CTR072042_Attachment_13_Data_Sharing_Agreement__-_signed.pdf

J-119 DSA (8-23) ARIZONA DEPARTMENT OF ECONOMIC SECURITY

Division of Technology Services/Information Risk Management

1400 West Washington Street, Mail Drop 1426, Phoenix, Arizona 85007

DATA SHARING REQUEST/AGREEMENT

BETWEEN

REQUESTING ENTITY:

DES Division / Administration/Program / Office Name or External Organization Name:

Child & Family Resources, Inc.

AND

DATA MANAGER: ARIZONA DEPARTMENT OF ECONOMIC SECURITY

Division / Administration/Program / Office Name:

Division of Child Care

DSA Effective Date: DSA Agreement No.: 234517

Contract Start Date: 07/01/2024

Contract Max End Date: 06/30/2029 (If applicable)

Contract No.:

UID:

CTR072042

Equal Opportunity Employer / Program • Auxiliary aids and services are available upon request to individuals with disabilities • TTY/TDD Services 7-1-1

02/08/2024

J-119 DSA (8-23) – Page 2 of 10 Agreement No.: 234517

1a. PURPOSE OF THIS REQUEST (What information is being requested and why? How will it be used? Define business need. Give details/specifics.)

The DES Division of Child Care contracts with Child and Family Resources, INC. to meet the requirements of the federal Child Care and Development Block Grant (CCDBG) and ARS §41-1967 Child care resource and referral system. DES and CFR partner in ongoing and monthly data sharing and reporting requirements, characteristics of child care providers, including those contracted or certified with DES, the CCR&R Monthly Activity Report and the CCR&R database owned by DES. This Agreement is specific to Contract. Additional data requires a Request for approval.

1b. INFORMATION TECHNOLOGY AND CONNECTIVITY TYPE (VPN, DVD, Mainframe, etc.; or some other alternative way of accessing application/data?) Select all appropriate and explain in detail below:

VPN-Client Mainframe Secure-FTP Secure-Email Other

Access to the CCR&R database at https://azchildcareprovidersearch.azdes.gov/ CFR will receive un-redacted aggregated data and/or public data for data request per their contract. DES will send the data through the Child Care IT team using excel workbooks. The Child Care IT team will complete the data transfer for the current and subsequent years.

1c. INFORMATION TYPE BEING ACCESSED (Personal Identifiable Information, FBI, SSA, HIPAA, define) PII and business information of Child Care Providers and PII of the public who submit a Child Care Complaint, Contact Us form, or Data Request form. DES may provide additional data upon written request of CFR and mutually agreed upon, signed amendment to the data sharing agreement.

SECTION I. REQUEST (Completed by Requesting Entity) Use attachment if necessary

J-119 DSA (8-23) – Page 3 of 10 Agreement No.: 234517

1d. WILL THIS INFORMATION BE RETAINED?

Yes No If Yes, where, and how?

This data is retained in the CCR&R database. CFR will retain the information in files that are password protected encrypted server.

PLEASE SELECT THE TYPE OF INFORMATION REQUESTED AND SPECIFIC FIELDS:

HIPAA PCI PHI PII Full Name Home Address SSN or National Identification Number Vehicle Registration Plate Driver’s License Number Fingerprints Credit Card Numbers Digital Identity Date of Birth Birthplace Gender/Race Health/Medical Records Wage/Tax Info Phone Number Criminal Record Medical Benefits Eligibility Records

The requester enters all information required for successful communication between the requesting entity and the DES IT Staff.

Contact Name (1): Michelle Saint-Hilarie

Contact Name (2): Diane Fellows

Contact Address: 2800 E Broadway Blvd, Tucson, AZ 85716

Contact (1) E-Mail Address: msainthilarie@cfraz.org

Contact (2) E-Mail Address: dfellows@cfraz.org

Contact Fax No: (520) 325-8780

Phone: (520) 881-8940

Phone: (520) 321-3749

2. CITE LAW, REGULATION, DIRECTIVE OR OTHER BASIS FOR THIS REQUEST

42 USC Chapter 105, Sub-chapter II-B: Child Care and Development Block Grant A.R.S. § 41-1967 Child Care Resource and Referral System. A.R.S. § § 46-806, 808, and 809 under Child Care Services. 6 A.A.C. 5 Article 50, Child Care Resource and Referral System.

