7-Attachment I- System Access Attachment 4-2025.docx

Attachment I System Access Agreement

I. Purpose The Grantee shall have access to AWARE System (System) for the purpose of entering student data, disability documentation, and releases of information.

II. Information Sharing A. Grantee shall utilize the AWARE case management system to enter the required data elements:

1. Name

2. Date of Birth

3. Student Contact Information

4. Race

5. Ethnicity

6. Social Security Number

7. Student with Disability/Documentation of Disability

8. Pre-ETS services provided with start and end dates

9. School Attending

10. Confirmation if the student has IEP or 504 Plan

11. Referral Source

12. Veteran Status

13. School Attending

14. Gender

III. Legal Authority The confidential information that is the subject of this Agreement may be governed by one or more of the following:

A. Government Records Access and Management Act (GRAMA).

1. Governmental entities are permitted to share records pursuant to Utah Code Section 63G-2-206(6).

2. GRAMA provides for criminal penalties in the event of intentional unauthorized disclosure.

B. Utah Administrative Code R986-100-110(4)(b), (c), (g). This rule identifies when DWS may disclose personal data from public assistance programs to another governmental entity.

C. The Privacy Act of 1974, (5 U.S.C. 552a, as amended) and the Social Security Act (42 U.S.C 7, as amended). These federal laws define purpose and use restrictions on personal data.

D. The confidentiality of Social Security records shall be maintained in accordance with 42 U.S.C 1306; 5 U.S.C 552a; and 20 CFR 401.150.

E. As it pertains to any third party information, Grantee will adhere to Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) or any other relevant legal authority.

F. Utah Government Data Privacy Act (GDPA). Grantee shall comply with the GDPA, Title 63A, Chapter 19, under which a Grantee that enters into or renews an agreement with a governmental entity and processes or has access to personal data as part of Grantee’s duties under the agreement, is subject to the requirements of the GDPA with regard to the personal data processed or accessed by Grantee to the same extent as required of the governmental entity.

G. The Utah Employment Security Act. Utah Code Section 35A-4-312(7) provides penalties for unauthorized disclosure of unemployment information in the form of a fine, imprisonment, or both.

IV. Disclosure and Confidentiality Requirements A. All Grantee users shall complete and submit the DWS 3rd Party Access Request Form (see attached) to gain access to the system as provided in this Agreement.

B. Grantee shall use the most recent version of the DWS 3rd Party Access Request Form when requesting access for new employees. Grantee shall contact the DWS contact listed on the Agreement to obtain the most recent version of the DWS 3rd Party Access Request Form.

C. Grantee shall immediately notify, by email, the DWS Contract Owner and dws_data_security@utah.gov when previously authorized employees are no longer authorized access to the system.

D. Information obtained under this Agreement shall only be used to support the valid administrative needs of Grantee and shall not be disclosed for any purpose other than those specifically authorized by this Agreement. Grantee’s employees must sign the Department of Workforce Services Non-Disclosure Agreement (see attached).

E. Grantee shall request and receive information only for individuals who are applying for or participating in Grantee’s programmed services. Contactor’s employees are not allowed to access their own information or the information of family members or close acquaintances.

F. Grantee shall have sufficient safeguards in place to ensure the information obtained is used only for the purpose disclosed. Information in electronic format shall be stored and processed in such a way that unauthorized persons cannot retrieve the information by computer, remote terminal, or any other means.

G. The information shall not be stored on any server accessible from the Internet or by unauthorized Grantee employees.

H. At the request of DWS, Grantee shall identify all employees, by position, authorized to request and receive information.

I. Any person who knowingly and willfully requests or obtains wage records under false pretenses, or any person who knowingly and willfully discloses any such information in any manner to any individual not entitled under law to receive it shall be guilty of a misdemeanor and receive a fine of not more than $5,000 under federal law (UIPL 11-89, Attachment III), or guilty of a class C misdemeanor under Utah law (Subsection 76-8-1304). Any person whose information was negligently or knowingly disclosed without authorization may bring a civil action for damages or such other relief as may be appropriate against any officer or employee (UIPL 11-89, Attachment III).

J. Social Security Administration records may only be re-disclosed pursuant to the provisions of 42 U.S.C. 1306; 5 U.S.C. 552a; and 20 CFR 401.150.

K. The penalties for unlawful access or disclosure of Social Security records shall be governed by the provisions of 42 U.S.C. 1306.

L. Grantee shall provide information to its employees about the state or federal penalties associated with any unauthorized disclosure of information that is the subject of this Agreement.

M. Grantee hereby provides DWS written assurance that (1) Grantee’s use of the records produces a public benefit that is greater than or equal to the individual privacy right that protects the records, (2) the records requested are necessary for the performance of the contract with DWS, that they will only be used for the performance of the contract with DWS, that they will not be disclosed to any other person, and that they will not be used for advertising or solicitation purposes, and (3) Grantee will adhere to the restrictions of this section.

V. Data Security A. Grantee shall monitor, detect, analyze, protect, report, and respond against known vulnerabilities, attacks, and exploitations. Grantee shall also continuously test and evaluate information security controls and techniques to ensure that they are effectively implemented.

B. Grantee shall follow the information security guidelines set forth in the latest version of NIST 800-53.

C. Grantee shall ensure that its employees do not access the System while outside of the United States.

D. Data must be stored in the United States.

E. Grantee shall access the System using a two-factor authentication process by logging in with a Utah ID account with the State of Utah security token. DWS will provide security tokens to authorized users during the term of this Agreement. Grantee shall be responsible for the cost of replacing lost and damage tokens.

