Colorado WIC Program Policies & Procedures Section 4: Organization and Management Revised: 01.01.2021

Page 1 of 2

Data Use Policy: Process to Request Participant and Applicant Data

Policy: WIC staff, state and local, direct all requests for the disclosure of individual-level, identifying WIC participant information (i.e., any non-aggregated data) to the Data Manager at the Colorado WIC State Program Office.

Regulation: 7 CFR 246.26, 7 CFR 246.7(i)(11), 7 CFR 246.3(h)(3)

Procedure/Additional Guidance:

Introduction and Background State agencies administering the WIC program are responsible for the management and protection of confidential WIC applicant and participant information. The Colorado WIC State Program carries out these responsibilities according to state agency policies that ensure compliance with Federal regulations. The USDA grants state agencies the authority to determine with whom confidential WIC applicant and participant information will be shared and for what purposes within the limitations and allowances established in Federal regulation.

Colorado WIC Program policy requires that non-WIC partners may only use PII with participant consent for the following reasons: 1) to follow up on referrals and provide additional services to participants and their families. 2) under a data use agreement to support evidence-based or promising practices that increase WIC enrollment and/or retention. 3) reporting known or suspected child abuse or neglect.

The intent of this request process is to guide public partner organizations who desire use of confidential personal information for meaningful projects that benefit WIC applicants/participants or the Colorado WIC Program. Completion of this request will provide the Colorado WIC State Program Office sufficient information to assess whether the data use purpose meets Federal regulations and upholds program data use values. Expected time for review is within 10 business days. The Colorado WIC Program Director has the authority to approve or decline this request. If a request for data use is approved, additional information about data elements and timelines may be needed to create a data use agreement with all approved parties for approved uses.

In addition to compliance with Federal regulations, the Colorado WIC Program makes decisions regarding data use according to Program policies and values. The Colorado WIC State Program Office intends to support innovation proposed by state and local partners with these values in mind:

 The protection of confidential participant and applicant data is the highest level of priority for the Colorado WIC Program to build and maintain public trust that personal data is protected.  The Colorado WIC Program holds the interests, desires, and well-being of the public, WIC participants, and WIC applicants at the center of any data use decision. The Colorado WIC Program will ensure that any data use allowed within Federal regulations provides benefit to program participants, applicants and/or to the Colorado WIC Program as a whole.  Racial and ethnic equity will be preserved by ensuring that no data use agreements result in any type of harm to people or communities of color or any people or communities impacted by public charge.  The Colorado WIC Program will ensure that only the minimum necessary protected information is provided through data use agreements.  Robust protections of personal data by the recipient organization will be ensured by the Colorado WIC Program before approving data use agreements.  Data use requests will be balanced with capacity and resource constraints of the Colorado WIC Program, as the Program does not typically receive additional funding for these purposes.

Colorado WIC Program Policies & Procedures Section 4: Organization and Management Revised: 01.01.2021

Page 2 of 2

Request Process Please answer the following questions to request confidential personally-identifiable information (PII) from the Colorado WIC Program:

 What effort or intervention does your organization plan to execute using Colorado WIC Program data? In your response, please describe how your proposal meets at least one of these state requirements for use of PII with participant consent by non-WIC partners: ○ to follow up on referrals and provide additional services to participants and their families. ○ under a data use agreement to support evidence-based or promising practices that increase WIC enrollment and/or retention. ○ reporting known or suspected child abuse or neglect.

 What evidence demonstrates that this effort or intervention has a promising or proven impact for Colorado WIC Program participants?

 Has your organization conducted engagement work with Colorado WIC Program participants to understand their perspective about your effort or intervention? If yes, please answer the following: ○ In what ways has participant engagement informed your planned effort or intervention? ○ What has the engagement work revealed about participants’ perceived benefit of this proposal? ○ What has your community engagement revealed about participants' level of comfort for the Colorado WIC Program using their personal data for these purposes?

 If your organization hopes to streamline administrative procedures and minimize staff burden, have you engaged Colorado WIC Program (state or local) staff for their perspective about the proposal? If yes, what do they perceive as the benefit to their administrative roles?

 What interventions do you hope to do differently based on the availability of this data? How may this change if this request is denied?

 During or after your effort or intervention, what findings would you share with the Colorado WIC Program about the outcomes, impacts, and discoveries of your work that could benefit the future direction of the Program statewide?

 What specific additional value does PII data provide that cannot be met by available sources of aggregate data provided by the Colorado WIC Program?

 Data Security: ○ If this request is approved, who specifically will see and/or utilize Colorado WIC Program data? Please include names, titles, a description of their roles, the name of the entities for which they work, and a description of where they appear in an organizational chart (division, unit, and which positions they report to). ○ Where and how would data from the Colorado WIC Program be stored? ○ What is your planned destruction method for sensitive data? When and would the data from the Colorado WIC Program be destroyed? ○ How can the Colorado WIC Program audit the handling of the data to ensure proper use? ○ What safeguards do you have in place to ensure Colorado WIC Program data will not be used in any way that might harm the individuals represented in the data?

 What long term or future work is planned that relates to this work and the Colorado WIC Program data used for this immediate project?

 Have you gotten permission from your organization to enter into a data use agreement with the Colorado WIC Program, if needed? If so, who would sign the agreement for your organization or program (include name, title, contact information)?

 Please submit your data request electronically to the WIC Data Manager, cdphe_nsbdata@state.co.us.