USVI Public Records

Document text

Th ( a] W ju th hased 7 17 19 APHSA. American Public Human Services Association “OPO Memorandum of Understanding between APHSA and the Government of the United States Virgin Islands for National Electronic Interstate Compact Enterprise is Memorandum of Understanding (*MOL”) is made and entered into by and between the undersigned ereinafter referred to collectively as “the Parties“) as of the Effective Date. WITNESSETH: HEREAS, the purpose of this MOU is to establish a data sharing agreement between the state or risdiction of the United States Virgin Islands, as a Participant, with a principal place of business at e Department of Human Services and the American Public Human Services Association (“* th APHSA™), acting as Secretariat: for the Association of Administrators of the Interstate Compact on p Placement of Children (““AAICPC™), with offices tocated at 1101 Wilson Blvd.. 6" Floor, Arlington, Virginia 22209. to implement the national electronic web-based network for administration of the In El Ww pr Bu ca WwW i?) = = erstate Compact on the Placement of Children (“IC PC’), hereafter referred to as the National ectronic Interstate Compact Enterprise (“NEICE™); HEREAS, APHSA was awarded a Cooperative Agreement to develop the NEICE as a result of a posal submitted to the Administration of Children and Families, Children’s Bureau (the "Children’s reau”), APHSA. working collaboratively with the Children’s Bureau. enters into this agreement with the Participant to implement. through a national web-based system, the real-time electronic exchange of ke files between and among the 52 states and jurisdictions that are members of the AAICPC: HEREAS. the purpose of the NEICE is to streamline the ICPC administrative process by providing a web-based network to support best practices and provide cost savings for Participant by reducing postal prges and other paper-based expenses when making an interstate placement of children; POS6DHST19 WHEREAS. the NEICE currently offers two software applications (hereinafter collectively referred to as thd “NEICE System’): 1) The NEICE Case Management System (“CMS”), which ts a software platform, offered in either Cloud-hosted or Modular form, designed to collect, track and report uniform ICPC interstate data in real-time and enable timely communication of interstate placement decisions and 2) the NEICE Clearinghouse Direct method (“Clearinghouse”), which is designed to allow states to process ICPC cases from within their state child welfare information system (“SACWIS") or their Comprehensive Child Welfare Information System (‘CC WIS") and transmit the documents, in conformance with the National Information Exchange Model (“"NIEM") standards, to other states via the NEICE’s web-based network service, the NEICE Clearinghouse information highway: WHEREAS, APHSA and Participant both desire to set forth their understanding about the duties and responsibilities concerning the implementation and operation of the NEICE System: G WHEREAS, APHSA desires to grant Participant a non-exclusive, non-transferable, and revocable license to access and use the NEICE System for ICPC information exchange purposes: NOW, THEREFORE, for and in consideration of the mutual covenants herein contained, the Parties hereby mutually agree as follows: lL. Definitions. For the purposes of this MOU, the following terms shall have the meaning ascribed to them below. All defined terms are capitalized throughout this MOU. a. Applicable Law shall mean all applicable federal and Participant's state laws and regulations. including the ICPC. b. Breach shall mean all known incidents that threaten the security of the Participant's data or databases and data communications resulting in exposure of data protected by federal or state laws, or other incidents compromising the security of the Participant's information technology systems with the potential to cause major disruption to normal ICPC activities, c. Data shall mean all information, including documents. collected or exchanged in accardance with the requirements of the [(CPC, d. Data Transmittal shall mean an eiectronic exchange of Data via the NEICE System between Participants and/or APHSA, or grant of access to Data. using agreed upon privacy and security Specifications. e. Effective Date shall mean the date of execution of this MOU, as recorded by APHSA. f. NEICE User Group shall mean all Participants and Users that have agreed to the terms of the MOU. g. Participant shall mean any state or jurisdiction of the ICPC that is a signatory to this MOU. h, Participant Access and Disclosure Policies shall mean those policies and procedures of a Participant that govern a User's ability to access, exchange. and transmit Data-using the Participant's System or NEICE. including privacy and security policies. i. Participant System shail mean the software, portal, platform, or other electronic medium comrolled by a Participant through which the Participant conducts its