Narrative: III. b. 6. D.

The State of Colorado takes its responsibility very seriously to protect the privacy of individuals and their personally–identifiable information (PII). Connecting Colorado utilizes masked individual identifiers for online customer records and reports to ensure that the social security number (SSN) remains confidential. In addition, Connecting Colorado provides a multilevel system of access to data that is controlled by state and local administrators of the system. The level of access granted determines which screens and which data can be viewed by staff and whether individual staff has read only or data entry permissions. Industry standard encryptions ensure that data transfers between agencies are secure.

CDLE is in the process of moving the Eligible Training Provider list to the CDHE to ensure further security of PII. CDHE receives student information under FERPA (20 U.S.C. 1232g) as an educational entity, and CDHE also receives Colorado Unemployment Insurance Wage data on an annual basis. CDHE can match the student cohort data with the wage records provided to easily calculate performance for training programs in Colorado without compromising PII since all data calculations happen securely within CDHE. Performance is always aggregated and never presented at an individual level that might compromise the anonymity of students.

This process will allow the schools to drop expensive surveys they have been forced to perform for any program that had to be on the Eligible Training Provider list in order to gather results for the “All Students” section. In addition, it will make the performance results much more consistent, since the results will all be based on Colorado Unemployment Insurance Wage data.

DVR will maintain adherence to federal regulatory requirements around confidentiality and state requirements around personally identifiable information (PII) through staff training related to confidentiality of customer information. Additionally, DVR has and will continue to maintain processes and procedures that support the HIPAA level of confidentiality within its electronic case management system.

Within SCSEP, the privacy of participants, host agencies and employers is protected and stored in locked files that are not accessible to anyone other than authorized personnel. Data that is transmitted via the internet is sent encrypted, and only authorized personnel have access to the electronic files. Participants are given the option of providing their social security numbers for administrative purposes, and they are also asked to sign a consent form allowing release of information for the purpose of enhancing and marketing SCSEP.

The Colorado Department of Education (CDE) takes seriously its obligation to protect the privacy of data collected, used, shared, and stored. In compliance with the Family Educational Rights and Privacy Act (FERPA), CDE does not disclose PII from student records unless the disclosure is for one of the limited purposes outlined in FERPA, 34 CFR § 99.31, including the following:

• Student Transfer and Enrollment: Student information may be disclosed, subject to the requirements of FERPA, 34 CFR § 99.34, to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student’s enrollment or transfer and the student’s former district has provided prior notification of this service through its annual FERPA notification letter.
• Educational Studies: Student information may be disclosed to organizations conducting studies for, or on behalf of, CDE to: (1) develop, validate, or administer predictive tests; (2) administer student aid programs; or (3) improve instruction. Disclosures for the purposes of such studies must ensure that the study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization that have legitimate interests in the information, the information is destroyed when no longer needed for the purposes for which the study was conducted, and CDE enters into a written agreement that meets the requirements outlined below.
• Audits or Compliance Activities: Student information may be disclosed to authorized representatives of CDE in connection with an audit or evaluation of Federal or state supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs. Disclosures for the purposes of such audits, evaluations, or compliance activities must ensure that CDE uses reasonable methods to ensure that its authorized representative: (1) uses personally identifiable information only to carry out an audit or evaluation of Federal– or State–supported education programs, or for the enforcement of or compliance with Federal legal requirements related to these programs; (2) protects the personally identifiable information from further disclosures or other uses, in accordance with FERPA; (3) destroys the personally identifiable information in accordance with FERPA; and (4) CDE enters into a written agreement that meets the requirements outlined below.

Pursuant to CDE policy, prior to sharing personally identifiable student information for purposes of audits, evaluation, or compliance monitoring, CDE must enter into a written agreement or contract that meets the following requirements:

