2021 ANNUAL PRIVACY NOTICE

Submitted on: August 04, 2021

SHARE Head Start program must annually notify par­ents of their rights in writing described in Head Start Program Performance Standards (HSPPS) 1303. Included in notice is a description of the types of Personally Identifiable Information (PII) that may be disclosed, to whom the PII may be disclosed, and what may constitute a necessary reason for the disclosure without parental consent.

25.0    Purpose:     

SHARE Head Start recognizes that in certain instances it must collect, store and use Sensitive Information relating to its participants, staff or other project beneficiaries associated with SHARE as well as certain types of research data. SHARE Head Start is dedicated to collecting, handling, storing, using and the disposition of sensitive information properly and securely. This Policy establishes administrative, technical and physical safeguards for the protection of sensitive and Personally Identifiable Information throughout the agency to ensure compliance with applicable laws and to:

• Eliminate unnecessary collection and use of Sensitive Information;
• Protect against anticipated threats or hazards to the security or integrity of Sensitive Information; and
• Protect against unauthorized access to or use of Sensitive Information in a manner that creates a substantial risk of identity theft, fraud or other misuse of the data.

 All information in participants and staff files is confidential and is not to be discussed with anyone unless the information is essential for reasons clearly related to program services. Confidential information shall also include all Personally Identifiable Information (PII) data, reports, some meeting content, technology (information on desktops, laptops and tablet computers), computer programs, non-public information, and any other information disclosed orally, submitted in writing or by any other media that is not approved for dissemination.

 PROTECTIONS FOR THE PRIVACY OF CHILD RECORDS

 25.1     Policy:

SHARE Head Start program must establish procedures to protect the confidentiality of any Personally Identifiable Information (PII) in child records per §1303.20. Personally Identifiable Information (PII) is defined as that information about a participant, family member or other staff person which would make it possible to identify that person with reasonable certainty. This includes any document or information that has names, addresses, telephone numbers, social security numbers, insurance information, or any other data that can readily identify the person, including data management reports from ChildPlus.

All SHARE Head Start staff will follow procedural safeguards to protect the confidentiality of all information/records, inclusive of staff and family information. (§1303.21)

Procedures:

1. SHARE Head Start maintains all child files in a locked and secure location in the central filing office and each center location. Electronic files in the ChildPlus database are maintained with individual identification numbers to promote privacy and security of information. Access to electronic files requires individual log in and password information by authorized staff and managers.

 

1. If SHARE Head Start serves a child who is referred to, or found eligible for services under, IDEA, then the program must comply with the applicable confidentiality provisions in Part B or Part C of IDEA to protect the PII in records of those children, and, therefore, the provisions in this subpart do not apply to those children.

 

1. At Registration, Family Advocates explain child and family confidentiality to ensure a clear understanding of their rights according to the Head Start Program Performance Standards: 1303 Subpart C--Personally Identifiable Information (PII) in child records. Families are asked to sign consent forms to allow program staff to share essential service information with necessary direct service staff and partners (including the mental health consultant, nutrition, medical and oral health partners, and partners delivering services in accordance with the (Individuals with Disabilities Education Act). Consent forms include:
2. Name of the child
3. Name of the parent(s) or legal guardian(s)
4. Name of the person, program, or agency with whom the information will be shared.
5. Reasons for sharing the information
6. The information that will be shared
7. Parent or legal guardian signature and date
8. A statement that the release can be revoked by the parent or legal guardian at any time
9. An expiration date for the release (at the end of the program year)

 

1. SHARE Head Start managers will work with health partners to support their compliance with the Health Information Portability and Accountability Act (HIPAA) as well with families to understand their rights under this law. In addition, SHARE Head Start managers will provide information to families regarding the benefits and barriers of sharing health information between the program and health providers offering services to children.

 

1. Managers, staff, consultants and volunteers (healthcare or service partners) will follow the following standards of conduct regarding confidentiality:
2. Discussions regarding children, families, and other staff members will not occur within contexts that would impair the privacy or confidentiality of the individual concerned. This includes public conversations both within and outside of the program environment;

 

2. Identifying information will be removed from any reporting information if parents or legal guardians have not consented to sharing;

 

3. Staff will not use private texts or emails to share personal and confidential information, except in approved conditions. Communication with others that includes personal information will be conducted by phone, written communication delivered through the US mail service or hand delivered, and/or through a protected email server, except in approved conditions.

 

1. All videos, photos, work samples, and other graphic representations of children’s private information will not be released on program promotional materials including websites, reports, or presentations without parental consent for use.

 

1. All staff will receive training in confidentiality procedures in staff orientation and will receive ongoing supervision and support to meet requirements. If a breach of confidentiality occurs, the individual’s supervisor will conduct one-on-one supervision with the staff member to ensure a breach does not re-occur. Breaches in confidentiality will lead to disciplinary action or termination.