SECTION I. (Continued) REQUEST (Completed by Requesting Entity) Use attachment if necessary mailto:msainthilarie@cfraz.org mailto:dfellows@cfraz.org

J-119 DSA (8-23) – Page 4 of 10 Agreement No.: 234517

3. WILL OTHER ENTITIES INTERFACE/WORK WITH YOUR ORGANIZATION?

Yes No If Yes, identify entity and reason(s) for interface:

4. WILL INFORMATION BE DISCLOSED/SHARED WITH ANOTHER ENTITY/ORGANIZATION?

Yes No If Yes, identify the entity/organization and reason(s) for disclosure:

Child Care Provider information will be shared with other entities/organizations that submit a data request to CFR as a pass through to DES. This data will only be shared with a written approval by DES. The data will be provided to CFR through the Child Care IT team. Per ARS§ 46-808 (B) Section 41-1959 does not apply to PII of Child Care Providers.

5. WILL DES DATA BE STORED IN ANY FORM OF (DATABASES, FILES, TAPES, PAPER COPIES, ETC.)? WILL

DATA BELONGING TO DES BE STORED IN A SECURE SPECIFIED ON-SITE LOCATION?

Yes No If Yes, identify where, what type of data and how the data is to be stored, and for how long:

Data will be stored in a secure on-site location for the length of time needed to complete the project.

6. DESCRIBE IN DETAIL THE SAFEGUARDS YOUR ENTITY/ORGANIZATION HAS IN PLACE TO PROTECT

AGAINST UNAUTHORIZED ACCESS/DISCLOSURE OF DES DATA/INFORMATION. EX. SECURE LOCATION, LOCKED AREAS, PASSWORD PROTECTION.

Data with PII and child care provider information is kept in a secure location such as a secure database or locked filing cabinet. Electronic data is secured by serves hosted by DES for the CCR&R Database and Salesforce for the Salesforce Customer Management System. CFR follows the Management of Information Reporting Policy to safeguard data.

J-119 DSA (8-23) – Page 5 of 10 Agreement No.: 234517

6a. IF AN INFORMATION BREACH SHOULD OCCUR, WHAT ARE YOUR PROCESSES AND PROCEDURES TO ADDRESS THIS? (See Section II, #6)

CFR staff will investigate the breach, document the breach and contact the users affected. CFR leadership will follow the processes as outlined in their agencies breach of confidentiality. CFR shall notify DES within 24hrs when an information breach occurs. Notification must be in accordance with timelines based on State and Federal laws.

7. HOW WILL THE INFORMATION BE PRESENTED FOR USE? WILL THE INFORMATION BE POSTED, DIGITALLY COPIED, APPLICATION, ETC.?

CFR staff will investigate the breach, document the breach and contact the users affected. CFR leadership will follow the processes as outlined in their agencies breach of confidentiality. CFR shall notify DES within 24hrs when an information breach occurs. Notification must be in accordance with timelines based on State and Federal laws.

8. HOW WILL THIS INFORMATION BE DISPOSED OF WHEN NO LONGER NEEDED? SEE RETENTION POLICY.

Paper documents are shredded. Electronic data is kept for 7 years in the backups. After 7 years they are purged from backups.

Print Name and Title of Authorized Contact: Melissa Busby Program Development Manager

Phone: 480-851-0604 Fax: E-mail: m b u s b y @ a z d e s . g o v

Date:08/02/2024

Mailing Address/Mail Drop: Child Care Administration – Central Office 1789 West Jefferson Street, MD 5471

City: Phoenix State: AZ ZIP Code: 85007

J-119 DSA (8-23) – Page 6 of 10 Agreement No.: 234517

SECTION II. STIPULATIONS REGARDING THE USE OF INFORMATION

STIPULATIONS APPLICABLE TO THE REQUESTING ENTITY:

1. Disclosure of the data provided to the Requesting Entity is not permitted unless specifically authorized.

2. Repackaging or redistribution of data or screens, or creation of separate files will not be permitted unless specifically authorized.