F. Grantee shall return all security tokens to DWS upon termination of the Agreement by either party, when the Agreement ends, or upon DWS’s request.

G. Grantee shall cooperate with DWS to exchange security tokens if at any time during the term of this Agreement it becomes necessary to update or change security tokens utilized to access the System.

H. Grantee shall control access based on need to know. Grantee shall limit access to data in electronic or hardcopy format to authorized individuals only. DWS reserves the right to prohibit access to select individuals or groups of individuals.

I. DWS will maintain a query log containing the user identification, the date/time of each query, and the Social Security number used in each query. The query log may be used to monitor Grantee compliance with the terms of this Agreement.

J. Grantee shall store or process information either in electronic format such as magnetic tapes or discs or in hardcopy paper format in such a manner that unauthorized access is avoided. Grantee shall secure information in a manner to protect confidential files.

K. Grantee shall avoid printing or faxing any DWS confidential information unless necessary for required job duties, and if no other methods exist to store or communicate the needed information. Printing or faxing may only occur at an approved third-party site and may not occur in a telework or outreach environment.

L. Screenshots, photographs, or other media images and recordings of DWS confidential information are prohibited. This includes all DWS applications, and any documents provided by DWS that contain confidential information.

M. DWS and Grantee agree to train users accessing, disclosing, or receiving information under this Agreement, including contract providers and subgrantees on relevant statutes prescribing confidentiality and safeguarding requirements, re-disclosure prohibitions, and penalties for unauthorized access or disclosure. DWS may review Grantee’s disclosure-training program and require Grantee to make any changes DWS determines necessary.

N. DWS and Grantee system security plans must include provisions warning of the potential statutory sanctions for individuals who violate access and disclosure provisions. Sanctions procedures and individual corrective actions under applicable statutory authority shall be pursued and taken against individuals who violate terms of this Agreement.

O. Grantee shall comply with all applicable laws that require the notification of individuals in the event of a data breach or other security incident that may impact DWS systems or data within 24 hours of the occurrence. DWS is entitled, in its sole discretion, to determine whether any attempted unauthorized access is a security incident or a data breach.

P. Grantee shall comply with all applicable laws that require the notification of individuals in the event of a data breach or other events requiring notification in accordance with DTS Policy 5000-0002 Enterprise Information Security Policy. In the event of a data breach or other event requiring notification under applicable law including the GDPA, Grantee shall: (a) cooperate with DWS by sharing information relevant to the data breach; (b) promptly implement necessary remedial measures as determined by DWS; and (c) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to modify business practices in relation to the data breach. If the data breach requires public notification, all communication shall be coordinated with DWS. Grantee is responsible for all notification and remedial costs and damages.

Q. Grantee shall develop a contingency plan for addressing access to any uniquely sensitive records such as those of public officials and celebrities.

R. Grantee shall notify DWS of any major change in a system platform (hardware or software), procedure, or policy affecting transmission or distribution so DWS may re-review system safeguards.

S. Grantee shall comply with the following measures to prevent data breaches. Failure to meet the requirements will result in liability against Grantee.

1. Install all workstation updates within 72 hours of the patch/software/service pack release dates.

2. Install all server patches/software updates/service packs within two weeks of release date or within a reasonable time frame, based on professional information technology industry standards and best practices.

3. Implement whole disk encryption on laptops and devices that are used to access the system.

4. Install the most recent OS service pack.

5. Install the most recent OS security updates.

6. Install most recent patches for applications including Adobe (Acrobat, PDF, Reader, Flash), Java, Quick-Time, and Microsoft Office.

7. Install, run and maintain anti-virus software with the latest signature which includes, but is not limited to, protection from computer viruses, worms, Trojan horses, malicious rootkits, backdoors, spyware, botnets, keystroke loggers, data-stealing malware, dishonest adware, crimeware, and other malicious software.

8. Maintain secure configurations for hardware and software on laptops, workstations, and servers.

9. Maintain secure configurations on network devices such as firewalls, routers, and switches.

10. Install and maintain adequate boundary defense and run and maintain a host-based firewall on all devices.

11. Educate and encourage computer users to put in place strong authentication credentials and passwords.

12. Control wireless devices used to access, transmit, or store DWS data, including:

a) Enterprise management tools (vs. tools for home use)

b) Network vulnerability scanning tools

c) Deactivation of unauthorized ports

d) Wireless intrusion detection systems (WIDS)

e) Disabling peer-to-peer network capability

f) Disabling wireless peripheral access, such as Bluetooth

g) Disabling the ability to connect to public wireless networks and those not authorized by Grantee

13. Maintain, monitor, and analyze security audit logs.

14. Maintain controlled use of administrative privileges.

15. Continually assess vulnerability and remediate.

16. Limit and control network ports, protocols, and services.

17. Prevent data loss through the use of appropriate measures, including: encryption software, network monitoring tools, monitoring, and an adequate data security plan and employee training on such plans.

18. Maintain records only until such time that the records are no longer necessary and then securely dispose of the records.

a) Disposal means return of the information to DWS, destruction of the information, or deletion of personal identifiers by DWS in lieu of destruction.

b) Grantee shall not retain information with personal identifiers for longer than needed to fulfil the purposes of this Agreement.

VII. Client Informed Consent Grantee will be responsible for obtaining written consent to release the student’s personal information to DWS-USOR. Documentation will be uploaded using a DWS designated application. Grantee will only be able to access the documents they have uploaded. The program owner will be able to access all documents uploaded to the DWS designated application and will have the ability to attach these documents in the case management system. Grantee will maintain and provide documentation of these consents and provide these consents when requested by DWS Rev. 4/28/2025 Page 1 of 1