HomeMy WebLinkAbout2017-745-E Health - Family Success Alliance Master Data Sharing Agreement United Way DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Master Data-Sharing Agreement:
Orange County Family Success Alliance
February 2017
1
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Master Data-Sharing Agreement
between
United Way of the Greater Triangle (hereinafter, "UWGT")
and
Boomerang, Chapel Hill-Carrboro Public School Foundation, Childcare Services Association,The
Women's Center, Inc. (doing business as Compass Center for Women and Families), El Futuro,Girl
Scouts NC Coastal Pines,Chapel Hill Training Outreach Project, Inc. (doing business as KidSCope),
Orange County Literacy Council (doing business as Orange Literacy),Volunteers for Youth, and Orange
County Health Department (hereinafter, "Orange County FSA")
1. PURPOSE AND INTENDED USE OF DATA SHARING.The purpose of this Master Data-Sharing
Agreement (hereinafter, "this Agreement") is to facilitate the creation and maintenance of
individual level data sets entered by Orange County FSA and stored by UWGT, and the sharing of
subsidiary identifiable, de-identified, or restricted-use data sets for the use of approved staff of
Orange County FSA for tracking individual and family participant characteristics, program
participation, and outcomes. Participation in this Agreement on the part of the Orange County FSA
entails providing individual-level and individually identifiable data to UWGT for linkage with similar
data from Orange County FSA.These data could be used for the following purposes provided that:
i. appropriate consent or authorization has been obtained from the individual or the
individual's parent or guardian as specified in Attachment E;
ii. a role-based access control is assigned as specified in Attachment A;
iii. access to individual level data is limited to persons who sign the confidentiality
statement in Attachment 6; and
iv. appropriate request-specific written consent or authorization has been obtained
from Orange County FSA and all appropriate parties to this agreement for any
individually identifiable data requests.
a. For inclusion in UWGT case management system Efforts to Outcomes, (hereinafter, "the
database") which is used by UWGT and its Partners to coordinate, manage, track, and report
on the services funded by UWGT and provided by its partners to individuals and families.
Orange County FSA authorizes UWGT to share personally identifiable information received
from Orange County FSA to the entities shown in Attachment C to this Agreement.
b. For research and evaluation purposes to study and report on the impact of UWGT on
individuals and families within this collaborative effort.
c. To aggregate and compare with other collaborative efforts supported by UWGT and its
partners. Data used for these purposes is limited to the following, unless request-specific
written consent from UWGT and Orange County FSA is obtained:
i. aggregated summary indicators of participant characteristics, program
participation, and outcomes
ii. de-identified, individual-level data and information on participant characteristics,
program participation, and individual outcomes.
2
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
d. For reporting measures of participant characteristics, program participation, and outcomes
to potential UWGT funders and partners. Data reported to these potential funders and/or
partners is limited to:
i. aggregated summary indicators of participant characteristics, program
participation, and outcomes
ii. de-identified, individual-level data and information on participant characteristics,
program participation, and individual outcomes.
2. PERIOD OF AGREEMENT.This Master Data-Sharing Agreement shall be in effect for the duration of
UWGT initiative, or until terminated in writing by either UWGT or Orange County FSA, as set forth in
Section 11 of the agreement.
3. DESCRIPTION OF DATA.
a. Master Data Set. Data shared by Orange County FSA and UWGT under this Agreement shall
be limited to the data elements specifically defined and authorized by UWGT and Orange
County FSA in this Agreement, as listed below.The specific record and file formats of the
Master Data Set will be as negotiated between designated representatives of Orange
County FSA and UWGT. Orange County FSA and UWGT agree to make their best efforts to
provide any updates to the Master Data Set in a consistent, agreed-upon record and file
format. Data elements shared by Orange County FSA and UWGT under this Agreement
include program specific data, performance assessments, and records from Orange County
FSA service providers, including:
i. Intake information collected on participants (such as name, address, and date of
birth)
ii. Participation data (such as services received, attendance dates, and length of time
participating)
iii. Program results and assessments (such as tests results, notes, and observations by
program staff)
b. Adding to the Master Data Set. Subject to applicable law, and provided there is mutual
agreement of the Parties to this Agreement, content of the Master Data Set(s) may also
include other records mutually agreed upon by the Orange County FSA and UWGT to be
necessary and appropriate for the proper execution of this Master Data-Sharing Agreement
or any approved Data Use Agreement executed under this Master Data-Sharing Agreement.
