maintenance of the application including costs.


Enhanced security of the data sharing tool.


Enhanced HIV case information sharing among participants.


Improved security of data sharing between HIV surveillance jurisdictions.


Improved resolution of duplicate reports.


Increased knowledge of the duplicate review process among health department staff.


Improved efficiency of the matching process.










Improved understanding of available secure data sharing methods to identify interstate duplicate case reports.


Improved data quality and completeness.


Reduced cost to perform interjurisdictional duplicate review.


Improved efficiency of duplicate review process.



Improved accuracy of local and national case counts.


Increased availability of high-quality HIV surveillance data to measure HIV prevention and care outcomes more accurately.


Enhanced use of surveillance data to support individuals through the HIV care continuum including data to care activities.




Eligibility for this NOFO is unrestricted.

Before applying

Applicant Informational Call

Due to technical difficulties encountered during the initial informational conference call, a second informational conference call will be conducted.

Topic: NOFO PS24‐0121 Applicant Informational
Call Time: April 10, 2024, 03:00 PM Eastern Time ﴾US and Canada﴿

Join ZoomGov Meeting
Meeting ID: 160 168 1106
Passcode: hsb2024!

How to apply

An organization must be registered at the three following locations before it can submit an application for funding at
PLEASE NOTE: Effective April 4, 2022, applicants must have a Unique Entity Identifier (UEI) at the time of application submission (SF-424, field 8c). The UEI is generated as part of registration. Current registrants have already been assigned their UEI and can view it in and Additional information is available on the GSA website,, and Finding the UEI.
a. Unique Entity Identifier (UEI):
All applicant organizations must obtain a Unique Entity Identifier (UEI) number associated with your organization’s physical location prior to submitting an application.  A UEI number is a unique twelve-digit identification number assigned through registration.  Some organizations may have multiple UEI numbers.  Use the UEI number associated with the location of the organization receiving the federal funds.
b. System for Award Management (SAM):
The SAM is the primary registrant database for the federal government and the repository into which an entity must submit information required to conduct business as a recipient. All applicant organizations must register with SAM, and will be assigned a SAM number and a Unique Entity Identifier (UEI).  All information relevant to the SAM number must be current at all times during which the applicant has an application under consideration for funding by CDC. If an award is made, the SAM information must be maintained until a final financial report is submitted or the final payment is received, whichever is later. The SAM registration process can require 10 or more business days, and registration must be renewed annually. Additional information about registration procedures may be found at and the Knowledge Base.

The first step in submitting an application online is registering your organization at, the official HHS E-grant Web site. Registration information is located at the “Applicant Registration” option at
All applicant organizations must register at The one-time registration process usually takes not more than five days to complete. Applicants should start the registration process as early as possible.


System Requirements Duration Follow Up
1 System for Award Management (SAM) 1. Go to and create an Electronic Business Point of Contact (EBiz POC). You will need to have an active SAM account before you can register on  The UEI is generated as part of your registration. 7-10 Business Days but may take longer and must be renewed once a year For SAM Customer Service Contact fsd-gov/ Calls: 866-606-8220
2 1. Set up an account in, then add a profile by adding the organization’s new UEI number.

2. The EBiz POC can designate user roles, including Authorized Organization Representative (AOR).
3. AOR is authorized to submit applications on behalf of the organization in their workspace.

Allow at least one business day (after you enter the EBiz POC name and EBiz POC email in SAM) to receive a UEI (SAM) which will allow you to register with and apply for federal funding. Register early!

Applicants can register within minutes.

Request Application Package

Applicants may access the application package at  Additional information about applying for CDC grants and cooperative agreements can be found here:

Application Package

Applicants must download the SF-424, Application for Federal Assistance, package associated with this notice of funding opportunity at

Submission Dates and Times

If the application is not submitted by the deadline published in the NOFO, it will not be processed. Office of Grants Services (OGS) personnel will notify the applicant that their application did not meet the deadline. The applicant must receive pre-approval to submit a paper application (see Other Submission Requirements section for additional details). If the applicant is authorized to submit a paper application, it must be received by the deadline provided by OGS.

