This month we sat down with our Counsel, Krissa Kean, to learn more about administrative data sharing. As part of her role, Krissa manages data transfer and integrity issues during workforce program evaluations, and negotiates data security agreements with entities ranging in size from community colleges to state agencies.
What is a data sharing agreement?
A data sharing agreement is the legal document that sets up the methods and rules for sharing data between two organizations. New Growth uses data to track participants through workforce development programs and into the workforce (i.e., we follow students through the completion of community college training programs and after they get hired for work). This tracking enables New Growth to report to the college or funder on the effectiveness of the training programs.
Why do you need one?
When we say “data,” we mean personally identifiable data, which is in most cases a Social Security Number. Both colleges and state wage agencies use Social Security Numbers, so that is one of the data fields we use to track participants. Social Security Numbers are one of the most sensitive types of data that exist, outside of health data. This is precisely why we enter data sharing agreements: to make sure we take the utmost care to protect the transmission and storage of personally identifiable data.
Who needs to be involved in a data sharing agreement?
In general, there are 3 main components to a data sharing agreement: defining the data, securing the data, complying with legal requirements on the data. Data managers from the source organization should be involved to map out the data that can be shared. For a community college, this could be someone from the Institutional Research office where the data resides. Securing the data is extremely important, so both sides should have someone from Information Technology weigh in on their respective electronic data security capabilities. Lastly, a data sharing agreement is a legally binding document that may have regulatory requirements beyond what each organization permits. For example, New Growth’s data sharing agreements with community colleges are governed by the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99). All data sharing agreements should be prepared by, or with guidance from, an attorney.
What makes a strong data sharing agreement?
A strong data sharing agreement a) defines the data that will be shared; b) describes in detail the permitted methods for secure transmission and storage of the data; c) describes in detail the means for data destruction at the completion of the project; and d) defines what constitutes a breach of the agreement and includes liability and damages language in the event of a breach.
Any tips for those seeking to link data between multiple sources?
Sharing data between organizations, especially personally identifiable data, requires extraordinary attention to ensure the security of someone’s sensitive data – imagine if it was yours! They should not be entered lightly or as an afterthought. Data sharing agreements take time to negotiate, so it is in your best interest to start the process early in any project where sensitive data may cross organizational lines.
If you need technical assistance with data sharing components of your projects, New Growth can help.