3. The data shall be used only to assist in legal valid business needs as stated in Section I, item 1a of this Agreement.

4. All data shall be stored in a physically secure, logically encrypted facility/system that follows the physical security regulations and standards based on the type of data appropriate and related standards. HIPAA / PHI / PII / PCI / PUB- 1075 etc.

5. All data in electronic format shall be safeguarded and stored, processed, and monitored so that unauthorized persons cannot compromise the information.

6. DES shall be notified within 24 hours when an information breach occurs. Notification must be in accordance with timelines based on State and Federal law.

7. Only authorized staff will be given access to accomplish the purpose(s) specified in Section I, item 1a of this Agreement.

8. All DES information system users must successfully complete the authorized information security awareness training course provided through the State of Arizona Learning Portal, which instructs users on general information security awareness concepts, such as confidentiality, privacy laws and the penalties imposed when there is non-compliance.

All users must complete the security awareness training course at the initial information system access point and are required to recertify annually thereafter.

9. A Request for Terminal Access and/or other Activity (J-125) shall be used to request specific access for each authorized staff member and must be signed by the staff supervisor or designee.

10. All authorized users are required to electronically sign the State User Affirmation Agreement, as a condition for using the requested data. The affirmation agreement must be signed at the initial information system access point and annually thereafter.

11. All changes requiring additional access or removal of access must be reported promptly within two business days to the respective user account management team via email at ISAAdmin@azdes.gov.

12. Federal and state audit and data security personnel may have access to offices and records of the requesting entity to monitor or verify compliance with this Agreement.

13. This Data Sharing Agreement will remain in effect for 5 years from the effective date unless otherwise stipulated in Section III or overridden by the Contract, a Memorandum of Understanding, or an InterAgency Agreement. If duration is overridden by another document, please reference the document in Section III.

14. Upon Contract Termination, Media Sanitization procedures shall be adhered to in accordance with Arizona Statewide Policy – P8250v 1.0 - The Business Unit shall sanitize digital and non-digital information system media containing Confidential information prior to disposal, release of organizational control, or release for reuse using defined sanitization techniques and procedures in accordance with the Media Protection Standard S8250. [NIST 800-53 MP- 6] [HIPAA 164.310(d)(2)(i)] [HIPAA 164.310(d)(2)(ii)] [IRS Pub 1075]

15. All DES Contract retention terms and conditions will be adhered to as written unless otherwise stated on DES Retention Policy [(DES 1-37-12-(01)(02)(03)] is applicable.

16. Requesting entity is responsible for all costs and licenses associated with securely connecting to DES and for maintaining confidential standards.

STIPULATIONS APPLICABLE TO PROVIDER:

1. DES will use the Requesting Entity employee identifying information solely for the purpose of establishing access.

2. Only authorized DES employees will have access to Requesting Entity employee data.

3. In accordance with applicable federal, state, and/or local privacy regulations, DES will protect all information collected from the Requesting Entity.

STIPULATIONS APPLICABLE TO HIPAA – HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT

1. All staff shall attend an authorized HIPAA awareness training class, where they will be instructed on confidentiality, privacy, information safeguards and penalties imposed when compliance is breached.

2. If applicable, a “Business Associate Contract” [45 CFR 164.502(e), 154.504(e). 164.532(d) & (e)] will be attached to this data sharing agreement as an addendum.

STIPULATIONS APPLICABLE TO DIVISION DATA OWNERS:

1. The assigned DES User Account Management representative must verify external and internal requesters, submit a service request (Cherwell), and attach the received Request for Terminal Access (J-125) and process the account creation request. A service request must contain the affected DSA number, and all contents of the Request for Terminal Access (J-125) in the service request summary field. The DES User Account Management representative must monitor and manage all accounts with access to data or with whom this DSA is in partnership.

mailto:ISAAdmin@azdes.gov

J-119 DSA (8-23) – Page 7 of 10 Agreement No.: 234517

Eric Schindler, Ph.D.