Data Transmittal related activities. For purposes of this definition, it shall not matter whether the Participant controls the software, portal, platform, or medium through ownership, lease. license. or otherwise. > POS6DHSTI9 j- Specifications shall mean the Specifications established by Applicable Law or adopted by the AAICPC that prescribe the Data content, technical, and security requirements needed to enable the Participants to perform Data Transmittal. Specifications may include, but are not limited to, specific standards, services, and. policies applicable to Data Transmittal pursuant to this MOU, National Information Exchange Model ("NIEM”) standards. the National Human Services Interoperability Architecture (“NHSIA™), and the State Automated Child Welfare Information System ("SAC WIS”) Child Welfare Systems. (The Specification requirements are attached hereto as Appendix 1.) This MOU shall not be deemed to supersede any differing obligations of the Participant to comply with Specifications promulgated or established by the Participant's state or jurisdiction. k. User shall mean any person, including a private adoption attorney and a private adoption agency. who has been authorized to conduct Data Transmittal through the respective Participant's System in accordance with the Participant's Access and Disclosure Policies and Applicable Law. 2. Expectations of APHSA. APHSA shall: a. Enter into a similar MOU concerming the implementation and operation of the NEICE with other ICPC member states and jurisdictions that grants each Participant a non-exclusive, non-transferable. and revocable license to access and use the NEICE System for Data Transmittal subject to the terms and conditions set forth in Sections 3. 4, 5, 6, 7, and 8 of this MOU and Appendices 1-7. b, Hold all NEICE System Participants to the same roles and responsibilities for technical. administrative, and operational implementation. c. Support Participant and other (CPC member states and jurisdictions to implement the NEICE System by: i. Conducting an annual assessment and analysis of the training and technical assistance needs of the Participant to implement the NEICE System. ti. Providing the training and technical assistance required to permit Participant to effectively onboard to the NEICE System. d. Review with its technical development vendor that the Data contained in NEICE and the NEICE System meet federal standards for security and protection. Specifically, the NEICE System will meet the Health Insurance Portability and Accountability Act (“HIPAA”) privacy and security requirements when applicable. FIPS Standards for Security Categorization of Federal Information and Information Systems and other applicable requirements and standards of the Federal Risk and Authorization Management Program (“FedRAMP”). e. Access and report on the Participant Data in NEICE to analyze for NEICE System improvements and evaluate system effectiveness and efficiency. and to improve the processing of ICPC cases across member states and jurisdictions. Other purposes will be recommended, assessed, and agreed to by the ; PO56DHST19 Executive Committee of the AAICPC on an ongoing basis. APHSA may also access and provide reports on the information at the request of the federal government or judicial authority in the unlikely event of investigations, f. Prepare and submit to the Children’s Bureau, in a timely manner. all required interim, annual and final reports to the Children’s Bureau to meet grant responsibilities in the required formats. g. Provide a process for reporting, monitoring, and implementing a corrective action should a Breach occur within the NEICE system. h. Solicit policy guidance from the AAICPC Executive Committee on effective strategies appropriate to manage and administer the NEICE System, including procedures for Participant suspension, termination, and reinstatement; or changes in Participant administrator. i, Adopt an appropriate data lifecycle management approach to include the following: process for reporting and remediation of system outage/problems (aka defects), process for receiving, recording, prioritizing and implementing suggested system enhancements (aka product improvements); process for notifying users of system outages (scheduled and unscheduled): process for identifying data retention requirements, including the deletion and/or archiving of appropriate data: adoption procedures/policies to ensure uniform application of these process. 