ACL’s New Data Requirements (Administration on Community Living)

1. ACL’s New Data Requirements(Administration on Community Living)

2. New Three-Part Data Requirement • Need to use updated workshop forms. • All leaders, program coordinators, and data entry staff need to view this mandatory webinar in order to safely handle participants’ private information. • Workshop leaders need to read a New Leader Script to participants before distributing the Participant Information Survey.

3. Updated Workshop Forms

4. II. Privacy Act TrainingWhy? How? • Participant Information Surveys contain personal information (PII or Personally Identifiable Information) that needs to be protected. • To protect participants’ PII certain procedures will need to be followed before, during and after the workshop.

5. Before the workshop All leaders, program coordinators, and volunteers need to view this mandatory webinar! • Designate a lock drawer/cabinet in which to keep the Participant Information Surveys until the workshop is over. • Get a manila or white envelop to carry the completed Participant Information Surveys back to the office.

6. During the workshop • Read the leader script before you distribute the Participant Information Survey. • Make sure participants understand that even if they do not want to complete the Participant Information Survey, they can still participate in the workshop. • Make sure the name/nickname or number on the Attendance Log, and Participant Information Survey match! • Put all completed Participant Information Surveys inside a manila or white envelope. Keep them locked until the workshop is over.

7. After the Workshop • Mail all the workshop paperwork as soon as the workshop is over (within 5 days) to: • Elder Services of the Merrimack Valley (Attn. Joanna Fernandez) • Include a cover sheet marked: FOUO (For Official Use Only) • Attendance Log, • Cover Sheet, • Participant Information Surveys, • Attachment B (if receiving grant reimbursement) • Participant Satisfaction Surveys • NO FAXES WILL BE ACCEPTED!

8. The New Leader Script A New Leader Script needs to be read to workshop participants before the Participant Information Surveys are distributed. The script explains workshop funding sources, why we are collecting demographic data, and the care used in handling their private information.

9. Can I change the Leader Script? Yes! Please mention all the funding sources you have to implement the workshop and who you share the data in the Participant Information Survey with.

10. The Healthy Living Center of Excellence will: • Enter all the data from the Participant Information Surveys into the NCOA National Portal. • Shred all the Participant Information Surveys after data entry. • Keep all the Non-Disclosure Agreements in a locked cabinet for three years after the termination of the grant year (2018).

11. Please remember!ACL Needs Your DataMassachusetts Needs Your Data!(regardless of who is funding your program) • Funding for CDSME is not guaranteed! • ACL and MA need to have as much data as possible to help show who is being served and how is the program helping them.

12. These requirements are mandatory for all workshops starting January 1, 2014. What can you do now? • Make sure you have all the updated workshop forms. • Find a locked cabinet to store the forms with PII until they are sent to ESMV. • Make sure all leaders, program coordinators, and data entry staff have viewed the webinar and have sent their Non-Disclosure Agreement Forms to ESMV. • Buy Manila Envelopes!!

13. NCOA Webinar Now that you know what this is about, let’s review the Mandatory NCOA Webinar. • After you view the NCOA Webinar please: • Print and complete the Quiz • Print and sign the Non-Disclosure Agreement • Mail or Email the Quiz and Non-Disclosure Agreement to HSL, attn: Amanda Aprea • Amanda will mail a certificate back to you.

14. Privacy and Security Basics for CDSME Data Collection Sue Lachenmayr, MPH, CHES

15. Training for CDMSE Data Collection Overview • Purpose of the Privacy Act • Primary Features of the Act • Who Needs Privacy Training? • Master Trainers and Lay Leaders • Program Coordinators and Data Collection/Data Entry Personnel • Types of Information Protected by the Act • Disclosure • Safeguarding, Transporting and Disposing of PII • Roles and Responsibilities • Final Instructions

16. Privacy Act of 1974 Public Law 93-579 (5 U.S.C.A. 552a) • Purpose: to protect records that can be retrieved by personal identifiers such as a name, social security number, or other identifying number or symbol. • The act was created in response to concerns about how the use of computerized databases might impact individuals' privacy rights. • requires government agencies to show individuals any records kept on them • requires agencies to follow "fair information practices," when gathering and handling personal data. • places restrictions on how agencies can share an individual's data with other people and agencies. • lets individuals sue the government for violating of these provisions http://epic.org/privacy/1974act /

17. Who Needs to be Trained? • If your work involves the management of sensitive information, PII (Personally Identifiable Information), or protected health information, you need to ensure you are taking precautions to protect it from unauthorized access/disclosure, theft, loss and improper disposal.

18. Who Needs to Be Trained? • Employees, • Managers, • Supervisors, • Coordinators, • Master trainers (MTs), and • Lay leaders (LLs), including volunteers who are involved in the collection, handling, and/or data entry of Personally Identifiable Information (PII) on individuals participating in CDSME.

