AttachmentF_AdditionalSecurityCompliance_12_pagenumbers.doc

PAGE

ATTACHMENT F

ADDITIONAL SECURITY COMPLIANCE

Additional Compliance ConsiderationsPRIVATE

PRIVATE

1. Protection of datatc \l 3 "1. Protection of data" The confidentiality of individually identifiable information contained in documents, data, and other information supplied by the National Center for Education Statistics, U.S. Department of Education (NCES/ED) or acquired in the course of performance under this contract, furnished under the provisions of section 406 of the General Education Provisions Act (20 U.S.C. 1221e-1), is a material aspect of the contract, and must be maintained, as provided in Paragraphs 4(A) through (F) of Section 406 of the General Education Provisions Act and 5 U.S.C. 552a. Further, the Privacy Act of 1974, as amended also applies.

In accordance with these regulations, the contractor agrees to be fully responsible for maintaining the confidentiality of all documents, data, and other information supplied by NCES or acquired in the course of performance of this contract, except for any documents or other information specifically designated as nonconfidential by NCES. The contractor shall take such measures as are necessary to maintain the required security including, but not limited to, the following:

a) The contractor shall have all employees who will have access or the ability to gain access to the above described NCES documents, data, or other information execute the Affidavit of Nondisclosure, which evidenced their having taken an oath not to disclose individually identifiable information, before any information is transmitted to, or acquired by, the contractor. These Affidavits of Nondisclosure will be executed and the original transmitted to NCES within 10 working days of the start date of the contract;

b) Prohibit and effectively prevent any person other than the project team members of the contractor (or other employees for whom access is necessary for the effective performance in the project) from seeing or having access to the acquired information discussed above while it is in the possession or under the control of the contractor;

c) Prohibit and effectively prevent any project team member (or other employee for whom access is necessary for the completion of the project), while employed by the contractor, from disclosing the contents or description of the documents or information to any person not authorized under this contract, or by NCES, to have access to such documents or information;

d) Prohibit and prevent removal of any of the acquired documents or information in any form from the premises of the contractor, without authorization by the COTR or other designated appropriate NCES officials;

e) Maintain all data storage, maintenance and management in accordance with ED's ADP standards, NCES standards, and the attachment entitled, “Security Procedures” (Attachment E).

The contractor shall report to NCES breaches of this agreement and its requirements by any employee as soon as any such breach becomes known. A breach by any employee of his/her Affidavit of Nondisclosure shall be considered a material breach of this provision of the contract. At the determination of NCES, the contractor shall assign all of its rights of action against the particular employee(s) to the United States.

A copy of this confidentiality provision, together with the attachment entitled, “Security Procedures,” shall be provided by the contractor, to every employee utilized in the performance of this project. Any dispute arising under the agreement shall be resolved in accordance with the Disputes Clause of this contract.

The penalty for unlawful disclosure is a fine of not more than $250,000 (under 18 U.S.C. 3559 and 3571) or imprisonment for not more than 5 years or both.

Under no circumstances shall the contractor release personally identifiable information (except as necessary to transfer to later follow-up contractors). Information which identifies persons shall be maintained in files which are physically separate from other research data and which are accessible only to authorized agency and contractor personnel.

Individual identifiers shall be associated with data only for purposes of data gathering, matching new data with old, establishing sample composition, authenticating data collections, or obtaining missing data. The contractor shall be responsible for maintaining the strictest confidentiality for all individual data collected in this survey.

The contractor shall enforce strict procedures for assuring confidentiality. These procedures shall apply to all phases of the project and should include but not be limited to: data collection in the field; coding and editing phases of data prior to machine processing; safeguarding response documents; and maintenance of student follow-up information files which physically separate the identifying data required for follow-up from the data required for research purposes.

The contractor shall be familiar with, and be prepared to comply with:

1) The Privacy Act of 1974, P.L. 93-579, 5 USC 552a;

2) E-Government Act of 2002, Title V, Subtitle A, Confidential Information Protection (CIP 2002);

3) The "Buckley Amendment", Family Educational and Privacy Act of 1974, 20 USC 1232g;

4) The Freedom of Information Act, 5 USC 552;

5) Related regulations, including but not limited to: 41 CFR Part 1-1, 45 CFR Part 5b, and 40 FR 44502 (September 26, 1975);

6) Hawkins-Stafford Elementary and Secondary School Improvement (P.L.100-297) Amendments of 1988;

7) Section C of Education Sciences Reform Act of 2002 (P.L.107-279);

8) Title IV of the Improving America's Schools Act of 1994, P.L.103-382;

9) US Patriot Act of 2001;

10) Federal Statistical Confidentiality Order of 1997; and

11) Any new legislation which impacts the data collection through this contract.

Further, the contractor shall adhere to NCES Standard 4-2 Standard for Maintaining Confidentiality, and related standards and procedures, and any more recent legislative mandates including, but not limited to, those described above.

The contractor shall be prepared to develop compliance procedures in cooperation with the COTR concurrently with the development of the study design. Survey participants, if they so request, must be given access to their records and be permitted to amend their responses. All students and individuals asked to participate shall be informed of the following: NCES enabling legislation; the purposes for which the information is needed; uses which may be made of the individual's responses; that data will not be reported in a way to reveal individuals" responses; and that participation is voluntary, with no adverse action if the requested information is not provided.

2. NCES Review and Approval

Reports prepared by the contractor shall follow guidelines referenced by NCES's standards (NCES 2003-601), as amended. The NCES review process may take as much as 12 months, depending on the type of report. Schedules for publication releases shall be kept and NCES standards for all phases of report production shall be followed. All materials must be approved by NCES before release. The contractor shall not release any data in raw or derived form to anyone without NCES's review and approval.