4. CUSTODIAL RESPONSIBILITY AND DATA STEWARDSHIP.
a. The parties mutually agree that UWGT will be designated as Custodian of the raw and linked
data sets and will be responsible for the observance of all conditions for use and for
establishment and maintenance of security arrangements as specified in this Agreement to
prevent unauthorized use.
3
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
b. UWGT management will be responsible for oversight and review of the provisions and
requirements of this Agreement.
c. Unless otherwise stated or modified in this Agreement, data will be managed, linked, and
stored as specified in Attachment D to this Agreement.
d. UWGT is hereby informed and agrees that the Orange County FSA will release data under
this Agreement only upon the condition that UWGT will not disclose the information to any
other party not listed in Attachment C and will not use the information for any purpose
other than the purposes specified in this agreement. Further, UWGT agrees to fully
cooperate with Orange County FSA in the event that an adult individual or the parent or
guardian of a child under 18 years old requests the opportunity to review his/her personally
identifiable information disclosed to UWGT by Orange County FSA or wishes to revoke their
consent to data sharing with UWGT. UWGT also agrees to notify Orange County FSA in the
event it obtains a revocation of consent to share data with UWGT, or a request to review
personally identifiable information stored by UWGT from an adult or parent/guardian of a
child under 18 years old.
e. Orange County FSA agrees not to release any data it receives from UWGT as a result of its
participation in this Agreement to any third parties not specifically authorized to have access
to such data under this Agreement.
5. ROLES AND RESPONSIBILITIES. UWGT agrees to provide appropriate staff support to execute its
data stewardship, data management, custodial responsibilities, and analysis under this Agreement.
Orange County FSA agrees to provide appropriate staff support to create, manage, and record the
necessary data for the purpose of the database.
a. The following UWGT staff members are assigned to roles related to the proper
management, processing, and distribution of the data under this Agreement, as described in
Attachment D, Section 1,to this Agreement.
Role Name,Title,& Contact Information
Organization
ETO Enterprise Edwin Jeffords, CIO, eieffords@unitedwaytriangle.org
Administrator UWGT
ETO Site Manager Nick Allen, Community nallen@unitedwaytriangle.org
Impact Director, UWGT
6. PERMISSIBLE DATA USE, LINKING AND SHARING UNDER THIS AGREEMENT. All data shared as part
of this Agreement and any related Data Use Agreements becomes the property of UWGT after being
entered into the database.This Agreement represents and warrants further that data covered under
this Agreement shall not be disclosed, released, revealed, showed, sold, rented, leased, or loaned to
any person or organization except as (1) specified herein, (2) approved in an executed Data Use
4
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Agreement, (3) otherwise authorized in writing by UWGT and Orange County FSA, or(4) required by
law. Access to the data covered by this Agreement shall be limited to the minimum number of
individuals necessary to achieve the purpose stated in this section and to those individuals on a
need-to-know basis only. Each person not employed by UWGT or a member of Orange County FSA
who is authorized to receive personally identifiable information shall sign Attachment B
acknowledging that s/he shall comply with the restrictions within this Agreement on disclosure of
such data. Notwithstanding these exceptions, UWGT understands and agrees that it will not, under
any circumstances, disclose personally identifiable information from the records it receives from
Orange County FSA to any other party not subject to this Agreement without prior written consent,
and UWGT understands and agrees that it will not use the information for any purpose other than
the purposes for which the disclosure was made. UWGT also agrees and understands that Orange
County FSA shall receive written notice of any use or disclosure made with such consent.
a. Authorized Linkage and Data Transfers of Data-Contributing Organizations for Program
and Site Management. Access to limited identifiable individual-level data will be restricted
to a tightly controlled data stream of"need to know" users at end service points and
carefully selected organizational administrators to see this data. Only records with a signed
consent or authorization agreement (included in this Agreement as Attachments E and F)
will be transmitted for this purpose.
b. Authorized Linkage and Data Transfers of Data-Contributing Organizations for Research
and Evaluation. Uses of this data apply only to de-identified data for use in evaluating the
overall and community impact of UWGT program components overtime.
c. Termination. In the event of the termination of the Master Data-Sharing Agreement
between UWGT and Orange County FSA or otherwise specified in the Master Data-Sharing
Agreement, UWGT shall:
i. Provide a complete copy of the Master Data Set to Orange County FSA
ii. Provide appropriate subsets of Master Data Set to data-contributing organizations,
including those currently and/or previously involved with Orange County FSA
iii. De-identify any personally identifiable data within the site, entered during this
agreement and
iv. Certify in writing within five (5) business days that all personally identifiable data
stored on local servers, backup servers, backup media, or other media have been
permanently de-identified.
