Narrative: III. b. 6. D.

The State of Colorado takes its responsibility very seriously to protect the privacy of individuals and their personally-identifiable information (PII). Connecting Colorado utilizes masked individual identifiers for online customer records and reports to ensure that the social security number (SSN) remains confidential. In addition, Connecting Colorado provides a multilevel system of access to data that is controlled by state and local administrators of the system. The level of access granted determines which screens and which data can be viewed by staff and whether individual staff has read only or data entry permissions. Industry standard encryptions ensure that data transfers between agencies are secure. CDLE has moved the Eligible Training Provider list to the CDHE to ensure further security of PII. CDHE receives student information under FERPA (20 U.S.C. 1232g) as an educational entity, and CDHE also receives Colorado Unemployment Insurance Wage data on an annual basis. CDHE can match the student cohort data with the wage records provided to easily calculate performance for training programs in Colorado without compromising PII since all data calculations happen securely within CDHE. Performance is always aggregated and never presented at an individual level that might compromise the anonymity of students. This process will allow the schools to drop expensive surveys they have been forced to perform for any program that had to be on the Eligible Training Provider list in order to gather results for the “All Students” section. In addition, it will make the performance results much more consistent, since the results will all be based on Colorado Unemployment Insurance Wage data. 

DVR will maintain adherence to federal regulatory requirements around confidentiality and state requirements around personally identifiable information (PII) through staff training related to confidentiality of customer information. Additionally, DVR has and will continue to maintain processes and procedures that support the HIPAA level of confidentiality within its electronic case management system. 

Within SCSEP, the privacy of participants, host agencies and employers is protected and stored in locked files that are not accessible to anyone other than authorized personnel. Data that is transmitted via the internet is sent encrypted, and only authorized personnel have access to the electronic files. Participants are given the option of providing their social security numbers for administrative purposes, and they are also asked to sign a consent form allowing release of information for the purpose of enhancing and marketing SCSEP. 

The Colorado Department of Education (CDE) takes seriously its obligation to protect the privacy of Personally Identifiable Information (PII) collected, used, shared, and stored by CDE. CDE does not disclose student PII unless the disclosure is permitted under the Family Educational Rights and Privacy Act (FERPA) and covered by the appropriate agreements as required by Colorado’s Student Data Transparency and Security Act (SDTSA) [C.R.S. 22-16-101 et. seq.]. These agreements are required for any individual or entity that receives student PII from CDE. In addition, those individuals or entities receiving student PII from CDE are required to ensure that their subcontractors contractually agree to comply with the requirements of SDTSA. CDE’s contractual agreements include specific information security and privacy requirements, including, but not limited to, incident response procedures and requirements, the encryption of student PII at rest and in transit, limitation on the uses of student PII to only what is specifically stated in the agreement, destruction of student PII upon the termination of the agreement, best practices around the use of technology, limited data access, and requirements to remove personally identifiable information from public reporting. Violations of these agreements can result in the immediate termination of the agreement, a halt to all data sharing, and, under the requirements of FERPA, a prohibition from sharing student PII with the violating entity for a period of five years. In addition, all previously shared student PII will need to be immediately destroyed. 

Colorado Works is guided by CCR 3.609.94: Protections to the Individual, which specifies that all information concerning an applicant or recipient is confidential and the exclusive property of the state and county departments of human services. Unless disclosure is specifically permitted, no information will be released to other agencies or individuals. By signing the application for assistance, clients agree to allow county departments to get and share information with any of the following agencies: Social Security Administration, Internal Revenue Service, United States Customs and Immigration Services, Colorado Department of Labor and Employment, financial institutions, child support agencies, employers, courts or other law enforcement agencies. Information may also be shared with county, state and federal auditors and individuals executing the Income and Eligibility Verification System (IEVS). Permission to release information to advocate agencies that apply for, or act on behalf of, an individual is implied, as long as the county department is reasonably sure the confidential nature of the information will be preserved. All other disclosure of information to agencies or individuals not listed above requires a formal, written release from the applicant/recipient. 

County departments of human services are expected to provide privacy during client interviews and are instructed to set up facilities in a way that ensures information is not inadvertently revealed. County workers must also use discretion outside the office, by not mentioning department business or any other confidential information. Storing of county records is located at 3.603, Case File Maintenance and outlines the responsibility for county departments to provide a location to store files in a safe place in order to prevent accidental disclosure of confidential information.