DRAFT_WVDE_AssessmentContractorDataAccess_2025.docx

Confidentiality and Non-Disclosure Agreement:

Contractors and Consultants Additional Signature Page

CONTRACTOR ACCESS TO STUDENT DATA AGREEMENT

BETWEEN

THE WEST VIRGINIA DEPARTMENT OF EDUCATION

AND

Vendor Name

This Contractor Access to Student Data Agreement (“Agreement”) is made by and between VENDOR (“Contractor”) and the West Virginia Department of Education (“WVDE”). Either Contractor or WVDE is referred to as a “Party” and both together are referred to as “the Parties.”

This Agreement supplements the contract for services between WVDE and Contractor (“Controlling Agreement”) to address the obligations of the Parties to protect the confidentiality of student data. Any term contained in this Contractor Access to Student Data Agreement which conflicts with a term in the Controlling Agreement takes precedence. Any term in the Controlling Agreement that is more stringent in its protection of student data shall control, to the extent that it does not directly conflict with a term in the Contractor Access to Student Data Agreement.

The Parties hereby agree as follows:

1. Purpose. The purpose of this Agreement is to establish the conditions, safeguards, and procedures for the disclosure of certain confidential data from the WVDE to Contractor.

Contractor requires access to certain information about students, staff, and/or finances in order to carry out its responsibilities under the terms of the Controlling Agreement. Contractor will develop, administer, and score the [ASSESSMENT NAME] for West Virginia students. [Include other brief statement of work to be accomplished by the vendor, customized pursuant to controlling contract/agreement, as needed]

2. Definitions.

a. “Confidential Information” shall include any and all personally identifiable information, as that term is defined in 34 C.F.R. § 99.3 and West Virginia Board of Education Policy 4350, § 3.1.q, and “confidential student information” as that term is defined by West Virginia Code § 18-2-5h(b)(11), in disaggregated form. Also included shall be any and all personally identifiable staff member information exempt from disclosure under the West Virginia Freedom of Information Act, W. Va. Code § 29B-1-4.

b. "Disclose" or "disclosure" means to permit access to or the release, transfer, or other communication of Confidential Information contained in education records by any means, including oral, written, or electronic means, to any party except the party identified as the party that provided or created the record.

c. “FERPA” means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, 34 C.F.R. § 99.

d. The “Student DATA Act” means the West Virginia Student Data Accessibility, Transparency and Accountability Act, W. Va. Code § 18-2-5h.

3. Term. The term of this Agreement shall commence on the date upon which both Parties have executed this Agreement and shall terminate on mm/dd/yyyy, the terminal date of the Controlling Agreement between WVDE and Contractor.

4. Termination.

a. For Cause. In the event Contractor violates any of the terms of this Agreement, WVDE may terminate this Agreement effective immediately.

b. Without Cause. This Agreement may be terminated without cause by either party hereto upon thirty (30) days written notice.

5. “Authorized Representative” Designation. For purposes of FERPA, the WVDE hereby designates Contractor an “authorized representative” pursuant to 20 U.S.C. 1232g(b)(1)(C). It is understood by the Parties that Contractor qualifies as an authorized representative working on behalf of the WVDE to perform assessment services, and authorized Contractor staff require access to certain student information in order to perform Contractor’s assigned duties, as set forth in 34 C.F.R. 99.31(a)(3), West Virginia Code §§ 18-2-5h(c)(2)(A)(i) and 18-2-5h(c)(3)(E), and West Virginia Board of Education (WVBE) Policy 4350. In addition, Contractor is developing, validating and/or administering predictive tests for West Virginia students pursuant to WVBE Policy 2340, which is a permissible purpose for disclosure of protected educational information under 34 C.F.R. § 99.31(a)(6)(i)(A), and assisting West Virginia in evaluating its education program, which is another permissible reason for disclosure under 34 C.F.R. 99.3S(a)(1).

6. Compliance with Laws. Contractor and the WVDE shall comply with the provisions and regulations of FERPA, the Student DATA Act, and WVBE Policy 4350 in all respects. Nothing in this Agreement may be construed to allow either party to maintain, use, disclose, or share personally identifiable student information in a manner not allowed by state or federal law or regulation.

7. Permitted Disclosure. WVDE may disclose necessary Confidential Information to Contractor for the purposes set forth in this Agreement.