d. Termination of Data-Contributing Organization or Revocation of Consent. In the event of
the termination of the Master Data-Sharing Agreement between UWGT and one or more,
but not all, Orange County FSA data-contributing organizations, UWGT shall provide
appropriate subsets of Master Data Set to the relevant data-contributing organization(s)
terminating their participation in the Agreement.
e. Disposition of Data upon Revocation of Consent by Client or Client's Guardian. In the event
of the revocation of consent by a client or the legal guardian of a client, UWGT shall:
5
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
i. Provide a complete copy of the client's personal records upon request
ii. De-identify any personally identifiable data within the site, entered during this
agreement and
iii. Certify in writing within five (5) business days that all personally identifiable data
stored on local servers, backup servers, backup media, or other media have been
permanently de-identified.
7. RESOURCES AND COSTS OF DATA SHARING AND DATA MANAGEMENT. Costs for staff time and to
execute this Agreement will be provided for by each participating partner.
8. NO WARRANTY FOR DATA OR LINKAGE QUALITY. Both the accuracy of record linkage and the
utility of administrative data for research and analytical purposes are dependent on the quality and
consistency of the source data. Although UWGT will use reasonable efforts to promote accurate
record linkage and the creation of appropriate data sets for analysis, no warranty is made as to the
achievement of any particular match rate nor as to the ultimate accuracy or utility of any data
contributed under this Agreement.
9. INDEMNIFICATION.The parties agree that statutory and common law theories and principles of
liability, indemnification, contribution, and equitable restitution shall govern all claims, costs,
actions, causes of action, losses, or expenses (including attorney fees) resulting from or caused by
the actions or omission of the parties hereto. Furthermore, if either party becomes aware of a claim
involving the other within the relationship,the party with knowledge of the claim shall inform the
other part in writing within ten (10) days of receiving knowledge of the claim, demand, or other loss.
10. PUBLICATION AND DISSEMINATION OF RESULTS. UWGT shall provide Orange County FSA access to
written reports, analysis, or visuals produced or derived in whole or in part from Orange County FSA
data.
11. TERMINATION AND MODIFICATION OF THIS AGREEMENT. UWGT and the Orange County FSA may
amend this Agreement by mutual consent, in writing, at any time.This Agreement may be
terminated at any time by either party with thirty(30) days' written notice. Upon termination of this
Agreement, UWGT will anonymize Orange County FSA data as specified in Attachment D to this
Agreement unless otherwise specified in an attachment to this Agreement.
6
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
12. SIGNATURES. By the signatures of their duly authorized representatives below, UWGT and Orange
County FSA agree to all of the provisions of this Master Data Sharing Agreement and execute this
Agreement effective with this signing.
DocuSigned by:
C70232C560654CB...
Signature
Edwin Jeffords,CIO and Senior Vice President
United Way of the Greater Triangle
EDocuSigned by: DocuSigned by:
�6VAOL rVislkw6V E C-�41h�
073B8221A51F422.. OC298F75CF6B475...
Signature Signature
Sonia Frischemeier,Director of Operations Lynn Lehmann,Executive Director
Boomerang Chapel Hill-Carrboro Public School Foundation
qq DocuSigned by: tber DocuSigned by:
A.G�IA.A l �ly�^ LNirbia' h"
06000018401`8472... 20A8CC451`3494C5...
Signature Signature
Anna Carter,President Cordelia Heaney,Executive Director
Childcare Services Association The Women's Center,Inc.
DocuSigned by: DocuSigned by.
+ A ember SO, 5 lember
C2E60264B503461... IbI30747698CICCA131
Signature Signature
Luke Smith,Executive Director Lisa Jones,Chief Executive Officer
EI Futuro Girl Scouts NC Coastal Pines
DocuSigned by: DocuSigned by:
11(ib,
����}A.� per Aember
• e� " NII 'Oeo".
9B71DAAC75A85490... 5BE44E1871`813412...
Signature Signature
Mike Mathers,Executive Director Alice Denson,Executive Director
Chapel Hill Training Outreach Project,Inc. Orange County Literacy Council
DocuSigned by:
43BT86356C�� DocuSigned by:
B F F 4 E 6 Eti!B w545lE .A r Signature Signature
Susan Worley,Executive Director Colleen Bridger,Health Director
Volunteers for Youth Orange County Health Department
7
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Master Data-Sharing Agreement
Attachment A: Role-Based Data Access Controls
The matrix below identifies and describes covered organizations by role, access, and functions in the
Orange County Family Success Alliance.The parties agree that any modifications or additions to this
attachment will require prior approval by the UWGT and Orange County FSA members.