 

1303. SHARE Head Start program must annually notify par­ents of their rights in writing described in HSPPS 1303.23 and include in that notice a description of the types of PII that may be disclosed, to whom the PII may be disclosed, and what may constitute a necessary reason for the disclosure without parental consent.

 

1303. Children and staff files will be maintained as outlined in policies, and then disposed of per the agency document retention and destruction protocol in alignment with HSPPS 1303.224. The Policy is designed to ensure compliance with federal and state laws and regulations, to eliminate accidental or innocent destruction of records and to facilitate SHARE Head Start’s operations by promoting efficiency and freeing up valuable storage space.

 

1. Document destruction will be suspended immediately, upon any indication of an official investigation or when a lawsuit is filed or appears imminent. Destruction will be reinstated upon conclusion of the investigation.

 

1. SHARE Head Start management will conduct regular document review to ensure confidentiality and privacy measures ensure the protection of sensitive and confidential information. Adjustments will be made to the confidentiality procedures, if needed.

 

1. Substitutes will only have access to PII as deemed appropriate by the immediate supervisor to carry out duties as assigned. Staff will only discuss confidential information in the presence of substitutes as necessary in implementing Head Start services.

 

1. Contractors (consultants), including diagnostic service contractors must adhere to all Federal, state and SHARE Head Start confidentiality policies and procedures.

 

1. Volunteers may not have access to confidential information. Staff may not discuss PII in the presence of volunteers, parents, or children.

DISCLOSURES WITH, AND WITHOUT, PARENTAL CONSENT

25.2     Policy:            

SHARE Head Start must obtain a parent’s written consent before the program may disclose PII from child records; and follow requirements as outlined in HSPPS 1303.22.

Procedures:

1. Disclosure with parental consent
2. Staff must obtain the parent’s written con­sent which –

• specifies what child records may be disclosed,
• explains why the records will be disclosed, and
• identifies the party or class of parties to whom the records may be disclosed.

2. The written consent must be signed and dated.

“Signed and dated written consent” under this part may include a record and signature in electronic form that:

• Identifies and authenticates a particular person as the source of the electronic con­sent; and,
• Indicates such person's approval of the information.

                      

3. The program must explain to the parent that the granting of consent is voluntary on the part of the parent and may be revoked at any time. If a parent revokes consent, that revo­cation is not retroactive and therefore it does not apply to an action that occurred before the consent was revoked.

 

1. Disclosure without parental consent but with parental notice and opportunity to refuse
2. The program must notify the parent about the disclosure.

 

2. The program must provide the parent, upon the parent’s request, a copy of the PII from child records to be disclosed in advance.

 

3. The program must give the parent an opportunity to challenge and refuse disclosure of the information in the records, before the program forwards the records to officials at a program, school, or school district in which the child seeks or intends to enroll or where the child is already enrolled so long as the disclosure is related to the child's enrollment or transfer.

 

1. Disclosure without parental consent

SHARE may disclose such PII from child records without parental consent to:

1. Officials within the program or acting for the program, such as contractors and sub recipients, if the official provides services for which the program would otherwise use employees, the program determines it is necessary for Head Start services, and the program maintains oversight with respect to the use, further disclosure, and maintenance of child records, such as through a written agreement;
2. Officials within the program, acting for the program, or from a federal or state entity, in connection with an audit or evaluation of education or child development programs, or for enforcement of or compliance with federal legal requirements of the program; provided the program maintains oversight with respect to the use, further disclosure, and maintenance of child records, such as through a written agreement, including the destruction of the PII when 1303.23 no longer needed for the purpose of the disclosure, except when the disclosure is specifically authorized by federal law or by the responsible HHS official;
3. Officials within the program, acting for the program, or from a federal or state entity, to conduct a study to improve child and family outcomes, including improving the quality of programs, for, or on behalf of, the program, provided the program maintains oversight with respect to the use, further disclosure, and maintenance of child records, such as through a written agreement, including the destruction of the PII when no longer needed for the pur­pose of the disclosure;
4. Appropriate parties in order to address a disaster, health or safety emergency during the period of the emergency, or a serious health and safety risk such as a serious food allergy, if the program determines that disclosing the PII from child records is necessary to protect the health or safety of children or other persons;
5. Comply with a judicial order or lawfully issued subpoena, provided the program makes a reasonable effort to notify the parent about all such subpoenas and court orders in advance of the compliance, unless:

• A court has ordered that neither the subpoena, its contents, nor the information pro­vided in response be disclosed;
• The disclosure is in compliance with an ex parte court order obtained by the United States Attorney General (or designee not lower than an Assistant Attorney General) con­cerning investigations or prosecutions of an offense listed in 18 U.S.C. 2332b(g)(5)(B) or an act of domestic or international terrorism as defined in 18 U.S.C. 2331.
• A parent is a party to a court proceeding directly involving child abuse and neglect (as defined in section 3 of the Child Abuse Prevention and Treatment Act (42 U.S.C. 5101)) or dependency matters, and the order is issued in the context of that proceeding, additional notice to the parent by the program is not required; or,
• A program initiates legal action against a parent or a parent initiates legal action against a program, then a program may disclose to the court, also without a court order or subpoena, the child records relevant for the program to act as plaintiff or defendant.