Letter of Intent

The letter of intent is not required for this NOFO.

Application Deadline

Applications are due on May 1, 2024, Include the date and time (U.S. Eastern Standard Time) when the entire application must be submitted at Programs must allow applicants at least 60 days to submit the application after the NOFO is published, unless a deviation is approved.

11:59 pm U.S. Eastern Time, at If is inoperable and cannot receive applications, and circumstances preclude advance notification of an extension, then applications must be submitted by the first business day on which operations resume.

Frequently Asked Questions

1. Are we allowed to submit letters of support?

Additional documents will not increase your score and will likely not be reviewed.

2. Can there be more than one principal investigator?

Yes, there can be a co-principal investigator if necessary.

3. What is CDC’s recommendation for teaming? Specifically, can a performer consist of a team of organizations? Can you collaborate across multiple organizations?

Collaboration across multiple organizations is allowed. The applicant should assure that all roles and responsibilities of each participating organization are described in the application.

4. Is there a specific format for CVs beyond the 2-page criteria?

No, there is no specific format for CVs.

5. Is there more information about what a Memorandum of Agreement (MOA) or Memorandum of Understanding (MOU) would be for this? How does this pertain to component B?

An MOA/MOU is only needed if a particular health department requires one for participation in   the secure data sharing tool. We do not expect Component B to utilize state or county health department data. Because this component is a proof-of-concept project, no live data are required. An MOA/MOU would not be expected for component B.

6. Who is collaborating with the health departments on our project? Do we need to coordinate with the health care department to resolve any Data Use Agreement (DUA) issues related to data requests?

The recipient of the grant will be expected to collaborate with health departments conducting    HIV surveillance, including all issues related to Data Use Agreements.

7. During the course of performance, will CDC facilitate and provide contact information for partners within the 59 jurisdictions that conduct HIV Surveillance activities?

CDC will provide the contact information of all surveillance coordinators in the jurisdictions. CDC will announce to the jurisdictions that this grant has been awarded to the recipient and that the grantee may be reaching out to them. The recipient will need to reach out to discuss each jurisdictions’ participation.

8. If we are not doing component B with the state or county data and it’s a Proof of Concept, are there sample data sets or should we assume structure of the data sets?

It is possible that the technology could be delivered with a data set agnostic approach. The communication between the servers may not rely on the content of a sample data set that approximates the health departments’ setup for the eHARS application that is currently in use. If applicants would like to see a sample data set that approximates the eHARS application, it can be provided.

9. Does CDC require an architecture diagram to be included in the application to demonstrate how the applicant will develop a system to accomplish required program activities?

No, CDC does not require an architecture diagram. CDC does, however, allow for the inclusion of any information the applicant chooses to include to describe how the applicant will accomplish the required activities (subject to the posted page limits).

10. It says equipment is not allowed in the budget, if a specific server needs to be purchased is that allowed?

Page 30 Funding Restrictions states, “Generally, recipients may not use funds to purchase furniture or equipment. Any such proposed spending must be clearly identified in the budget.” If a specific server is needed, ensure that the expenditure and justification for the purchase are included in the application budget.

11. Do you want a detailed work plan for component B or is that supposed to just be a high-level overview plan?

Component B would fall into a subsequent year so it would be high level work plan. It should be included in your plan for year 2.

12. What are the chief concerns when it comes to security and privacy? Specifically, where do you see a lot of adversarial scenarios that might inform the solution?

There is a link in the NOFO to NCHHSTP’s Security and Confidentiality Guidelines for use of our data. We advise following those guidelines and keeping in mind the highly sensitive nature of HIV data.

13. In terms of the server-to-server component, are there any data requirements for what is demonstrated between the servers such as a CVS file or copying into the databases? 