Organization Access Level Functions
Social Solutions Group Software Provider • Update and patch software
• Full access to data • Regular software
contained in all sites, maintenance, backups, and
including Orange County support
FSA site.
UWGT Enterprise Administrator • Create and edit touchpoints
• Full access to data • Assign enterprise-level user
contained in all sites, roles and permissions
including Orange County • Manage organizations, sites,
FSA site. and programs across the
enterprise
• Manage Site Administrators
• Aggregate and de-identify
data for enterprise-level
reporting
Reporting Manager • Creating and distributing
• Limited access to data reports
contained within the • Aggregate and de-identify
Orange County FSA site. data for enterprise-level
reporting
Orange County Health Site Manager • Create and edit
Department(Backbone Staff) • Full access to data touchpoints, dashboards,
contained within the and reports
Orange County FSA site. • Assign site user roles and
permissions and accounts
• Enter data into touchpoints,
demographics, and
individual records
• Overall management of
records from all sources
• Creating and distributing
reports
• Manage participants,
entities, referrals,
collections, surveys, and
families
• Data deduplication within
8
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
site
Boomerang Program Manager • Enter data into touchpoints,
Chapel Hill-Carrboro Public demographics, and
School Foundation individual records
Childcare Services Association • Practice Data Security
Compass Center Protocols
EI Futuro • Create and view program-
Girl Scouts NC Coastal Pines level dashboards
KidSCope • Manage participants,
Orange Literacy entities, collections,
Volunteers for Youth surveys, referrals, and
Orange County Health families
Department(Program Staff) • View Site-level reports
9
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Master Data-Sharing Agreement
Attachment B:Staff Confidentiality Pledge Assurance of Confidentiality
UWGT and Orange County FSA assures all individual participants that the information they release to the
UWGT and Orange County FSA will be held in the strictest confidence and that such information will only
be disclosed to authorized persons in a specified manner.Access to Orange County FSA data is by
consent of the participants who have been guaranteed confidentiality and assured that their personally
identifiable information will only be used in a manner consistent with the terms of their consent.
I have carefully read and understand this assurance that pertains to the confidential nature of all
information and records to be handled by Orange County FSA. I have read a copy of the Master Data-
Sharing Agreement, and I understand that I must comply with all of the requirements of that plan.As an
employee of , I understand that I am prohibited from
disclosing any such confidential information which has been obtained from Orange County FSA or UWGT
to anyone other than authorized staff, and I agree to follow the data security procedures outlined to me
during training. I understand that any willful and knowing disclosure of information released to this
study may subject me to disciplinary action, up to and including termination of employment.
Printed Name
Signature
Organization
10
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Master Data-Sharing Agreement
Attachment C: Data-Contributing Organizations and Contact Information by Role
Pursuant to Sections 1, 3b, and 6b of the attached Agreement, Master Data Sets shared by Data-
Contributing Organizations in the execution of this Agreement will be linked and shared, using the role-
based access rules specified in Attachment A to this Agreement,with the following individuals and
partner organizations.
The parties agree that any modification or addition to Attachment C will require prior approval and
written notification by UWGT and Orange County FSA.
First Last Name Organization Role Position Email Phone
Name
Allison Young Orange County Site Manager Health ayoung@orangecountync.gov 919-245-
Health Informatics 2409
Department Manager
Juliet Sheridan Orange County Site Manager APHIF Fellow iheridan@orangecountvnc.gov 919-245-
Health 2081
Department
Nick Allen UWGT Reporting Community nallen@unitedwaytriangle.org 919-463-
Manager Impact 5002
Director
Edwin Jeffords UWGT Enterprise C.I.O. eieords@unitedwaytriangle.org 919-463-
A1 5001
Sonia Frischemeier Boomerang Program Director of Sonia.frischemeier@boomerangvouth.org 919-968-
Manager Operations 2146
Nancy Zeman Chapel Hill- Program Program nzeman@chccs.kl2.nc.us 919-967-
Carrboro Public Manager Services 8211 ext.
