EESD REVISED FINAL STATEMENT of REASONS - Laws and Regulations (CA Dept of Education)

FINAL STATEMENT OF REASONS

CONFIDENTIALITY OF RECORDS

UPDATE OF INITIAL STATEMENT OF REASONS

An Addendum to the Initial Statement of Reasons was completed on April 24, 2017, to fix a typographical error on page 2 of the Initial Statement of Reasons regarding proposed section 18117. The Initial Statement of Reasons presented proposed section 18117 as “proposed section 11817” when it should have read “proposed section 18117. “

The original proposed text was made available for public comment for at least 45 days from April 22, 2017 through June 5, 2017. Two individuals submitted comments during the 45-day comment period.

A public hearing was noticed and held at 1:30 p.m. on June 5, 2017 at the California Department of Education (CDE). No members of the public attended the public hearing.

SUMMARY AND RESPONSE TO COMMENTS RECEIVED DURING THE INITIAL NOTICE PERIOD OF APRIL 22 THROUGH JUNE 5, 2017.

Peggy Dodge, Coordinator, Early Childhood Education, College of Marin

Comment: The commenter opposes the amendments to the regulations, noting that the changes to the regulations do not adequately protect the data of children and families no matter who has possession of the data. The commenter notes she is particularly concerned with the “Desired Results Developmental Profile (DRDP) Tech” instrument that is in wide use, and the ability to protect the DRDP data.

Response: The comment is rejected. The revisions to the regulation do not “loosen” or change in any way the legal protections given to the information or data of the children and families served in the Early Education and Support Division’s (EESD) child care programs. The amendments to the regulations merely clarify that the information held by the CDE is not covered by the California Code of Regulations, Title 5, which are intended to apply solely to the CDE contractors. The information on children and families held by the CDE is protected under state and federal laws and regulations and may only be used and disclosed under very limited circumstances. For example, before any personally identifiable information could be disclosed for purposes of conducting scientific educational research, state law requires the project obtain approval of an Institutional Review Board (IRB). Pursuant to state law, the IRB may only approve of disclosure to a non-profit educational institution or another non-profit conducting scientific educational research if it finds that the following conditions have been satisfied:

(A) The researcher has provided a plan sufficient to protect personal information from improper use and disclosures, including sufficient administrative, physical, and technical safeguards to protect personal information from reasonable anticipated threats to the security or confidentiality of the information.

(B) The researcher has provided a sufficient plan to destroy or return all

personal information as soon as it is no longer needed for the research project, unless the researcher has demonstrated an ongoing need for the personal information for the research project and has provided a long-term plan sufficient to protect the confidentiality of that information.

personal information will not be reused or disclosed to any other person or entity, or used in any manner, not approved in the research protocol, except as required by law or for authorized oversight of the research project.

Further, the IRB must, at a minimum, accomplish all of the following as part of its review and approval of the research project for the purpose of protecting personal information held in agency databases:

(A) Determine whether the requested personal information is needed to conduct the research.

(B) Permit access to personal information only if it is needed for the research project.

(D) Require the assignment of unique subject codes that are not derived

from personal information in lieu of social security numbers if the research can still be conducted without social security numbers.

(E) If feasible, and if cost, time, and technical expertise permit, require the

agency to conduct a portion of the data processing for the researcher to minimize the release of personal information.

As a side note, please note that the DRDP Tech data is de-identified data at the state level, so no personally identifiable DRDP data could be released.

Donna Sneeringer, Director of Government Relations, Child Care Resource Center

Comment: The commenter notes that they have worked in partnership to assess their agency child data to identify overlap between children in their subsidized child care program and children known to the County Welfare Department in Los Angeles, noting that there is a secure data protocol in place. The commenter further notes that there is a need for CDE contractors to effectively show the full picture of child care and early education services and thus provide data to other agencies and, without that ability, they would be unable to effectively educate and plan for services. The commenter claims the addition of ‘‘‘held by the contractor’ increases the perception that the data should be used ‘only for purposes of administration of the program.’” The commenter proposes an addition to Section 18117(b) as follows:

(b) The contractor shall permit the review of the basic data file by the child’s

parent(s) or parent’s authorized representative, upon request for the purposes of secure data collection for service planning, education and research.

Response: The comment is rejected. The information on children and families collected by the CDE contractors belongs to the CDE and is not information that belongs to the CDE contractor to determine how it wishes to share the information. The current regulation prohibits CDE contractors from using and disclosing child and family information unless use and disclosure are “directly connected with the administration of the program.” This regulation has stood for many years and continues to remain the intent of these amendments. The CDE has approximately 800 contractors administering its programs. If each contractor was allowed to decide with whom it would share the child and family information and under what conditions it would share child and family information, there would be no way that CDE could provide monitoring and oversight to ensure that the data being shared would abide by state and federal law and regulations. In addition, the CDE would not be able to ensure that any sharing of its information would be protected from inadvertent disclosure. The amendments to the regulations in this case were neither intended to “loosen” or “tighten” the obligations of the CDE contractors vis-à-vis the information the contractors collect; CDE contractors are only permitted to use and disclose the information pertaining to the child and the child’s family if the use or disclosure is directly connected to the administration of the program and thus that should be the perception of the contractors and the public. Should there be a need for the CDE EESD information to be utilized by partner or government agencies or researchers, the CDE is available as a potential source for such information, assuming that disclosure is permitted by federal and state law and regulations and the CDE consents to the sharing of the information.

ALTERNATIVES DETERMINATION

The CDE has determined that no alternative would be more effective in carrying out the purpose for which the regulations are proposed, or would be as effective and less burdensome to affected private persons than the proposed regulations or would be more cost effective to affected private persons and equally effective in implementing the statutory policy or other provisions of law.

No alternatives have been brought to the attention of CDE and given the underlying statutory requirements; the CDE has been unable to come up with any reasonable alternatives.

LOCAL MANDATE DETERMINATION

The proposed regulations do not impose any mandate on local agencies or school districts.