3. Expectations of Participant. As a condition of APHSA and AAICPC providing Participant with a license to access. and use the NEICE System for Data Transmittal. Participant shall: a. Comply with all Data requirements of the ICPC, b, As needed and necessary, adapt current systems/processes for handling [CPC cases in order to connect Data in NEICE to existing child welfare systems (SAC WIS, CC WIS or other). c. Use the NEICE System to disclose and exchange Data and materials required for the interstate placement of children as defined by the ICPC ina timely and responsive manner with all other ICPC jurisdictions. d. Ensure that Data and materials exchanged (sent or received) with non-NEICE System jurisdictions, as required by the ICPC for the interstate placement of children, are entered or uploaded into the NEICE System to enable comparative analysis and reporting by the APHSA as the Secretariat on behalf of the AAICPC. e. Ensure that all required Data fields are completed as indicated in the NEICE User Manual f. Work cooperatively with all NEICE System Participants, APHSA and its sub-contractors, and the Children’s Bureau. in ensuring that the NEICE System has access to Participant's IT and child welfare POSé6DHST19 professionals with decision making authority and/or technical expertise, and any other personnel instrumental to the full and complete implementation of NEICE in Participant's state or jurisdiction. gu. Agree to the NEICE Data Retention Policy (attached as Appendix 2) developed cooperatively among APHSA, members of the AAICPC. and the technical vendor, Participants retain ownership of the Data and materials shared via the NEICE System and are responsible for maintaining records according to Applicable Law. as outlined in the NEICE Data Retention Policy. h. Ensure that reproduction of any materials developed within the NEICE System carry the same marking as that which appears on the original and is subject to the same standard of authenticity, confidentiality, and security. i. Participate in communication and dissemination of the project's progress with the understanding that all written communication and dissemination of products must be approved by APHSA in advance because APHSA must obtain the prior approval from the Children’s Bureau. j. Whenever a Participant performs a Data Transmittal to another Participant or User, the transmitting Participant shall comply with Applicable Law, this MOU. the applicable Participant Access and Disclosure Policies (attached as Appendix 3), and the applicable Specifications (including the Specifications for Data Transmittal attached as Appendix 1). If Applicable Law requires an authorization for the Data exchange from the Data subject or his or her personal representative, the requesting Participant shall provide an authorization that meets all requirements of Applicable Law. 4. Operating Policies and Procedures. Both Parties shall: a. Participate in the on-going evaluation of the NEICE System’s effectiveness and provide input. to include any necessary technical services, into revising and improving both the NEICE System and the Participant System. b. Consider all Data and materials exchanged proprietary and confidential in accordance with the ICPC protocols and secured in accordance with the Specifications set for Data Transmittal (attached as Appendix 1). c. Provide any assistance to the technical vendor of APHSA in implementing any local interfaces from the NEICE System to the Participant’s existing child welfare system in the form of SAC WIS or CCWIS. This assistance would include the export of Data from the child welfare system and the receipt of Data published from the NEICE System to the existing child welfare system. if applicable. This assistance would also include support from Participant's local technical staff responsible for the existing child welfare system. d. Meet and work cooperatively as required/requested with the NEICE Federal Project Officers and other representatives of the Children’s Bureau, other Participants, and APHSA and its subcontractors 5 — POSEDHS TIS to discuss the NEICE in the context of the current environment for the duration of the current grant period. e. Recognize that there may be a need to modify the state’s automated child welfare information system (SAC WIS or CCWIS) to ensure the bidirectional functions so Data and materials can be extracted and imported so as to avoid redundant entry and achieve other potential ICPC benefits. f. Participate in the NEICE User Group in order to relate/express learning opportunities that will enhance Data literacy and provide guidance on NEICE and NEICE System improvements related to Data authenticity, access, validity, reliability, retention, and transmittal. g. Attend, participate, and present at in-person and conference call mectings of the NEICE System (calls that will be scheduled as needed). h. Attend, participate in, and present at virtual sessions conducted over the web for the collection and dissemination of information, as well as training sessions as needed. i. Ensure ongoing Data Transmittal security compliance with the NIEM standards and the NHSIA, as wellas the SACWIS or CCWIS, j- NOT export directly or indirectly. any technical software or hardware acquired from the other Party or other NEICE System Participants, or any products utilizing any such software or hardware to any entity without the express written agreement of both Parties and/or other impacted Participants and the federal government. k. NOT assign its rights or obligations under this MOU, including a successor- in-interest, without the prior written consent of the other Party. |. Provide data breach reporting in compliance with Appendix 4 and Applicable Law. m. Adhere to the license fee payment and service obligations described in the Annual Licensing Agreement and List of Services document (attached as Appendix 6). n. Adhere to policies and procedures reporting incidents and seeking technical assistance as outlined in the Service Level Agreement (Appendix 7). 