School Foundation Manager 28376
Vivian Eto Childcare Services Program Senior Viviane@childcareservices.org 919-403-
Association Manager Director of 6950
Family
Support
Ardith Burkes The Women's Program Associate programsdirector@compassctr.org 919-968-
Center,Inc. Manager Director 4610
Sarelli Rossi EI Futuro Program Associate grossi@elfuturo-nc.org 919-688-
Manager Director 7101 ext.
603
Jenal Austin Girl Scouts NC Program Grants and jaustin@nccoastalpines.org 919-600-
Coastal Pines Manager Research 6310
Manager
Linda Foxworth Chapel Hill Program KidSCope Ioxworth@kidscope.chtop.org 919-644-
Training Outreach Manager Director 6590 ext.
Project,Inc. 4810
Alice Denson Orange County Program Executive adenson@orangeliteracy.org 919-914-
Literacy Council Manager Director 6153
Susan Worley Volunteers for Program Executive susan@volunteersforyouth.org 919-967-
Youth Manager Director 4511
Data Specialist Orange County Program Data Entry
Entry Health Manager Specialist
Department
Coby Austin Orange County Program Director of caustin@orangecountync.gov 919-245-
Health Manager Programs 2070
Department and Policy
Meredith McMonigle Orange County Program Program mmcmonigle@orangecountVnc.gov 919-245-
Health Manager Manager 2071
Department
11
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Master Data-Sharing Agreement
Attachment D: Standard Protocols and Procedures for the Use, Management,and Custodial
Responsibilities for Identifiable and Linked Data Sets
This document describes protocols and procedures for the use, management, and custodial
responsibilities for United Way of the Greater Triangle (hereinafter, "UWGT") and Boomerang,Chapel
Hill-Carrboro Public School Foundation,Childcare Services Association,The Women's Center, Inc. (dba
Compass Center for Women and Families), El Futuro,Girl Scouts NC Coastal Pines,Chapel Hill Training
Outreach Project, Inc. (dba KidSCope), Orange County Literacy Council (dba Orange Literacy),
Volunteers for Youth, and Orange County Health Department(hereinafter, "Orange County FSA")when
accessing data meeting one or more of the following criteria:
• Data are in the form of individual records containing personally identifying information;
• Data are HIPAA or FERPA protected;
• Data are shared by one or more Orange County FSA member(s)with the understanding and
intent that records from the contributed data sets will be linked with records from other Orange
County FSA Partners; or
• Data were provided under the terms of a Master Data-Sharing Agreement between UWGT and
Orange County FSA and/or through obtaining consent or authorization from individuals to
disclose their data.
This document will act as a core component to all agreements entered into between UWGT and Orange
County FSA, in which data meeting any of the above criteria are shared and will define how individual-
level data will be secured and managed.
POLICY AND PROCEDURES FOR DATA SHARING
1.Terms and Definitions.
1.1. User. Includes any person with access to covered data.Teachers and site coordinators are
considered users.
1.2. Public Information is information that can be freely given to anyone.
1.3. Sensitive Information is all other information which is confidential, private, personal, or
otherwise sensitive in nature. Sensitive Information includes the following:
1.3.1. Personally Identifiable Information includes an individual's name; address; date of birth;
social security number; driver license or state ID number; student ID number assigned by a
school district, local education agency, or state education agency;financial account number with
the associated PIN; and DNA or any biometric identifier.
1.3.2. Legislatively Protected Data are data subject to some government regulation or
oversight.This includes, but not limited to, data as defined under
• The Family Educational Rights and Privacy Act (FERPA)—student education
records
12
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
• The Health Insurance Portability and Accountability Act (HIPAA)—individually
identifiable health information.
1.4 Other Sensitive Data are data where unauthorized disclosure could lead to a business,
financial, or reputational loss. Examples include all intellectual property, research results, or
information protected by a confidentiality agreement.
2. User Roles and Functions in Relation to Covered Data. For any Master Data-Sharing Agreements
executed under the terms of this document, UWGT and Orange County FSA will assign (where
applicable) an appropriate and qualified staff member for any of the following roles. UWGT and Orange
County FSA will inform each other in writing of the staff member(s) assigned to each role as well as to
any changes in staffing for these roles. Parties agree that roles specified below may be performed by
one or more staff.
2.1. Enterprise Administrator.The Enterprise Administrator will be primarily responsible for(1)
creating and maintaining sites within the database, (2) assigning Site Manager permissions and
accounts, (3) performing deletion or de-identifying of covered Master Data Sets upon
termination of applicable agreements.The Enterprise Administrator reports any compliance
issue or breach directly to the Site Manager(s).
