You Can*t Skip Privacy Considerations

The Center for IDEA
Early Childhood Data Systems
Stay on the Linking Path:
Don’t Forget Privacy
May 18th, 2017
#LinkingWeek
Objectives
Increase understanding of important steps related to
privacy and confidentiality as you plan for linking Part
C and Part B 619 data
Increase understanding of the FERPA policies
relevant to linking Part C and Part B 619 data
Learn about strategies that North Carolina is using to
address privacy and confidentiality considerations
Joining us Today
Baron Rodriguez, DaSy and PTAC
Barbara Simpson, NC Part C
Kelley Blas, NC Part B
Sharon Walsh, DaSy
POLL: What
is your role?
Consider Two Scenarios
Scenario A
Single lead agency,
Education, two separate
data systems for Part C and
619
Scenario B
Two different lead agencies,
Health for Part C and
Education for 619 – each
has its own data system
Privacy Considerations
Where does the data
reside as a result of your
inventory?
What data will need to
be shared AND how will
the data flow?
?
What federal, state, and
local laws apply to data
sets?
What data sharing
agreements need to be
in place? Requirements?
Step 1: FERPA/IDEA Crosswalk
Why it matters to you:
Will help you understand
the differences between
definitions, protections, and
requirements around IDEA
Part B & Part C and FERPA.
What does it address?
Will help differentiate the
statutes and provide
comparisons for the shared
definitions.
What Records Are Covered?
IDEA Part C
Early Intervention Records
IDEA Part B
Education Records
FERPA
Education Records
All records regarding a
child that are required to
be collected, maintained,
or used under Part C
The type of records
covered under the
definition of “education
records” in FERPA
[303.403(b)]
Records that are
collected, maintained, or
used
Records that are –
Directly related to
student; and maintained
by an educational agency
or institution or by a
party acting for the
agency or institution
[99.3]
[300.611(b)]
Step 2: FERPA Applicability?
FERPA Exceptions Summary
Why it matters to you:
The various exceptions to
FERPA can be confusing and
difficult to keep track of.
This gives you a simple two
page or large single page
“at-a-glance” view of FERPA
exceptions.
What does it address?
It is intended be a handy
visual aid to help look at
what FERPA exception
applies to the data sharing
work you are trying to do.
FERPA/Part C Crosswalk of Terms
FERPA
IDEA Part C
Education Record
Early intervention record
Education
Early intervention
Educational agency or
institution
School official
Participating agency
State educational authority
Lead agency
Student
Child under IDEA Part C
Qualified early intervention service (EIS)
personnel/Service coordinator
Disclosure of PII From Education
Records under FERPA
FERPA permits non-consensual disclosure of PII from
education records under several exceptions
– Staff or employees who need access to perform duties
• School official exception
• “Legitimate educational interest”
– External entities
•
•
•
•
Studies exception
Audit or evaluation exception
Uninterrupted Scholars Act
Other (e.g., court order, health or safety emergency)
Note on the Studies Exception
The "Audit/Evaluation” exception in 34 CFR §§99.31(a)(3) and 99.35 is the
most appropriate exception under IDEA and FERPA for data sharing
arrangements for the IDEA early childhood community.
In the very limited instance in which IDEA Part C or IDEA Part B section 619
agencies or programs propose to consider using the “Studies” exception
under FERPA, such agencies and programs will want to consult with the
Department’s Office of Special Education Programs (OSEP) and Family
Policy Compliance Office (FPCO) regarding how the proposed data sharing
would meet the requirements in 34 CFR §§99.31(a)(6) and 303.414 (for
IDEA Part C) and 34 CFR §§99.31(a)(6) and 300.622 (for IDEA Part B
Section 619).
IDEA Safeguards
Each participating agency must protect the
confidentiality of PII at all stages.
One official at each participating agency must
assume responsibility for ensuring the confidentiality
of any PII.
All persons collecting or using PII must receive
training on state’s privacy procedures.
Each participating agency must maintain a list of
employees with access to PII.
