Colorado WIC Program Policies & Procedures Section 4: Organization and Management Revised: 07/01/2026

Page 1 of 4

Data Use Policy: Use of Program Participant and Applicant Data

Policy: WIC staff, state and local, direct all requests for the disclosure of individual-level, identifying WIC participant information (i.e., any non-aggregated data) to the Data Manager at the Colorado WIC State Office. The following policy is used to assess the ability to fulfill data requests.

Regulation: Federal:7 CFR 246.26, 7 CFR 246.7(i)(11), 7 CFR 246.3(h)(3) State: § 24-74-102(1), C.R.S. and § 24-74-103 CRS

Procedure/Additional Guidance: This data use policy clarifies when and how Colorado WIC State Program participant data will be shared with state, local, and external entities while protecting participant confidentiality.

Aggregated Data Aggregated data arise from processing individual records into summary form in order to track information across populations, organizations, time and other variables of interest. State and local Colorado WIC Program staff may access aggregated data via WIC Data Central (WDC) and Compass reports. Requests for additional aggregated data not available on WDC or within Compass reports shall be directed to the Data Manager.

Maintaining Statistical Stability Aggregated WIC data sometimes describe rare events and/or small populations, which may compromise statistical stability. Therefore, when possible, aggregated data produced by the Data Manager shall include a description of the variability of the data (i.e., confidence intervals, relative standard error). Additionally, the Data Manager will recommend the requester interpret any counts of less than 30 with caution given the small sample size.

Maintaining Confidentiality When data use occurs outside of state and local Colorado WIC Program staff, rare events and small populations may also endanger participant confidentiality. Counts of 20 or less will be censored when producing tables that will be viewed outside of state or local WIC staff to maintain confidentiality. The Data Manager also uses caution when sharing aggregate data with populations of less than 500, and producing multiple tables from the same dataset. Should there be concern about a possible breach of confidentiality when sharing outside of state and local WIC staff, the Data Manager will take steps to limit this risk through strategies such as: combining alike groups, producing a courser analysis, and omitting tables unlikely to contain information that would inform public health efforts.

Personally Identifying Information (PII) Per Federal regulations (§246.26), PII includes any information that individually identifies an applicant, participant, and/or family member(s) that was obtained or created during the course of an individual(s) WIC referral, application, or program participation. This includes but is not limited to: name; WIC participant number; contact information (may include address, phone, email); health data; the fact that a person was referred, applied, and/or participated in WIC; date of birth; health insurance number; source of income; status as a recipient of public assistance; race; ethnicity; gender identity; physical, intellectual and/or developmental disability.

In accordance with Federal regulation §246.7(i)(11), WIC applicants and participants acknowledge in the Participant Rights & Responsibilities form through the following language that their PII may be shared for these allowed purposes: ● “WIC respects my privacy. Information I give is used to verify if I qualify and to provide me with services. My information may be shared only with programs directly connected with WIC and for reports and audits as approved by the Colorado WIC Data Use Policy. Any other sharing of information must be approved by me with a signed or verbal consent.” ● “WIC staff are mandatory reporters. They are required to report suspected child abuse or neglect.”

Colorado WIC Program Policies & Procedures Section 4: Organization and Management Revised: 07/01/2026

Page 2 of 4

The local Colorado WIC agency must permit applicants and participants to refuse to sign/acknowledge the Rights & Responsibilities statement but must also notify the applicants and participants that signing/acknowledging the form is a condition of program eligibility and participation. These forms must be signed/acknowledged only after the certification is complete.

A verbal acknowledgment is allowed instead of a signature for those participants who are participating in a remote appointment.

Prior to PII disclosure for the allowed purposes listed below, the state WIC agency requires a completed data request process. If the request is approved, a data use agreement is created to include: a) Specific PII to be shared, why PII is critically necessary, the intended purpose of PII, time frame of PII use, specific individuals with access to PII, plan for safekeeping and timely destruction of PII, and assurance that the partner will not use the information for any other purpose or disclose the information to a third party. b) Approval of the Colorado WIC director, the director of the CDPHE Office of Legal & Regulatory Compliance, and CDPHE Privacy Officer. c) Signature of the Executive Director of CDPHE. d) Amendment to the WIC State Plan in accordance with federal regulation §246.3(h)(3).

The Colorado State WIC Program provides only the PII reasonably necessary to accomplish the approved purpose(s). The initiation of a data request does not compel the Colorado WIC Program to provide PII to the requestor. The Colorado State WIC office will make every attempt to use aggregated data in lieu of disclosing PII in meeting the needs of a requestor. If a request cannot use aggregated data and does not present a clear benefit to applicants/participants or the Colorado State WIC program as a whole, the request will be denied.

If the data requested requires matching or may involve research, Colorado State WIC follows the Prevention Services Division procedure related to these types of requests.