2.2 Reporting Manager. The Reporting Manager will be responsible for(1) site-level data
reporting and aggregation of data, (2) managing data requests from Site or Program Managers,
and (3) communicating reporting needs to Site and Program Managers and coordinating timely
aggregate reporting. The Reporting Manager requires full aggregate level access to data, but
not necessarily access to individual-level data. The Reporting Manager reports any compliance
issue or breach directly to the Enterprise Administrator.
2.3. Site Manager.The Site Manager is responsible for the day-to-day management of data
released under this Agreement including tasks related to preserving the confidentiality and
security of identifiable information. In addition,the Site Manager is responsible for obtaining
and maintaining all signed forms currently required under this Agreement and for training staff
with access to data covered under this Agreement.The Site Manager requires access to
personally identifiable information.The Site Manager reports any compliance issue or breach
directly to the Enterprise Administrator.
2.4. Program Manager.The Program Manager is responsible for program-related data entry
tasks and requires full program-related access to individual records, but not necessarily full site
access to individual data.The Program Manager reports any compliance issue or breach directly
to the Site Manager.
2.5. Software Provider.The Software Provider is responsible for providing database software
used to store, manage, and/or report Orange County FSA and UWGT data.The Software
Provider will need access to the data to provide ongoing maintenance and service functions.The
Software Provider reports any compliance issue or breach directly to the Enterprise
Administrator.
3. Data Set Creation and Delivery
13
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
3.1. All creation, use, and/or transmittal of linked, de-identified, and/or limited data sets
created under this Agreement is subject to the specific terms of the Master Data-Sharing
Agreement and any applicable Data Use Agreements. Under no circumstances will any data sets
subject to the terms of this document be released to any party(including use by Orange County
FSA members) unless (a)the proposed use of the data set is explicitly authorized, either as part
of Master Data-Sharing Agreements executed by the UWGT and Orange County FSA or by the
execution of an approved Data Use Agreement covering the proposed Program and Site
Management uses of the limited data set by all Orange County FSA members whose data are
included in the data set requested; and Orange County FSA approval is obtained for the
proposed Program and Site Management uses of the limited data set.
3.2. UWGT will transmit covered data in electronic form to the Software Provider via secure file
transfer protocol procedure.
3.3.The Software Provider provides access to covered data in electronic form to the UWGT and
Orange County FSA via a web-enabled password-protected site.
4. Confidentiality and Data Security Safeguards
4.1. UWGT and Orange County FSA agree to establish appropriate administrative, technical, and
physical safeguards to protect the confidentiality of the data and to prevent unauthorized use or
physical or electronic access to it, and to report violations of this Agreement. Appropriate
administrative,technical, and physical safeguards include, but are not limited to
4.1.1. Users must not save Sensitive Information on personal computers that are not
approved for storage of such information. If Sensitive Information is stored on a
personal computer,then all reasonable safeguards and security procedures shall be
employed.
4.1.2. Users shall put in place reasonable safeguards and security procedures for its
environment, including, but not limited to, using password-protected computers,
prohibiting password sharing among users, prohibiting unauthorized data downloads
and distribution of data; requesting that users do not leave computer unattended
and/or set a timeout to lock an unattended computer, installing antivirus software with
current updates and a supported operating system with current patches and updates.
4.1.3. UWGT and Orange County FSA shall provide periodic training for staff on internal
security policies and procedures, and on applicable state and federal legal requirements
for protecting the privacy of individuals.
5.Compliance
5.1. Compliance to this Agreement includes, but is not limited to
5.1.1.A confidentiality statement form included as Attachment B to this Agreement and
signed by UWGT and Orange County FSA staff acknowledging that s/he shall comply
with the restrictions within this Agreement on disclosure of such data, and will not use
the information for any purpose other than the purpose for which the disclosure was
made.
14
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
5.1.2. Integrity Audits.To ensure compliance of this Agreement and the protection of
Sensitive Data, UWGT Enterprise Administrator or appointed staff reserve the right to
make unannounced visits to UWGT or Orange County FSA members for the purposes of
inspecting computer equipment and reviewing the security arrangements that the Site
Managers are maintaining with respect to Sensitive Information. UWGT staff and
Orange County FSA Managers will fully and promptly cooperate with the UWGT
Enterprise Administrator or appointed staff, and will assist them in completing those
inspections.
5.2. UWGT or Orange County FSA may temporarily suspend, block, or restrict access to Sensitive
Information when it reasonably appears necessary to do so to protect the integrity, security, or
functionality of Sensitive Data or to protect the organization from liability.