19. What Type of Training is Needed? • Training for program coordinators and program implementers • The rights of individuals participating in CDSME • The appropriate protection of PII shared by CDSME participants at the workshop level • The appropriate storage and transfer of participant forms • Training for individuals completing data entry and data transfer • The appropriate protection of PII shared by CDSME participants at the workshop level • The appropriate storage, transfer and destruction of data forms • Security requirements for electronic data transfer, storing and degaussing (destruction)

20. Types of Information Covered by the Privacy Act • Sensitive: if the loss of confidentiality, integrity, or availability could be expected to have a serious, severe or catastrophic adverse effect on organizational operations, organizational assets or individuals. • Protected Health Information: Individually identifiable health information that relates to a person’s past/present/future physical/mental health, health care received, or payment. http://irtsectraining.nih.gov/publicUser.aspx

21. Information Protected by the Privacy Act PERSONALLY IDENTIFIABLE INFORMATION (PII) • Home address • Home telephone number • Complete date of birth • Personal medical information • Social Security Number (including just the last four digits of SSN) • Personal/private information (if the information can uniquely identify the individual) • Photographs • Education records • Financial transactions • Employment history

22. Information Protected by the Privacy Act PERSONALLY IDENTIFIABLE INFORMATION (PII) "the term Personally Identifiable Information means any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.“ http://www.gsa.gov/portal/content/104276

23. Disclosure • No agency or person shall disclose: • any record • by any means of communication • to any person or another agency • without a written request or prior written consent of the individual to whom the record pertains • “any means of communication” includes oral (phone, in-person), written and electronic (emails, faxes, texts, tweets, pins, etc.) http://www.dodea.edu/upload/2011_patrainingslides.pdf

24. Safeguarding PII • PII must always be treated as “FOR OFFICIAL USE ONLY” and must be marked accordingly. • This applies not only to paper records (including e-mail, faxes, etc., which must contain the cautionary marking “FOR OFFICIAL USE ONLY – FOUO”). • All records containing PII should be stored in locked filing cabinets or other secure containers to prevent unauthorized access. • Electronic records must be password protected and be transferred via encrypted e-mail.

25. Transporting PII • Hand Carrying • Use a Cover sheet to shield contents • Using Mail • Use manila or white envelopes • Mark the envelope to the attention of the authorized recipient • Never indicate on the outer envelope that it contains PII • Using E-mail: • Password protect personal data placed on shared drives, the Internet or the Intranet • Use encrypted e-mail • Do not send PII to a personal, home or unencrypted e-mail address • Announce in the opening line of the text (NOT the subject line) that FOUO information is contained http://www.dodea.edu/upload/2011_patrainingslides.pdf

26. Disposing of PII • A disposal method is considered adequate if it renders the information unrecognizable or beyond reconstruction. • Disposal methods may include: • Burning • Melting • Chemically decomposing • Pulping • Pulverizing • Shredding • Mutilating • Degaussing (erasing from magnetic field or disc) • Deleting/Emptying Recycle Bin www.dla.mil/.../Privacy%20Act%20103%20Safegarding%20Privacy%20

27. Your Role and Responsibility • Take privacy protection seriously • Respect the privacy of others • Ensure messages, faxes and e-mails that contain personal information are properly marked and e-mail is encrypted • Don’t share PII with individuals who are not authorized • Have appropriate transfer, storage and disposal protocols in place for PII • Do not e-mail PII to personal, home or unencrypted accounts

28. Roles and Responsibilities • All individuals involved in providing CDSME programs must sign Non-Disclosure Agreements • All individuals involved in data collection, data transfer and/or data entry must sign Non-Disclosure Agreements • Non-Disclosure Agreements should be maintained for 3-years after the end of the grant and stored by the state leader or the state’s designee for data collection/data entry

29. Master Trainers and Lay Leader Role • Use the CDSME Program Group Leader Script at a Class Zero pre-session or at the start of Session 1 and with any new participants who start at Session 2 • The script explains why participant data is being collected and how it will be kept secure • Emphasize that completing Participant Information Survey is voluntary • Individuals may skip any questions they do not want to answer • Individuals may choose to not complete the Survey, but they can still participate in the program • Store Survey forms in sealed envelope and mail to appropriate program coordinator

30. HLCE Role • Store completed CDSME forms in a secure, locked cabinet when not in use • Enter data into secure, password protected database, such as the CDSME database • Destroy participant data forms after data entry

31. Final Instructions • Please print the Quiz, complete and sign the Non-Disclosure Agreement. Mail or Email them to: Amanda Aprea Program Coordinator for Evidence-based Programs Hebrew SeniorLife Department of Medicine 1200 Centre Street Boston, MA 02131 Email: AmandaAprea@hsl.harvard.edu Amanda will send back your Certificate of Completion to keep for your records.

32. Please contact: Ana Karchmer CDSME Program Coordinator Executive Office of Elder Affairs (617) 222-7490 ana.karchmer@state.ma.us