Scenario A: One lead agency, Education, two
separate data systems for Part C and 619
Overall Agency
Data Governance
Part C Data
Stewardship
Provisions
619 Data
Stewardship
Provisions
Scenario B: Two different lead agencies,
Health for Part C and Education for 619
Multi-agency
Governance
Data
Required:
Data Sharing
Agreement
Audit/Eval
Exception
Health
Agency data
stewardship
input
ED Agency
data
stewardship
input
Helpful Resource: Data Destruction Best Practices
Why it matters to you:
Given the large volume of
child data collected by
providers, it is important to
understand responsibilities
and best practices in
destruction of data no
longer needed.
What does it address?
It details the life cycle of
data and discusses legal
requirements of destruction
of data destruction under
FERPA as well as examples
of methods for properly
destroying data.
NC Context
Part C in Health (DHHS)
Part B 619 in Education (DPI)
Participation in DaSy Linking C/619 Data Cohort
starting February 2016
North Carolina’s Part C and Part B 619
Linking Data Work
Preparation for Linking
– Data Sharing Agreements/MOUs
– Data Elements
– Unique ID
North Carolina Linking – Agreements
Challenges/Barriers: What is the format/language for
the necessary agreement/MOU?
– Interagency Agreement on Transition (DHHS/DPI)
– ECIDS MOU
– Other approved agreements within Part C or Part B 619
Solutions/Lessons Learned
– Leverage existing MOUs/Agreements (ECIDS, Current
Interagency Agreement on Transition)
North Carolina Linking - Agreements
Challenges/Barriers: Who needs to be involved in the
MOU/Agreement process?
– Separate agencies = Redundancies of roles (Lawyers from
Part C, Lawyers from Part B)
– Who are the decision-makers? Are they at the table?
– Separate data systems
– Involving Data Governance groups
Solutions/Lessons Learned
– Start early with meetings with key people
– Membership of core linking group is key
North Carolina Linking – Agreements
Current Status
Current Status: Amendment to current Interagency
Agreement Under Review
– Utilized language from other accepted agreements
– Includes information on:
• Why to link data
• FERPA guidance and exceptions for sharing Personally Identifiable
Information (PII)
• Joint Data Committee (decision-making body)
• “Legalese” – data requests, re-disclosure, security considerations,
permissions, etc.
North Carolina Linking – Data Elements
Challenges/Barriers: ECIDS data elements were
insufficient
– No referral data
– No Child Outcomes data from Part B 619
– Other data not included
Solutions/Lessons Learned:
– Start with lists from ECIDS MOU
– Add in fields relevant to critical questions
– Include in Amendment
North Carolina Linking – Unique ID
Challenges/Barriers: No C/619 unique ID
currently exists
Solutions/Lessons Learned:
– Standard ID currently used by DPI for all students
is also ID used for ECIDS
– ECIDS ID is in DHHS Data Warehouse, working on
getting Part B 619 data staff access
North Carolina Linking – Next Steps
Approval of Amendment to Interagency Agreement
Joint Data Committee/Joint Data Governance
– Permissions
– Secure data transfer
– Secure storage
Link Data
Use Data To Answer Critical Questions
Generate Reports/Data Visualizations for
Stakeholders
POLL: Biggest Challenges
Overview of Linking Week Activities
Monday - Governance and
Technical Considerations
Tuesday- Critical Questions
Wednesday- State Data
Thursday- Privacy and
Confidentiality
Friday- Linking
Resources
Check out the
blogs,
resources,
linking video
and visuals!
Evaluation will
be sent out on
Friday (5/19)
for all webinars
Final presentation slide
Visit the DaSy website at:
http://dasycenter.org/
Like us on Facebook:
https://www.facebook.com/dasycenter
Follow us on Twitter:
@DaSyCenter
The contents of this presentation were developed under a grant from the
U.S. Department of Education, # H373Z120002. However, those contents do
not necessarily represent the policy of the U.S. Department of Education,
and you should not assume endorsement by the Federal Government.
Project Officers, Meredith Miceli and Richelle Davis.