There are no distinct parameters. The NOFO is asking for responses that are demonstrations of your program’s ability to allow server to server communication/sharing of data between servers that approximate that which would be used by HIV surveillance programs in participating health departments. Most health department servers are behind a firewall with limited access. We would like to see, in component B, approaches that allow for servers to communicate with each other to share, in real time or near real time, information between those servers. CDC would like to know through this NOFO if it is possible to do so, and if it is possible, how would one go about doing that. Additionally, CDC would like to learn how feasible is it for CDC to ramp up those activities to deploy to a solution to state/local/territorial and other health department agencies to be able to share information securely.

14. The NOFO specifies in a very detailed table what are the capabilities that could be developed for component A and component B, is there some information available on metrics related to time of operation, how long this process can take, is there a real-time requirement or is that something that’s an open question that can be addressed in the work plan?

It needs to be a tool that is available on a regular, ongoing basis. Whether your solution is available in real-time is something that can be discussed in your work plan.

15. Could you please provide clarification on what the data submission process entails? Are we expecting to develop a website for data submission, or should we share specific locations where data can be uploaded?

The main objective of the NOFO is to provide a solution for data to be shared securely to identity duplicate cases between health departments conducting HIV surveillance. The manner in which the applicant chooses to accomplish this objective should be described in the application.

16. Based on my understanding, the de-duplication and matching logic have already been developed. Could you confirm if this is accurate?

The objective of the NOFO is to provide an efficient method of identifying duplicate cases between health department HIV surveillance systems. This method does not need to be based on what has been done in previous funding opportunities. The applicant should describe their proposed method of deduplication in the application.

17. Can we gain insights into the HIV surveillance variables used to determine the level of matching?

Upon request a sample HIV surveillance data set can be provided to the applicant. In general, the HIV surveillance system includes variables on demographic characteristics, HIV-related laboratory results, HIV testing and treatment history, vital statistics, and previous duplicate review resolution.

18. Regarding the directive to “provide feedback reports to jurisdictions on the matching levels of case pairs,” are we matching person data with other adjudicators and delivering reports in the form of dashboards?

One of the required activities of the NOFO is to provide a report back to participating health departments on the matching level of identified potential duplicates. How this report is delivered should be described by the applicant in their application.


Technical Difficulties

 If technical difficulties are encountered at, applicants should contact Customer Service at The Contact Center is available 24 hours a day, 7 days a week, except federal holidays. The Contact Center is available by phone at 1-800-518-4726 or by e-mail at Application submissions sent by e-mail or fax, or on CDs or thumb drives will not be accepted. Please note that is managed by HHS.

 Paper Submission

 If technical difficulties are encountered at, applicants should call the Contact Center at 1-800-518-4726 or e-mail them at for assistance. After consulting with the Contact Center, if the technical difficulties remain unresolved and electronic submission is not possible, applicants may e-mail CDC GMO/GMS, before the deadline, and request permission to submit a paper application. Such requests are handled on a case-by-case basis.

An applicant’s request for permission to submit a paper application must:

  1. Include the case number assigned to the inquiry
  2. Describe the difficulties that prevent electronic submission and the efforts taken with the Contact Center to submit electronically; and
  3. Be received via e-mail to the GMS/GMO listed below at least three calendar days before the application deadline. Paper applications submitted without prior approval will not be considered.
    If a paper application is authorized, OGS will advise the applicant of specific instructions for submitting the application via email.

For programmatic technical assistance, contact:
Kristen Hess
Project Officer
Department of Health and Human Services
Centers for Disease Control and Prevention
1600 Clifton Rd NE; MS H24-5
Atlanta, GA 30329-4027
Telephone: 404-639-1555

For financial, awards management, or budget assistance, contact:
Edna Green
Grants Management Specialist
Department of Health and Human Services
Office of Grants Services
Chamblee Building 102, Mailstop, S102-1, Atlanta, GA 30341
Office of Grants Services (OGS) – Branch 1
Centers for Disease Control and Prevention
Telephone: 770-488-2858

For assistance with submission difficulties related to, contact the Contact Center by phone at 1-800-518-4726.
Hours of Operation: 24 hours a day, 7 days a week, except on federal holidays.
CDC Telecommunications for persons with hearing loss is available at: TTY 1-888-232-6348