5. Data Use Governance. a. Use of Data. Participants shall only transmit and retain Data in accordance with Applicable Law. Each Participant shall require that its Users comply with this Section. b. Access Policies. Each Participant agrees to have Participant Access and Disclosure Policies (described in Appendix 3.). Each Participant acknowledges that Participant Access and Disclosure Policies will differ among them as a result of differing Applicable Law and business practices. Each Participant agrees to be responsible for determining whether and how to perform Data Transmittal 6 POS6DHST19 based on the application of its Participant Access and Disclosure Policies to the Data and [CPC materials, Each Participant shall comply with Applicable Law. this MOU, and all applicable security Specifications in performing Data Transmittal, c. Accuracy of Data. In performing Data Transmittal. each Participant hereby represents that at the time of transmittal, the Data it provides is (a) an accurate representation of the Data contained in, or available through its Participant System, (b) sent from a Participant System that employs security controls that meet the Specifications so that the Data are intended to be free from malicious software. d. Agreements with Users. Each Participant shall have established agreements with each of its Users that require the User to, ata minimum: (i) comply with all Applicable Law: (ii) reasonably cooperate with the Participant on issues related to. this MOU: (iii) perform Data Transmittal only for an ICPC permitted purpose; (iv) use Data received from another Participant or User in accordance with the terms and conditions of this MOU; (v) within 24 hours after determining that a Breach occurred. User will report such Breach to the Participant who in turn will report to APHSA: and (vi) refrain from disclosing to any other person. any passwords or other security measures issued to the User by the Participant. e. Agreements with Vendors. To the extent that a Participant uses vendors in connection with the Data Transmittal. cach Participant affirms that it has established agreements with each of its vendors. inchiding Information Technology Service Providers (*ITSPs”), that require the vendor to, at a minimum: (i) comply with Applicable Law; (ii) protect the privacy and security of any Data to which it has access: (iii) as soon as reasonably practicable after determining that a Breach occurred. report such Breach to the Participant: and (iv) reasonably cooperate with the other NEICE System Participants on issues related to this MOU. 6. Privacy and Security. a. Hold in Confidence. Each Participant agrees to hold all personally identifying Data and ICPC materials in confidence and agrees that it shall net, during the term or after the termination of this MOU, re-disclose the Data and [CPC materials to any person or entity. nor use for its own business or benefit, any such Data obtained by it in connection with this MOU, unless such use or re-disclosure is permitted by the terms of this MOU or permitted or required by Applicable Law. b. Applicability of Privacy and Security Regulations. fo maintain the privacy. confidentiality, and security of Data, cach Participant shall comply with Applicable Law, Applicable Participant Access and Disclosure Policies. the Specifications. and this MOU. c. Breach Reporting. Participant shall report to the APHSA contact person designated in this MOU all known incidents that threaten the security of the Participant Systems and Data communications resulting in exposure of Data protected by federal or state laws. or other incidents compromising the security of the Participant's information technology systems with the potential to cause major disruption to normal activities. Such reports shall be made to the APHSA contact person designated in the MOU within 24 hours from when the Participant discovered the occurrence. Participants shall also comply with any Applicable Law regarding Breaches. 