SECTION IV (B). PRIVACY RECOMMENDATIONS

(Completed by the Division HIPAA or Privacy Officer)

DES Child Care will provide the data in the fields required for the CCR&R database and other reporting requirements outlined in contract.

DES Policy 1-38-8280 and DES 1-38-8120 Which applies to: All DES personnel, contractors, volunteers and vendors who have access to any DES data, systems, facilities or clients.

TERMINATION OF AGREEMENT ONLY:

a. Information will be returned based on Contract terms and conditions. Yes No

b. Information will be truncated (erased/deleted). Yes No

c. Information in physical form shall be shredded. Yes No

d. All the above. Yes No

External Agency POC (Print Name): Eric Schindler Ph.D. Phone Number: (520) 321-3749

Signature:

Digitally signed by Eric Schindler, Ph.D.

DN: CN="Eric Schindler, Ph.D.", O="Child & Family Resoruces, Inc.", OU=President/CEO, E=eschindler@cfraz.org, C=US Reason: I am approving this document Location:

Date: 2024.01.12 13:26:16-07'00' Foxit PDF Reader Version: 2023.2.0 Date:

Recommend APPROVAL Request is not recommended for approval

Print Name: Yolanda Roberts Phone Number: (602) 771-8317 Date:

Signature: Mail Drop: 8111

Not Applicable for this Data Sharing Agreement

Print Name: Phone Number: Date:

Signature: Mail Drop:

Print Name: Phone Number: Date:

Signature: Mail Drop:

SECTION III. ADDITIONAL INFORMATION

SECTION IV (A). RECOMMENDATIONS

(Completed by the Data Managing Program/Data Owner)

SECTION IV (C). DES ENTERPRISE SERVICE DELIVERY

(Completed by DTS Service Delivery Manager)

08/02/2024

J-119 DSA (8-23) – Page 8 of 10 Agreement No.: 234517

FOR THE REQUESTING ENTITY: (Completed by Requesting Entity)

SECTION VI. APPROVAL

(Completed by Chief Information Security Officer (CISO))

I attest to the correctness of the information provided in Section I and agree to the stipulations and costs, if any, listed in Section III. I agree to comply with all provisions of the DES Information Security Policies and Procedures. If any violations of DES Information Security Policies and Procedures occur, this Agreement may be terminated. I further understand that DES will periodically review the terms of the Agreement to ensure it conforms with DES Policies and Procedures. In the event changes in either federal or state law or regulations occur that conflict with the terms of the Agreement or render the terms of the Agreement void, impracticable, or otherwise impossible, this Agreement will terminate immediately.

A new Agreement or amendment to the existing Agreement will be initiated to provide for any changes that cannot be accommodated within the provisions of the existing Agreement. The Requesting Entity shall hold harmless and indemnify the State of Arizona and the Department of Economic Security for any liability resulting from acts or omissions attributable to the Requesting Entity.

IN WITNESS HERETO, the PARTIES have executed this Agreement by signature of their duly authorized officials:

Entity Name: Child & Family Resources, Inc.

Print Signatory Name: Eric Schindler Ph. D.

Title: President/CEO

Signature: Eric Schindler, Ph.D.

Digitally signed by Eric Schindler, Ph.D.

DN: CN="Eric Schindler, Ph.D.", O="Child & Family Resoruces, Inc.", OU=President/CEO, E=eschindler@cfraz.org, C=US Reason: I am approving this document Location:

Date: 2024.01.12 13:26:33-07'00' Foxit PDF Reader Version: 2023.2.0

Date:

Entity Name: Division of Child Care

Print Signatory Name: Stacy Reinstein

Title: Project Evaluation Administrator

Signature: Date:

This signed Agreement meets all requirements necessary to permit controlled sharing of DES data while simultaneously providing for the protection of the data. I certify that:

THIS AGREEMENT CONFORMS to DES Information Security Policy [DES 1-38-8120 and 1-38-8280].