5.3. Statutory Breaches. If at any time a UWGT and Orange County FSA staff member
determines that there has been a breach of the security protocols or violation of this Agreement
(including, but not limited to any unauthorized release, access use, or modifications of covered
data),the staff shall promptly take such reasonable steps as are necessary to prevent any future
similar breaches and promptly notify the UWGT Enterprise Administrator and the Site Managers
of the breach.The UWGT and Orange County FSA Site Managers and/or Program Managers will
identify the steps taken to prevent any future similar breaches and report to the UWGT
Enterprise Administrator within 24 hours of their discovery.
5.4. Reported Violations.The Orange County FSA Site Manager will issue a report identifying
any privacy and security breaches on covered data by a staff member of UWGT or Orange
County FSA.The organization where the breach occurred will have three (3) business days to
comply and put in place corrective measures to prevent any future similar breaches. Failure to
comply within this time frame will result in temporary or permanent termination of access to
covered data and possibly termination of this Agreement.
5.4.1. Following a breach of sensitive information, affected individuals must be notified
of the breach. These individual notifications must be provided without unreasonable
delay and in no case later than 60 days following the discovery of a breach and must
include,to the extent possible, a brief description of the breach, a description of the
types of information that were involved in the breach,the steps affected individuals
should take to protect themselves from potential harm, a brief description of what
UWGT is doing to investigate the breach, mitigate the harm, and prevent further
breaches, as well as contact information for UWGT and Orange County FSA.
6. Disposition of Data at Termination of Agreement. In the event of the termination of the Master
Data-Sharing Agreement between UWGT and Orange County FSA or otherwise specified in the
Master Data-Sharing Agreement, UWGT shall:
i. Provide a complete copy of the Master Data Set to Orange County FSA
ii. Provide appropriate subsets of Master Data Set to data-contributing organizations,
including those currently and/or previously involved with Orange County FSA
15
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
iii. De-identify any personally identifiable data within the site, entered during this
agreement and
iv. Certify in writing within five (5) business days that all personally identifiable data
stored on local servers, backup servers, backup media, or other media have been
permanently de-identified.
6. Disposition of Data at Termination of Data-Contributing Organization(s). In the event of the
termination of the Master Data-Sharing Agreement between UWGT and one or more, but not all, of
Orange County FSA's data contributing organizations, UWGT shall provide appropriate subsets of
Master Data Set to the relevant data-contributing organization(s)terminating their participation in
the Agreement.
7. Disposition of Data upon Revocation of Consent by Client or Client's Guardian. In the event of
the revocation of consent by a client or the legal guardian of a client, UWGT shall:
i. Provide a complete copy of the client's personal records upon request
ii. De-identify any personally identifiable data within the site, entered during this
agreement and
iii. Certify in writing within five (5) business days that all personally identifiable data
stored on local servers, backup servers, backup media, or other media have been
permanently de-identified.
16
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Master Data-Sharing Agreement
Attachment E: Consent Agreement for Data Disclosure and Sharing
Orange County FSA Consent Agreement for Data Disclosure and Sharing
By signing this agreement,you give your consent to disclose and share personally identifiable
information on the person listed below with authorized partners in Orange County FSA.The purpose of
sharing this information is to allow Orange County FSA to provide well-informed,coordinated services to
participants and their families,to conduct ongoing evaluation and improvement of programs to better
serve the community, and to report results of programs and activities to residents, partners, and
funders.
Orange County FSA takes every precaution to protect personally identifiable information from
unauthorized use or disclosure. Information obtained on persons shall not be published in a manner that
will lead to the identification of any individual.This information is used solely for service provision and
program evaluation purposes and identified information shall not be further re-disclosed to third parties
not covered by this Consent Agreement without your prior written consent.
I understand that the records to be disclosed and shared with Orange County FSA may include but are
not limited to
• Education records from Orange County Schools &Chapel Hill Carrboro Schools
• Enrollment information
• Grade reports
• Demographic information such as gender, economic status, disability status, English learner
• Standardized test scores
• Post-secondary enrollment information
• Transcripts
• Classroom performance/behavior
• Attendance
Program specific data, performance assessments, and records from Orange County FSA service
providers, including
• Intake information collected on participants(such as name, address, and date of birth)
• Participation data (such as services received, attendance dates, and length of time participating)
• Program results and assessments (such as tests results and observations by program staff)
I consent to the disclosure of the personally identifiable information described above to the Orange
County FSA entities and partners.