7 PO56DHST19 d. Enterprise Security. Each Participant agrees to be responsible for maintaining a secure environinent compliant with the Specifications and other Applicable Law that supports the Data Transmittal in compliance with the Specifications. Participant shall use appropriate safeguards to prevent use or disclosure of Data other than as permitted by Applicable Law and this MOU, including appropriate administrative, physical, and technical safeguards that protect the confidentiality, integrity, and availability of that Data. Appropriate safeguards shall be those required by Applicable Law related to Data security. Before the Effective Date. each Participant agrees to, as appropriate under Applicable Law, follow the Participant Access and Disclosure Policies, as appropriate under Applicable Law. e. Equipment and Software. In accordance with Applicable Law, cach Participant shall be responsible for procuring. and assuring that its Users have or have access to, all equipment and software necessary for Data Transmittal. Each Participant shall ensure that all computers and electronic devices owned or leased by the Participant used for Data Transmittal are properly configured. including, but not limited to, the operating system. web server, and Internet connectivity. f. Auditing. Each Participant shall, through its agents, employees. and independent camtractors, have the ability to monitor and audit all access to. and use of the NEICE System related to this MOU, for [CPC administration, security, and other legitimate purposes. Each Participant shall perform those auditing activities required by the Specifications. g. General Compliance. Each Participant shall comply with all of the Specifications under this MOU, and identified hereto as Appendix |. unless compliance would be a violation of Applicable Law, 7. Liability. a. Reliance on a System. Each Participant acknowledges and agrees that: (i) the Data provided by, or through, the NEICE System is drawn from numerous sources, (ii) the Data is. specific to the point in time when drawn, and (iii) it can only confirm that, at the time of the Data Transmittal the Data are an accurate representation of Data contained in, or available through, its Participation System. Nothing in this MOU and Appendices shall be deemed to impose responsibility or liability on APHSA, AAICPC, or a Participant related to the clinical accuracy, content or completeness of any Data provided pursuant to this MOU. The Participants acknowledge that other Participant’s MOU may be suspended or terminated at any time: therefore, Participants may not rely upon the availability of a particular Participant's Data. b. Carrier lines. AH Parties acknowledge that Data Transmittal between themselves is to be provided over various facilities and communications lines, and Data shall be transmitted over local exchange and Internet backbone carrier lines and through routers, switches, and other devices (collectively. “carrier lines”) owned, maintained, and serviced by third-party carriers, utilities, and Internet service providers, all of which may be beyond the Parties” control. Provided a Party uses reasonable security measures, no less stringent than those directives, instructions, and specifications contained in this MOU, the Specifications, and Applicable Law, the Party assumes no liability for or relating to the t , POS6DNST19 integrity, privacy, security, confidentiality, or use of any Data while it is transmitted over those carrier lines. which are beyond the Party’s control. or any delay. failure. interruption, interception, loss. transmittal, or corruption of any Data or other [CPC materials attributable to transmittal over those carrier lines which are beyond the Parties * control. Use of the carrier lines is solely at the Party’s risk and is subject to all Applicable Law. Ifa Breach occurs and it is determined that it happened because of a carrier issue, the Party responsible for the Data being transmitted is the responsible party for any required Breach Notification. c. Data Requests. All Participants that make Data Transmittal requests. or allow their respective Users to access Data, shall have a corresponding reciprocal duty to respond to Data Transmittal requests. A Participant shall fulfill its duty by either (i) responding to the Data Transmittal request with the requested Data. or (ii) responding with a standardized response that indicates the Data is not available or cannot be exchanged. Data Transiittals in response to Data requests shall comply with the Specifications, this MOU, applicable Participant Access and Disclosure Policies. any applicable agreements between Participants and their Users. and Applicable Law. Nothing in this MOU shall require a Data Transmittal that would violate Applicable Law. d. Data Request Disputes. Each Participant that makes Data requests, or allows its respective Users to make Data requests, shall transmit Data with all other Participants in accordance with the terms of this MOU, [fa Participant desires to stop Data Transmittal with another Participant based on the other Participant's acts or omissions in connection with this MOU, the Participant may temporarily stop Data Transmittal with such other Participant to the extent necessary to address the aggrieved Participant’s concerns and to the extent allowed or required by Applicable Law. If any such cessation occurs, the aggrieved Participant shall provide notice to the APHSA and AAICPC of such cessation and the