THIS AGREEMENT DOES NOT CONFORM to DES Information Security Policy [DES 1-38-8120 and 1-38-8280].

Implementation of this Agreement cannot proceed until the following action(s) is/are taken:

(Signature)

DES Chief Information Security Officer

(Title) (Date)

SECTION V. APPROVAL

(Completed by the Requesting Entity and the Data Managing Program)

FOR THE DEPARTMENT OF ECONOMIC SECURITY:

(Completed by Data Managing Program)

02/08/2024

Dan Wilkins (Aug 2, 2024 14:11 PDT) Dan Wilkins

J-119 DSA (8-23) – Page 9 of 10

ROUTING INSTRUCTIONS FOR J-119

DATA- SHARING AGREEMENT BETWEEN DES ENTITIES:

1. Sections I, II and III are completed, contact information is provided and the document is signed by the requesting

Division or Program Assistant Director, Program Administrator, or designee. The Requesting Entity Division or Program Security Analyst sends the document to the Data Managing Division/Program Security Analyst. The DSA/ PSA from the Data Managing Division/Program will complete Section III and the recommendation in Section IV. If applicable, the Division HIPAA Privacy Officer will complete the recommendation in Section IV. Reason must be given if request is not recommended for approval. Section V is signed and dated by the Data Managing Assistant Director, Program Administrator, or designee.

EXCEPTION: All DERS UI Data Sharing Agreements will follow their own established process.

2. The Data Managing Division/Program Security Analyst forwards the Agreement to the Enterprise Delivery Team for signature and approval of information technology connectivity. Enterprise service delivery team sends DSA back to the Division/Program security team for final signatures. The Agreement is signed, and dated by the Information Security Administrator. The original Agreement is sent back to the Division/Program entered on the tracking list. The Agreement is scanned as a PDF to the network shared drive where all Data Sharing Agreements are saved. DSA is not final until fully signed by all parties.

NOTE: When the Agreement is modified during the approval process, both entities must review the modifications and re-sign/date the document.

DATA-SHARING AGREEMENT BETWEEN DES AND AN EXTERNAL ENTITY:

3. Section I, II and III are completed by the requesting entity, contact information is provided and the document is signed by the requesting entity and Division or Program Assistant Director, Program Administrator, or designee. The Division or Program Security Analyst sends the document out for signatures. If applicable, the Division HIPAA Privacy Officer will complete the recommendation in Section IV. Reason must be given if request is not recommended for approval.

Section V is signed and dated by the requesting entity administrator and Data Managing Assistant Director, Program Administrator, or designee.

EXCEPTION: All DERS UI Data Sharing Agreements will follow their own established process.

4. The Data Managing Division/Program Security Analyst forwards the Agreement to the Enterprise Delivery Team for signature and approval of information technology connectivity. Enterprise service delivery team sends DSA back to the Division/Program security team for final signatures. The Agreement is signed, and dated by the Information Security Administrator. The original Agreement is sent back to the Division/Program entered into the tracking list. The Agreement is scanned as a PDF to the network shared drive where all Data Sharing Agreements are saved. DSA is not final until fully signed by all parties.

NOTE: When the Agreement is modified during the approval process, both entities must review the modifications and re-sign/date the document.

J-119 DSA (8-23) – Page 10 of 10

1. From the Contracts Division for which the Contract has been originally created, the authorized Contracts person shall contact the Security Representative from the specific Agency for which the Contract was created, notify that a Data Sharing Agreement (DSA) is needed and being requested, and a copy must be sent to the Security Analyst to start the process of creating a DSA.

a. NOTE: A DSA request will not be honored without a valid Contract (number) (if applicable) accompanying the DSA.