8. Prohibited Use and Disclosure. Contractor shall not: (i) disclose any Confidential Information to any unauthorized third party; (ii) make any use of Confidential Information except to perform its obligations as described in this Agreement; or (iii) make Confidential Information available to any of its employees, officers, or agents except those individuals who have a legitimate need for the Confidential Information and who have been authorized by Contractor to use the information as a component of their project assignments. Any employees, officers, or agents granted access to Confidential Information under this Agreement must be under the direct supervision of Contractor or its subcontractors, subsidiary entities, or other agents working for or on behalf of Contractor. The term “unauthorized third party” for purposes of this Agreement does not include employees, officers, or agents of WVDE who are authorized to have access to the Confidential Information, the districts and/or school from which data originated, and the hosting service provider with security controls acceptable to WVDE.

9. Information to be Disclosed to Contractor. Pursuant to this Agreement, WVDE will disclose to Contractor the following student, staff, and/or financial information, some of which is Confidential Information, in order to allow the Parties to fulfill their responsibilities under the Controlling Agreement and WVBE Policy 2340.

[List must be customized to detail all of the SPECIFIC DATA ELEMENTS to be provided pursuant to the contracted work/needs. The example below is not to be construed as approved or recommended list for all agreements but merely serves as an example.]

For Students:

[List all specific elements here] State District Number and Name School Number and Name Unique Student Identifier Student Full Name (First, Middle, Last) Current Grade Level Birth Date Gender Race/Ethnicity Individualized Education Plan Status IDEA Indicator Limited English Proficiency Status Primary/Home Language Section 504 Status Economic Disadvantage Status Authorized Assessment Accommodations

For Staff:

[List all specific elements here]

[If needed, include a brief statement about the frequency, timing, and/or any special considerations about the provision of the data to Contractor.] No other personally identifiable information will be disclosed to Contractor.

10. Improper Disclosure. Contractor understands that the Confidential Information is protected under state and federal law and agrees to immediately notify WVDE if any of the Confidential Information is improperly disclosed, either intentionally or inadvertently.

11. Data Custodians. Contractor and WVDE shall identify at least one authorized representative or data custodian from their respective agencies who shall be responsible for processing and responding to data requests from the other party.

a. The authorized representative for Contractor shall be: [Name, email address]

b. The authorized representative for WVDE shall be: [Name, email address]

c. Either Party may ad of remove authorized representatives by providing written notice to the other Party.

12. Notices. Notices required or permitted to be sent to the Parties under this Agreement, other than data requests, shall be sent by United States Postal Service to the contact information appearing in this section. The Parties shall provide notice in writing of any change in their respective contact information.

a. To WVDE. Notices to WVDE under this Agreement shall be sent to:

West Virginia Department of Education Attn: [Data Custodian Name] 1900 Kanawha Blvd. East Building 6, Suite 550 Charleston, WV 25305

b. To Contractor. Notice to Contractor under this Agreement shall be sent to:

Vendor/Contractor Name Attn: [Data Custodian Name] Address Line 1 Address Line 2 City, ST ZIP

13. Written Assurances. Upon request of WVDE, Contractor shall permit the WVDE to review or shall provide written assurances to WVDE regarding the use of Confidential Data under this Agreement. The purpose of this provision is to ensure that appropriate policies and procedures are in place to protect the Confidential Information and that there has been no unauthorized disclosure of the Confidential Information.

14. Attestation. All employees, officers, and agents under direct supervision of the Contractor with access to the Confidential Information must be aware of and abide by the provisions of this Agreement.

a. Contractor Acknowledgment of Responsibilities. Contractor will attest to the organizational acceptance of this responsibility by executing the “Contractor Acknowledgment of Responsibilities under FERPA and Related Privacy Regulations” (included as an attachment to this Agreement).

b. Individual Acknowledgment of Responsibilities. Contractor will also provide confirmation that individuals with access to the Confidential Information have been trained for and acknowledge their individual responsibilities to safeguard the privacy of student data. Contractor may select one of the following options to satisfy this requirement:

· Providing evidence of the successful completion of relevant student privacy-related training, such as online training modules offered through the U.S. Department of Education Student Privacy Policy Office as offered by WVDE personnel;

· Providing copies of corporate non-disclosure agreements signed by individuals that specifically address student data/student privacy; or

· Providing copies of the “Confidentiality and Nondisclosure Agreement” (included as a second attachment to this Agreement) signed by individuals.