reasons supporting the cessation. The Participants shall submit the dispute leading to the cessation to the APHSA and AAICPC. If the cessation is a result of a Breach that was reported and deemed resolved pursuant to Appendix 4. the Participants involved in the Breach and the cessation agree to engage ina dispute resolution process in an effort to attempt to reestablish trust and resolve any security concerns arising from the Breach. e. Users and TFSPs. Each Participant shall require that all of its Users and ITSPs be given access to Data and ICPC materials only in accordance with the terms and conditions of this MOU and the Participant Access and Disclosure Policies. including without limitation those provisions governing the authorization, use, confidentiality, privacy. and security of Data. In no event shall ITSPs be permitted to retain or use information from the NEICE System, including software, the Specifications, instructional materials, and Data without the priar express written permission of APHSA and the Participant that has contracted for the [TSP’s services. 8. Termination. a. Term. The initial term of this MOU shall be for a period of one year commencing on the Effective Date. Upon the expiration of the initial term, this MOU shall automatically renew for successive one-year terms unless terminated pursuant to this Section. 5 POS6DHSTI9 b Suspension. Reinstatement or Termination. Suspensions, Reinstatements and Terminations of Participants shall be in accordance with Appendix 5 of this MOU. ec Effect of Termination. Upon any termination of this MOU for any reason, the terminated party shall cease to: be a Participant and thereupon and thereafter neither that party nor its Users shall have any rights to participate in the NEICE System. After revocation, the APHSA shall provide Notice of such revocation to the remaining Participants in the NEICE System. In the event that any Participant(s) is terminated, this MOU will remain in full force and effect with respect to all other Participants. Any Participant terminated from this MOU shall consider executing alternate data sharing agreements and where required by Applicable Law, shall do so. d. Availability of Appropriations; Sufficiency of Funds. This MOU is contingent upon and subject to the availability of sufficient funds. The Participant may terminate or suspend this MOU in whole or in part, without penalty or further payment being required, if (1) sufficient State funds have not been appropriated to the Participant (ii) the Participant's state government holds back or reserves funds previously appropriated for the MOU, or (iii) the Participant's state government determines that appropriated funds may not be available for payment. The Participant shall provide notice. in writing. of any such funding failure and its election to terminate or suspend this MOU as soon as practicable. The primary points of contact for the Parties pursuant to this MOU are: (a) Eavey-Monique C. James. ICPC Compact Administrator who can be reached at virginislandsicpe icj@dhs.vi.gov and (340) 715- 6906 and (b) Marci Roth (APHSA Project Director) who can be reached at 267.456.3594 and mroth@aphsa.org(c) June Dorn (Federal Project Officer) who can be reached at 202.205.9540 and june.dorn@acfhhs.gov. Any change in the identity of a primary point of contact by cither Party shall be made in writing with the other Party. This MOU contains the entire understanding between the Parties and is the complete and exclusive expression of the agreement between the Parties. Any modification to this MOU may only be made in writing and must be signed by authorized representatives of both Parties. The terms of this MOU shall be applicable only after the Participant agrees to such participation in the NEICE System. This MOU shall be governed by and construed in accordance with the laws of Washington. D.C. Any questions by Participant should be directed to Ray Davidson. the principal investigator for NEICE, at rdavidson@aphsa.org. As the duly authorized APHSA representative, [ execute this MOU in duplicate. each of which shall be deemed an original. POS6DHSTI9 Administrator (APHSA} Lavinia) (DAVIDSIK) , CEC Priijed Name and_Title of Authorizing Agent ary. pall D Signature,of hag ing Agent ape Date State Authority By signing this Memorandum of Understanding | acknowledge that | have read all terms and conditions in this document, fully understand, accept and agree to them. Further, | have discussed them with the appropriate state representatives and authorized these persons to execute the terms entered into as of the date executed. articipant Kimberley Causey Gomez Commissioner. Deparunent of Human Services Ze ae the Agent, (77 F220 19 Date Anthony D. Thomas Commissioner. Departmenpor Property & Procurement LY Signature qr Authorizing Agent 4 [30/2014 Dat Denise N. George. Esq. Attomey General. Office of the Attorney General ual? Weds a AAG a of migeiing Agent vefoa for Legal Sufficiency Only 46 Date a r r POS6DHSTI9