Located in:
- III. Operational Planning Elements
The Unified or Combined State Plan must include an Operational Planning Elements section that supports the State’s strategy and the system-wide vision described in Section II(c) above. Unless otherwise noted, all Operational Planning Elements apply to Combined State Plan partner programs included in the plan as well as to core programs. This section must include—
- b. State Operating Systems and Policies
The Unified or Combined State Plan must include a description of the State operating systems and policies that will support the implementation of the State strategy described in section II Strategic Elements. This includes—
- b. State Operating Systems and Policies
III. b. 6. D. Privacy Safeguards
Describe the privacy safeguards incorporated in the State’s workforce development system, including safeguards required by section 444 of the General Education Provisions Act (20 U.S.C. 1232g) and other applicable Federal laws.
Current Narrative:
The State is aware that a key element of success to utilizing data across agencies for either improved customer service or improved measurement and tracking of outcomes is ensuring the integrity of all data and ensuring confidential data is treated as such. The data retention policies are required by the State to identify and adopt a records retention schedule for the retention of documents and data following state and federal mandates.
This is accomplished with various technical safeguards and ensuring personnel handling this data are properly trained in all relevant regulations and the fundamentals of handling personal and confidential data. Technical safeguards may include:
- Approved processes that limit access to the data to only those personnel who require access to carry out their daily job functions;
- Network security, monitoring, firewalls, etc. to prevent unauthorized access to data from entities outside of State government;
- Encryption technology; and
- Secure data transport mechanisms.
Data Sharing Agreements are used when confidential information is shared with another entity. All partners that will provide and share data in collaboration efforts will enter into a memorandum of understanding (MOU) and/or a data sharing agreement to ensure security of sensitive information.
The privacy requirements for Family Educational Rights and Privacy Act (FERPA) outlined in section 444 of the General Education Provisions Act (20 U.S.C. 1232g) are enforced through role-based user operations that ensure separation of duties and data disclosure. The state mandates the local system staff must be compliant and must sign state confidentiality agreements following data security training.
All data sharing agreements and Memorandum of Understanding (MOU) documents are strictly enforced and utilized for all data sharing.
All partners expressly agree to abide by all applicable federal, state, and local laws regarding confidential information and to adhere to the same standards of confidentiality as state employees, including but not limited to: 29 U.S.C. 2935; as amended by WIOA - reports, recordkeeping, and investigations. 29 U.S.C. 2871(f)(3); as amended by WIOA - regarding confidentiality. 20 CFR Part 603 - safeguards and security requirements regarding disclosed information under Unemployment Compensation. 42 U.S.C. 503 - regarding state laws governing Unemployed Insurance operations. 20 CFR 617.57(b) - regarding disclosure of information under the Trade Act. 29 U.S.C. 49I-2(a)(2); as amended under WIOA - regarding information to be confidential under the Wagner-Peyser Act. The Privacy Act (5 U.S.C. 552). The Family Educational Rights and Privacy Act (20 U.S.C. 1232g).}34 CFR 361.38 - protection, use, and release of personal information of Vocational Rehabilitation Services participants. HIPAA: 45 CFR 164.500 - 164.534. 2 CFR 200.303 - regarding reasonable measures to safeguard protected personally identifiable information.
Title II Adult Education has a program policy specifically on Student Confidentiality. According to the Family Educational Rights and Privacy Act (FERPA) of 1974, enacted as Section 438 of the General Education Provisions Act, student information that is considered "private" cannot be shared with anyone who is not designated on a release of confidential information form that has been signed by the student. Examples of confidential information disclosures include disabilities, recovering substance abuse condition, AIDS/HIV, or other medical information. If the student discloses any condition or disability that falls under the Privacy Act, the disclosed information cannot be shared with anyone without a Release of Confidential Information Form, including all appropriate signatures.
Adult education and literacy council providers are responsible for securing confidential student information. The personal confidentiality statement should be completed and signed by all persons with access to student records for legitimate educational and/or reporting purposes. Care must be taken to ensure that student data is safe from access by unauthorized persons. All confidential student data should be aggressively protected, especially a student’s social security number. The Adult Education Section collects social security numbers to allow for authorized use in data match with other state agencies. Students must give permission for programs to use their information for data match.
ARS ensures that only staff as part of their duties have access to confidential information. ARS conducts background checks on all employees. State networking security and firewall procedures are implemented and followed. Participant information is not shared unless the individual has given written permission.
DSB ensures that only staff who need access as part of their duties can access confidential information. DSB conducts background checks on all employees. State networking security and firewall procedures are implemented and followed for all DSB staff. DSB staff require a signed release from participants before any information is shared.