Electronic signatures are acceptable. Contractor agrees to remove any person from performing work who has, or is suspected to have, violated the terms of this Agreement and agrees to discontinue its use of services from any subcontractor or similar entity if any of its staff has, or is suspected to have, violated the terms of this Agreement.

15. Ownership. WVDE retains ownership of the Confidential Information. By disclosing Confidential Information to Contractor, WVDE is in no way assigning ownership of the Confidential Information. Upon the termination of this Agreement for any reason, including expiration pursuant to item 3, Contractor shall immediately destroy all Confidential Information, including all copies, in its possession, custody, or control unless otherwise agreed to in writing by both parties or shall return such information to WVDE. Destruction and/or return of Confidential Information must occur within 30 calendar days of the termination of this Agreement. Upon request, Contractor will provide WVDE with affidavits to this effect.

16. Governing Law and Venue. This Agreement shall be governed by and construed in accordance with the laws of West Virginia. Any lawsuit pertaining to or affecting this Agreement shall be venued in the West Virginia Court of Claims or the Circuit Court of Kanawha County, West Virginia.

17. Assignment. Neither this Agreement nor any of its terms, in whole or in part, may be assigned by the Parties. And attempted assignment shall be voided.

18. Severability. In the event any term or condition of this Agreement is found to be unenforceable by a court of competent jurisdiction, the remaining terms and conditions shall remain in full force and effect.

19. Integrations. This Agreement contains and represents the entire agreement between the Parties and supersedes any and all prior agreements, whether oral or written, between the Parties on the subject matter of this Agreement.

20. Amendment. This Agreement may not be amended or modified except by written agreement signed by the Parties.

In witness hereto, the Parties signify their agreement by signature below:

Signature, Authorized Representative

Date

VENDOR

Printed Name and Role, VENDOR

Signature, Authorized Representative

Date

West Virginia Department of Education (WVDE)

Printed Name and Role, WVDE

WVDE: Contractor Access to Student Data Agreement | Page 3 Contractor Acknowledgment of Responsibilities under FERPA and Related Privacy Regulations Contractor/Consultant Leadership This acknowledgment must be signed by leaders of projects wherein contractor staff will have access to individual West Virginia student data.

Your organization has been hired by the West Virginia Department of Education (WVDE) to perform services that require you and/or your staff members to access and use personally identifiable information (PII) from students’ education records. Your (and your staff members’) access to and use of the PII is governed by the Family Educational Rights and Privacy Act (FERPA); West Virginia Board of Education (WVBE) Policy 4350, Procedures for the Collection, Maintenance and Disclosure of Student Data (126 CSR 94); and the West Virginia Student Data Accessibility, Transparency and Accountability Act (Student DATA Act, W. Va. Code § 18-2-5h). These regulations, particularly FERPA and WVBE Policy 4350, require the WVDE to use reasonable methods to ensure that you and your organization comply with laws and regulations.

Any questions about information in this document should be directed to your WVDE point of contact:

Tim Conzett, Technology Officer, Office of Data Management & Information Systems (tim.conzett@k12.wv.us)

Your organization has a written agreement with the WVDE detailing several points, including

· the PII that is shared with (disclosed to) your organization

· a description of the reason why your access to PII is required

· a plan, including a timetable, for destroying the PII once your organization no longer needs the information to perform services and functions for the WVDE

· policies and procedures to protect PII from unauthorized disclosure, access, or use

Your Responsibilities Regarding District Students’ Information

You must ensure that all data for and from West Virginia students is properly protected. Your (and your organization’s[footnoteRef:1]) responsibilities include ensuring that student PII is [1: “Your organization” in the context of this agreement includes staff regularly employed by your organation and any subcontractors used to carry out the obligations of the agreed-upon services.]

· Adequately protected once the data are under your control Comprehensive security standards should protect your electronic data systems. Standardized policy and procedures, including role-based access controls, should be in place to mitigate data security risks.

· Not disclosed to another party (except to the WVDE or the districts/schools in which the students are enrolled) Data about West Virginia students must not be shared with unauthorized users and must be safe from inadvertent disclosure due to careless handling or negligence by your organization’s employees.

· Protected in any public reporting Appropriate disclosure avoidance techniques must be applied.

· Not used for other purposes Your and your organization’s access to student PII has been provided only to perform the specific services and functions outlined in the contract and/or data access agreement between your organization and the WVDE. Identifiable student data must not be used for other purposes.