Furthermore, I consent that the following parties may obtain the information described above stripped
of any and all direct identifiers:
• The U.S. Department of Education and its authorized contractor(s)
For up-to-date information and questions, please go to
http://www.orangecountync.gov/departments/health/FSA.Php or contact the Orange County FSA data
17
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
manager . Signing this Agreement constitutes the granting of consent for
disclosure of protected education information under the Family Educational Rights and Privacy Act
(FERPA).
Please complete sections A or B, as appropriate, and sign C below.
A. For Parent/Guardian of child under 18 years old.
Parent/Guardian First Name Parent/Guardian Last Name
As the Parent/Guardian of,
Print Child's Legal First Name Print Child's Legal Last Name
consent to the release of personally identifiable information of the Child named above, subject to the
terms of this Consent Agreement.
B. For Adult 18 Years or Older or student enrolled in college (please print clearly)
I, ,
Print First Name Print Last Name
consent to the release of personally identifiable information of the Child named above, subject to the
terms of this Consent Agreement.
C. By signing this Consent Agreement, I agree that I have read and understood the above and consent
to all of the above statements. I understand that signing this Consent Agreement is voluntary and is
not a condition for receiving services from Orange County FSA.This Consent Agreement is valid for
the duration of the Orange County FSA initiative. I maintain the right to discontinue this permission at
any time by contacting the Orange County FSA Site Manager at
Signature Date
For Orange County FSA Use Only
Partner collecting this consent agreement:
Consent record recorded in Orange County FSA Site on (date):
Orange County FSA case management number:
18
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Master Data-Sharing Agreement
Attachment F:Authorization Agreement for Disclosure and Sharing of Protected Health Information
Orange County FSA Authorization Agreement for Disclosure and Sharing of Protected Health Information
By signing this agreement,you give your authorization to disclose and share personally identifiable
health information on the person listed below with authorized partners in the Orange County FSA.The
purpose of sharing this information is to allow the Orange County FSA to provide well-informed,
coordinated services to participants and their families,to conduct ongoing evaluation and improvement
of programs to better serve the community, and to report results of programs and activities to
residents, partners, and funders.
The Orange County FSA takes every precaution to protect personal information from unauthorized use
or release. Information obtained on persons shall not be published in a manner that will lead to the
identification of any individual.This information is used solely for service provision and program
evaluation purposes and identified information shall not be further re-disclosed to third parties not
covered by this Consent Agreement without your prior written consent. I understand that the records to
be disclosed and shared with Orange County FSA may include but are not limited to:
Program sp from [health care provider names]:
• Number and dates of health care visits
• Immunization records
• Blood screenings for lead levels
• Body-mass index measures
• Disability status
• Chronic health conditions
• Mental health status
I consent to the disclosure of the personally identifiable information described above to the Orange
County FSA entities and partners.
Furthermore, I consent that the following parties may obtain the information described above stripped
of any and all direct identifiers:
• The U.S. Department of Education and its authorized contractor(s)
For up-to-date information and questions, please go to
http://www.orangecountync.gov/departments/health/FSA.php or contact the Orange County FSA data
manager . Signing this agreement constitutes the granting of
authorization for disclosure of protected health information under the Health Insurance Portability and
Accountability Act (HIPAA).
19
DocuSign Envelope ID: D6EB45D6-6C12-4C2B-895B-067AF17D828F
Please complete sections A or B, as appropriate, and sign C below.
A. For Parent/Guardian of minor child (please print clearly)
Parent/Guardian First Name Parent/Guardian Last Name
As the (circle one) Parent, Guardian, or in loco porentis of
Print Child's Legal First Name Print Child's Legal Last Name
authorize the release of personally identifiable health information of the Child named above, subject
to the terms of this Consent Agreement.
B. For Adult of legal age(please print clearly)
I, ,
Print First Name Print Last Name
authorize the release of my personally identifiable health information, subject to the terms of this
Consent Agreement.
C. By signing this Consent Agreement, I agree that I have read and understood the above and consent
to all of the above statements. I understand that signing this Consent Agreement is voluntary and is
not a condition for receiving services from Orange County FSA.This Consent Agreement is valid for
the duration of the Orange County FSA initiative. I maintain the right to discontinue this permission at
any time by contacting the Orange County FSA Site Manager at
Signature Date
For Orange County FSA Use Only
Partner collecting this consent agreement:
Consent record recorded in Orange County FSA Site on (date):
Orange County FSA case management number:
20