2. Any external Contracts agreed upon by DES that include the sharing of information require a J-119 – Data Sharing Agreement (DSA). The normal longevity of the J-119 DSA is 5 years, with annual review. The newly agreed upon Contract terms and conditions supersedes the longevity of the DSA length of 5 years to align with the Contracts terms, conditions, and longevity.

a. Example: If a newly accepted Contract of 2 years needs a DSA, the DSA will align with the Contract’s longevity of 2 years. A DSA is created.

b. If at the end of the 2 years the contract is renewed for 1 more year, then the contract’s personnel shall inform the Agency’s Security Team of the contract extension. Agency’s Security Team will update the DSA tracking database to reflect the contract extension. The DSA can be renewed every year(s) up to five (5) years (the total life cycle of a DSA) before a new DSA is created.

i. J-119A (Amendment Form) is required when additional access to other information not stipulated in the original

DSA is being requested. For any extensions/changes of a DSA along with the following requirements:

1. J-119A must document the changes to the original DSA.

2. J-119A must document the new Contract Number.

3. Document all changes made on the renewed Contract that involve terms and conditions in the sharing of information.

4. Assign an agreement number to the DSA and put the Contract number on the first page of the DSA

(preferably typed).

5. DSA with other handwritten notes, directions, alterations and scratch offs will not be accepted by SRC.

6. Security Analyst will enter all data into the DSA Database and will select status field “pending signatures to

SRC.”

Words of CAUTION:

a. Security Analyst that has created the DSA will have to reproduce the DSA once again to be compliant, no exceptions.

b. A DSA that is attached to a Contract will not be approved by SRC without a valid contract number.

3. When the Security Analyst has completed all applicable signatures, the DSA must then be sent for final review and approval to the Division of Technology Services (DTS), Security, Risk, and Compliance (SRC), Attention: Chief Information Security Officer (CISO), 1400 W. Washington Street, Mail Drop 1426, Phoenix, Arizona 85007. The DSA Agreement shall be entered into the Data Security Warehouse Database by the Security Analyst with the status of “Pending SRC Approval’’.

4. The original agreement is filed in the DES Data Managing Division/Program and the SRC Security Analyst confirms all data in the DSA database. The Agreement is not final until signed by the SRC Security Analyst, the DES Executor, and the Requesting Entity(s).

5. A final digital copy of all signatures of essential personnel mentioned above is required to SRC for SRC Security Administrator to change the DSA to ACTIVE within the database.

DATA SHARING AGREEMENT WITH INTERNAL (if applicable)

EXTERNAL CONTRACTS BETWEEN ENTITIES PROCEDURES: STEP BY STEP

Child & Family Resources, Inc. 234517 Final Audit Report 2024-08-02

Created: 2024-08-02

By: Domonique Montez (dmontez@azdes.gov)

Status: Signed

Transaction ID: CBJCHBCAABAASIZH4fU_QNrTfYe-RBL1bQ8hfyFOHrDc

"Child & Family Resources, Inc. 234517" History Document created by Domonique Montez (dmontez@azdes.gov)

2024-08-02 - 8:06:19 PM GMT

Document emailed to Yolanda Roberts (yolandaroberts@azdes.gov) for signature

2024-08-02 - 8:06:24 PM GMT

Document emailed to Stacy Reinstein (StacyReinstein@azdes.gov) for signature

2024-08-02 - 8:06:24 PM GMT

Document emailed to Dan Wilkins (danwilkins@azdes.gov) for signature

2024-08-02 - 8:06:24 PM GMT

Email viewed by Stacy Reinstein (StacyReinstein@azdes.gov)

2024-08-02 - 8:16:56 PM GMT

Document e-signed by Stacy Reinstein (StacyReinstein@azdes.gov) Signature Date: 2024-08-02 - 8:18:14 PM GMT - Time Source: server

Email viewed by Dan Wilkins (danwilkins@azdes.gov)

2024-08-02 - 9:10:36 PM GMT

Document e-signed by Dan Wilkins (danwilkins@azdes.gov) Signature Date: 2024-08-02 - 9:11:31 PM GMT - Time Source: server

Email viewed by Yolanda Roberts (yolandaroberts@azdes.gov)

2024-08-02 - 9:17:38 PM GMT

Document e-signed by Yolanda Roberts (yolandaroberts@azdes.gov) Signature Date: 2024-08-02 - 9:18:19 PM GMT - Time Source: server

Agreement completed.

2024-08-02 - 9:18:19 PM GMT