In alignment with USDA Food and Nutrition Service (FNS) Instruction 800-1, State WIC does not allow the use of universal consents which give an agency unlimited authority to release applicant or participant information, or to take the place of sharing agreements with health and welfare organizations detailed in the regulations. Such open- ended release forms could result in inappropriate sharing of information and reduce the protection of applicant/participant PII.

Disclosure to WIC staff for WIC Purposes State WIC provides access to PII to state and local WIC staff who administer WIC programming through the data management information system, Compass. Only authorized users are allowed access to this information; no non-WIC staff can be authorized for this access. Notification must be provided as to how the data may be used or shared.

Disclosure to Participant’s Healthcare Provider Participants may consent or deny consent to disclosure of personal information to their healthcare providers. This consent or denial of consent is recorded in Compass in the Nutrition Interview and a signature is captured when the participant signs the Colorado WIC Rights & Responsibilities document. The Colorado WIC Rights & Responsibilities states, “I have been asked about disclosing my confidential healthcare information with my provider. That information can be found in the Nutrition Interview.” Prior to documenting a participant’s preference (Yes or No) for disclosing information to their healthcare provider, the participant must be notified that their answer (consent or denial) is not a condition of their eligibility, and the possible reasons why information may be shared with their provider.

Any information shared with the healthcare provider should be minimum necessary. Minimum necessary means only the relevant information needed to accomplish the task can be shared.

Limited Disclosure to Non-WIC Partners for Approved Purposes Limited disclosure is a one-time release of information and does not include back and forth data sharing. The approved purposes for limited disclosure are listed below.

Colorado WIC Program Policies & Procedures Section 4: Organization and Management Revised: 07/01/2026

Page 3 of 4

● Non-WIC partners may only use PII with individual, documented participant consent to follow up on referrals and provide additional services to participants and their families. ● Non-WIC partners may use PII under a data use agreement to support evidence-based or promising practices that increase WIC enrollment and/or retention.

Note: Local WIC MOUs with partners that include sharing of WIC data are not allowed.

Disclosure Related to Subpoenas Per Federal regulation (§246.26), local WIC agencies receiving subpoenas shall immediately do the following; 1) Immediately notify the Colorado WIC Program State Office; 2) Notify local legal counsel, however local legal counsel cannot authorize release of PII. CDPHE legal counsel determines this. 3) If the requested information is PII, CDPHE legal will attempt to quash the subpoena unless CDPHE legal counsel determines that disclosing the PII is in the best interest of the Colorado State WIC Program. a) The decision to disclose PII without attempting to quash a subpoena should be made rarely and the Colorado State WIC Program should inform the receiving party that the requested information is confidential, provide only the specific information requested in the subpoena and no other information, and limit, to the greatest extent possible, public access to the disclosed PII. This may require a signed data sharing agreement at the discretion of the Colorado WIC Program Director and Data Manager.

Disclosure Related to Court Orders Local WIC agencies presented with a court order shall do the following: 1) Immediately notify the Colorado WIC Program State Office. The State Office will consult with CDPHE legal for direction.

Disclosure Related to Judicial Search Warrants A judicial search warrant is a court order signed by a judge/magistrate based on probable cause for criminal investigations, authorizing forced entry. In responding to a judicial search warrant for PII, the local Colorado WIC Program agency shall do the following: 1) Immediately notify the Colorado State WIC Program Director. 2) Immediately notify local legal counsel. 3) Comply with the judicial search warrant, but inform the individual(s) serving the judicial search warrant that the information being sought is confidential. 4) Seek to limit the disclosure by: a) Providing only the specific information requested in the judicial search warrant and no other information; and b) Limiting public access to the confidential information disclosed.

Disclosure to US Department of Agriculture (USDA)/FNS State and local WIC and contractors must cooperate in studies and evaluations conducted by or on behalf of the USDA, related to programs authorized under the Richard B. Russell National School Lunch Act and the Child Nutrition Act of 1966 (42 U.S.C. 1786).

Release of WIC Records to Endorser The Colorado State WIC Program releases applicant/participant records to the current initial and/or additional endorser(s) only for the period of time they personally are the endorser. The Colorado State WIC Program is only required to release information that was provided by the applicant/participant, except as required by federal, state or local law. The endorser(s) must show proof of identification (as defined by Colorado WIC Program proof of identity standards) to obtain the records and may only be provided with the portion of the record for which they were the endorser(s).

Colorado WIC Program Policies & Procedures Section 4: Organization and Management Revised: 07/01/2026

Page 4 of 4

Records Not Released Colorado WIC Program records shall not be released to the federal government or third parties, including the Department of Social Services (DSS), without written approval from the Colorado WIC Program or the endorser. Records of a child in foster care may only be released to DSS for that time while the child was in foster care. Requests for records from proxies, past or interim endorsers, relatives, or nonlegal guardians shall not be released. Requests for records for immigration or immigration administration purposes shall not be released. Records requests and releases shall be documented in each participant's care plan.

Direct questions or concerns about this policy to the Colorado WIC Program Director or the Data Manager.