· Destroyed by the agreed-upon date listed in the data access agreement between your organization and the WVDE Identifiable student data must be destroyed when it is no longer needed for the specific purpose for which it was disclosed.

Additionally, as a leader in your organization whose staff members/supervisees will have access to PII and other data for West Virginia students, you must ensure that all staff with such access understand and acknowledge their responsibilities under FERPA and West Virginia privacy regulations listed in this document.

Acknowledgment and Acceptance of Responsibilities

I acknowledge that I have read the above information and will uphold all responsibilities outlined in this document, including ensuring that all staff with access to PII about West Virginia students understand their responsibilities under FERPA and related West Virginia privacy statutes.

Signature

Date

Contractor/Consultant Name and Title

Contractor/Consultant Organization Name

Confidentiality and Non-Disclosure Agreement:

Contractors and Consultants This agreement should be signed by all staff/employees who will have access to individual student or staff data.

The West Virginia Department of Education (WVDE) maintains strict expectations regarding the security and confidentiality of the WVDE data systems, computing networks, devices connected to WVDE networks, and all resources accessible on these networks. Contractors, consultants, interns, and other external parties performing work on behalf of the WVDE are expected to comply with these expectations, implement standard security practices, and exercise ethical behavior when granted access to WVDE data systems and networks.

I acknowledge that as a contractor or consultant (or employee of an organization acting in such a capacity) for the West Virginia Department of Education (WVDE) tasked with accessing, analyzing, and/or interpreting various data, I am considered an authorized representative of the WVDE, and, as part of my job-related duties, may have need to access staff- and student-level information or other privileged information processed, stored, or managed by education systems in West Virginia (hereafter, termed “confidential information”). Confidential individual-level and/or personally identifiable information includes all information protected by federal or state law, especially relevant to WVDE data are the Family Educational Rights and Privacy Act (FERPA); West Virginia Board of Education (WVBE) Policy 4350 (Procedures for the Collection, Maintenance and Disclosure of Student Data); the Student Data Accessibility, Transparency, and Accountability Act (Student DATA Act, W. Va. Code §18-2-5h), and other portions of W. Va. Code Chapter 18; and the WVDE Data Access and Management Guidance.

By my signature below, I understand, acknowledge and agree that:

1. The unauthorized disclosure, retention, or negligent handling of confidential information could compromise the integrity of WVDE or school systems; cause damage to the reputation of WVDE; impede operations; and violate state and federal law.

2. I may be subject to the loss of access privileges in WVDE and in other contexts for the unauthorized disclosure, retention, or negligent handling of confidential information.

3. Any breach for which I am responsible may result in the termination of my own and/or my organization’s work with the WVDE and may adversely affect future prospects for work with the department.

4. Any breach of this agreement may be disclosed to those federal, state, and local agencies with which the WVDE collaborates.

5. Any breach for which I am responsible may result in legal action by the WVDE or other authorities.

6. It is a violation of this agreement to read, copy, modify, delete, distribute or otherwise access confidential information unless required to do so to carry out my assigned duties.

7. I shall not discuss confidential information processed, stored or managed by WVDE, any district, or any school with anyone, whether within these institutions or outside unless required as part of my job.

8. I will implement appropriate physical, electronic, and managerial safeguards to prevent unauthorized access to, or disclosure of, confidential information.

9. I will promptly destroy or return all confidential identifiable information to which I may have access at the end of my term of service at the WVDE.

10. This Confidentiality and Nondisclosure Agreement remains in full force and effect after the conclusion, termination, or expiration of my work with the WVDE.

Signature

Date

Contractor/Consultant Name

Contractor/Consultant Organization Name

Signature

Date

Contractor/Consultant Name

Contractor/Consultant Organization Name

Signature

Date

Contractor/Consultant Name

Contractor/Consultant Organization Name

Attach additional signature pages as needed for all employees subject to this agreement.

Signature

Date

Contractor/Consultant Name

Contractor/Consultant Organization Name

Signature

Date

Contractor/Consultant Name

Contractor/Consultant Organization Name

Signature

Date

Contractor/Consultant Name

Contractor/Consultant Organization Name

Signature

Date

Contractor/Consultant Name

Contractor/Consultant Organization Name

WVDE Confidentiality and Non-Disclosure Agreement: Contractors & Consultants (v.04222021) Page | Additional image1.jpeg