• Designates the individual or entity that will serve as the authorized representative. If an entity is designated, the agreement must specify the individuals directly responsible for managing the data in question;
• Specifies the purpose for which the personally identifiable student information from education records is being disclosed and state specifically that the disclosure is in furtherance of an audit, evaluation, or enforcement or compliance activity. The agreement must specify the student information to be disclosed and must include a description of how the student data will be used. The agreement must describe the methodology and why disclosure of personally identifiable student information is necessary to carry out the audit, evaluation, or enforcement or compliance activity;
• Requires the authorized representative to use personally identifiable information only to meet the purpose of the disclosure as stated in the written agreement and not for commercial purposes or further disclosure;
• Requires the authorized representative to destroy the personally identifiable information from the education records when the information is no longer needed for the purpose specified and must be clear about how the education records will be destroyed. The agreement must identify a specific time period for destruction based on the facts and circumstances surrounding the disclosure and study. The parties to the written agreement may agree to amend the agreement to extend the time period if needed, but the agreement must include a time limit. The agreement shall require the authorized representative to provide written confirmation to CDE when the education records have been destroyed, per the terms of the agreement;
• Documents appropriate technical, physical, and administrative safeguards to protect personally identifiable student data at rest and in transit. Examples of this include secure–file transfer protocols (“SFTP”) and hyper–text transfer protocol over secure socket layer (“HTTPS”);
• The agreement establishes policies and procedures to protect personally identifiable student information from further disclosure and unauthorized use, including limiting use of personally identifiable information to only the authorized representatives with a legitimate interests in the audit, evaluation, or enforcement or compliance activity; and
• Includes a plan for how to respond to any breach in security, including the requirement that any breach in security must be reported immediately to CDE.

In addition to all of the precautions addressed above, any data sharing agreement or contract shall also address the following assurances to protect personally identifiable information from further disclosure and unauthorized use:

• CDE shall verify that the authorized representative has a sound data security program to protect data at rest and in transmission. This may be addressed through language in the data sharing agreement that states what data security provisions are required, including requirements related to encryption, where the data can be hosted, transmission methodologies, and provisions to prevent unauthorized access. CDE may require the authorized representative to provide a certification indicating that an independent vulnerability or risk assessment of this data security program has occurred. CDE shall also maintain the right to physically inspect the authorized representative’s premises or technology used to transmit or maintain data;
• CDE shall verify that the authorized representative has in place a data stewardship plan with support and participation from across the organization that details the organization’s policies and procedures to protect privacy and data security, including the ongoing management of data collection, processing, storage, maintenance, use, and destruction. CDE may also wish to verify that the authorized representative has a training program to teach its employees about FERPA and how to protect personally identifiable information from education records.
• If applicable, CDE shall verify that the authorized representative has appropriate disciplinary policies for employees that violate FERPA, including termination in appropriate instances;
• CDE shall maintain the right to conduct audits or other monitoring activities of the authorized representative’s data stewardship policies, procedures, and systems. If, through these monitoring activities, a vulnerability is found, the authorized representative must take timely appropriate action to correct or mitigate any weaknesses discovered; and
• CDE shall maintain the right to review any data prior to publication and to verify that proper disclosure avoidance techniques have been used and shall maintain the right to approve reports prior to publication to ensure they reflect the original intent of the agreement.

An individual may file a written complaint with CDE regarding an alleged violation of a data sharing agreement or contract. A complaint must contain specific allegations of fact giving reasonable cause to believe that a violation of a data sharing agreement or contract has occurred. CDE will investigate all reasonable and timely complaints. CDE may also conduct its own investigation when no complaint has been filed or a complaint has been withdrawn, to determine whether a violation has occurred.

As required by FERPA, if an authorized representative that receives data to perform evaluations, audits, or compliance activities improperly discloses the data, CDE shall deny that representative further access to personally identifiable data for at least five years. In addition, CDE may pursue penalties permitted under state contract law, such as liquidated damages.

Colorado Works is guided by CCR 3.609.94: Protections to the Individual, which specifies that all information concerning an applicant or recipient is confidential and the exclusive property of the state and county departments of human services. Unless disclosure is specifically permitted, no information will be released to other agencies or individuals.

By signing the application for assistance, clients agree to allow county departments to get and share information with any of the following agencies: Social Security Administration, Internal Revenue Service, United States Customs and Immigration Services, Colorado Department of Labor and Employment, financial institutions, child support agencies, employers, courts or other law enforcement agencies. Information may also be shared with county, state and federal auditors and individuals executing the Income and Eligibility Verification System (IEVS).

Permission to release information to advocate agencies that apply for, or act on behalf of, an individual is implied, as long as the county department is reasonably sure the confidential nature of the information will be preserved.

All other disclosure of information to agencies or individuals not listed above requires a formal, written release from the applicant/recipient.

County departments of human services are expected to provide privacy during client interviews and are instructed to set up facilities in a way that ensures information is not inadvertently revealed. County workers must also use discretion outside the office, by not mentioning department business or any other confidential information.

Storing of county records is located at 3.603, Case File Maintenance and outlines the responsibility for county departments to provide a location to store files in a safe place in order to prevent accidental disclosure of confidential information.