6. The Secretary of Agriculture or an authorized representative from the Food and Nutrition Service to conduct program monitoring, evaluations, and performance measurements for the Child and Adult Care Food Program under the Richard B. Russell National School Lunch Act or the Child Nutrition Act of 1966, if the results will be reported in an aggregate form that does not identify any individual: provided, that any data collected must be protected in a man­ner that will not permit the personal identification of students and their parents by other than the authorized representatives of the Secretary of Agriculture and any PII must be destroyed when the data are no longer needed for program monitoring, evaluations, and performance measurements;
7. A caseworker or other representative from a state, local, or tribal child welfare agency, who has the right to access a case plan for a child who is in foster care placement, when such agen­cy is legally responsible for the child's care and protection, under state or tribal law, if the agency agrees in writing to protect PII, to use information from the child’s case plan for specific purposes intended of addressing the child's needs, and to destroy information that is no longer needed for those purposes; and,
8. Appropriate parties in order to address suspected or known child maltreatment and is con­sistent with applicable federal, state, local, and tribal laws on reporting child abuse and neglect.

 

1. Written agreements
2. When SHARE Head Start establishes a written agreement with a third party, the program will annually review and, if necessary, update the agreement.

 

2. If the third party violates the agreement, then the program may:

(1) Provide the third party an opportunity to self-correct; or,

(2) Prohibit the third party from access to records for a set period of time as established by the programs governing body and policy council.

Limit on disclosing PII

SHARE Head Start program must only disclose the information that is deemed necessary for the purpose of the disclosure.

PARENTAL RIGHTS

(a) Inspect record.

(1) A parent has the right to inspect child records.

(2) If the parent requests to inspect child records, SHARE Head Start program must make the child records available within a reasonable time, but no more than 45 days after receipt of request.

(3) If SHARE Head Start program maintains child records that contain information on more than one child, the program must ensure the parent only inspects information that pertains to the parent’s child.

(4) SHARE Head Start program shall not destroy a child record with an outstanding request to inspect and review the record under this section.

(b) Amend record.

(1) A parent has the right to ask SHARE Head Start to amend information in the child record that the parent believes is inaccurate, misleading, or violates the child’s privacy.

(2) SHARE Head Start program must consider the parent’s request and, if the request is denied, render a written decision to the parent within a reasonable time that informs the parent of the right to a hearing.

 

(c) Hearing.

(1) If the parent requests a hearing to challenge information in the child record, SHARE Head Start program must schedule a hearing within a reasonable time, notify the parent, in advance, about the hearing, and ensure the person who conducts the hearing does not have a direct interest in its outcome.

(2) SHARE Head Start must ensure the hearing affords the parent a full and fair opportunity to pres­ent evidence relevant to the issues.

(3) If the program determines from evidence presented at the hearing that the information in the child records is inaccurate, misleading, or violates the child’s privacy, the program must either amend or remove the information and notify the parent in writing.

(4) If the program determines from evidence presented at the hearing that information in the child records is accurate, does not mislead, or otherwise does not violate the child’s privacy, the program must inform the parent of the right to place a statement in the child records that either comments on the contested information or that states why the parent disagrees with the program’s decision, or both.

(d) Right to copy of record.

SHARE Head Start must provide a parent, free of charge, an initial copy of child records disclosed to third parties with parental consent and, upon parent request, an initial copy of child records disclosed to third parties [without consent], unless the disclosure was for a court that ordered neither the subpoena, its contents, nor the information furnished in response be disclosed.

(e) Right to inspect written agreements.

A parent has the right to review any written agreements with third parties.

SHARE Head Start must maintain, with the child records, for as long as the records are maintained, information on all individuals, agencies, or organizations to whom a disclosure of PII from the child records was made (except for program officials and parents) and why the disclosure was made. If a program uses a web-based data system to maintain child records, the program must ensure such child records are adequately protected and maintained according to current industry security stan­dards.

 

If a parent places a statement in the child record, the program must maintain the statement with the contested part of the child record for as long as the program maintains the record and, disclose the statement whenever it discloses the portion of the child record to which the statement relates.