The Role of Data: Our Guiding Principles
United Way of Salt Lake and our partners recognize that our most complex social problems – including the achievement gap, poverty, and healthcare access – cannot be solved by any one organization on its own. It is only by coming together with a rigorous collective impact approach that we can change the odds for all children and families. This requires that we:
- Share responsibility for giving all children a quality education, ensuring access to quality healthcare, and ending the cycle of poverty
- Focus on the same outcomes
- Create shared plans for achieving those outcomes
- Communicate regularly and authentically among ourselves
We are aligning the efforts of more than 150 community organizations, healthcare providers, government agencies, school districts, philanthropic groups, and businesses (“Promise Partners”) to help communities achieve their goals, and this collaboration requires us to share aggregate information. Sharing aggregate information enables Promise Partners to convene around shared priorities, set plans of action, personalize learning experiences, learn what is working and what needs improvement, communicate about successes and challenges with students and families, and make decisions. A very small subset of these 150 Promise Partners ("trained service providers") are working directly with students on educational outcomes. Individual level data might be shared among this small group of service providers if (1) a parent or guardian has given written consent to share information; (2) the service provider has signed data confidentiality agreements and received specific training; (3) the service provider works in the student's community; and (4) the service provider "needs to know" the information, because knowing it will help them support an individual's success.
The following principles guide how we use and share data:
Data as a flashlight: Promise Partners believe that safe, effective data use – combined with expertise from parents and guardians, community organizations and students – empowers students and helps them to start kindergarten ready to learn, excel in school, graduate, complete a degree or credential that leads to financial stability, and live a healthy life.
Shared accountability: We believe everyone in the community is accountable for student success. Students, parents and guardians, school officials, community organizations, government organizations, businesses, and policymakers are all responsible for how every child is doing right now and for achieving better, more equitable results in the future. We believe that the trained service providers working day-to-day with our children should work together and have access to individual-level information for the students and adults that they support. We believe that data about results is never evidence of the success or failure of any one program, organization, sector, or group of people.
Ongoing professional development: We believe students do best when they are surrounded by professionals in schools and in the community who are trained to use student information to help students succeed. We believe that we all need ongoing support on how to effectively use student information, and UWSL provides that support through a variety of resources, including full-time staff whose job responsibilities focus on data privacy and data use. They provide formal training and ongoing support for partners around privacy and use.
Privacy: We take privacy seriously and invest significant resources in protecting the individual-level information with which we have been entrusted. Individual-level information is ONLY shared with a small subset of Promise Partners who work directly with students if (1) a parent or guardian has given written consent to share information; (2) the trained service provider has signed data confidentiality agreements and received specific training; (3) the trained service provider works in the student’s community; and (4) the trained service provider "needs to know" the information, because knowing it will help them support an individual’s success.
Transparency: We believe in being clear about what student information we are collecting, who it is being shared with and for what reasons, and how it is being protected. See below for information on what information we are collecting, who is seeing it, and for what reasons.
Helping Students through Data Sharing
We developed this webpage to make it clear what information we are collecting, who is seeing it, and for what reasons. Click here for information on the principles that guide our data use. Please call United Way of Salt Lake at 801.736.7702 or email us at firstname.lastname@example.org with questions or comments. Please provide your contact information, so we can respond.
Why is individual-level information being collected, and what is being done with it?
Individual-level information is ONLY shared with a small subset of Promise Partners who work directly with students ("trained service providers") if (1) a parent or guardian has given written consent to share information; (2) the trained service provider has signed data confidentiality agreements and received specific training; (3) the trained service provider works in the student's community; (4) and the trained service provider "needs to know" the information, because knowing it will help them support the student’s academic success.
Here are some ways individual-level information is used when these conditions exist:
What information is shared?
We only share information that promotes students’ academic success. Below are the specific data elements we share among trained service providers (1) a parent or guardian has given written consent to share information; (2) the partner has signed data confidentiality agreements and received specific training; (3) the partner works in the student’s community; (4) and the partner “needs to know” the information, because knowing it will help them support the student’s academic success.
Shared from a student’s educational record that is maintained by their school
Student name, student’s school ID number, student’s home address, and student’s date of birth
Race, Ethnicity, Gender, English Language Learner Status, Refugee Status, Primary Language, and Country of Origin
Current and past educational institutions and current grade in school
Credits earned and credits possible for current grading period; courses taken and grades achieved for current and past terms and grading periods; CPA and GPA; days absent and reasons for absences; attendance rate and absence category; state and district mandated tests taken and scores
Shared from community organizations
Information (i.e. dates of enrollment, contact with volunteers, dates of attendance and absence) about organizations and programs that a student attends during and outside of school time
Helps us with data quality, by reducing duplicate records and allowing a student’s information to be easily tracked from school to school.
Helps us understand how to work most effectively with students. Helps us do analyses to address differences in student outcomes based on demographic categories.
Allows us to restrict access to student information so only partners with a “need to know” get access to records. Helps us understand the programs and strategies a student has had access to.
Helps us understand how a particular student is doing and has done previously, so targeted plans can be designed to help them improve. Allows us to connect students to specific interventions to support their strengths and challenges.
Helps us understand which strategies are helping which students to be successful.
Who is data shared with and how is it used?
We share aggregate information with community organizations, healthcare providers, government agencies, school districts, philanthropic groups, and businesses that work in the students' community (Promise Partners) and who have committed to the principles of Collective Impact, signed data confidentiality agreements, and received specific training on data privacy and use. Some of these Promise Partners provide programs before and after school and over the summer to reinforce what’s being taught in school. Others provide tutoring and mentoring, both during and outside of the school day. Others support parents, guardians and families with skills classes, employment services, financial planning, housing, and other resources.
All Promise Partners have committed to protect information and work collaboratively with each other to help every student excel in their education. For a list of Promise Partners in each Community School who use aggregate data to support student success or a list of service providers in each school with access to individual-level information, please review the interactive map. Access to individual-level information is granted only to a small subset of Promise Partners who work directly with students if (1) a parent or guardian has given written consent to share information; (2) the partner has signed data confidentiality agreements and received specific training; (3) the partner works in the student’s community; (4) and the partner “needs to know” the information, because knowing it will help them support the student’s academic success.
Where is student information shared?
There are two main ways:
How are you protecting it from breaches and unauthorized use?
We only collect student data when parents or guardians give written consent, the information is used to support student academic success, and the information is kept secure. Here are just some of the policies and practices we have in place to protect this information. Please see our Collective Impact Contract, Data Privacy Terms and Conditions, and Data Sharing Terms and Conditions for a complete list.
Administrative and Technical Security Mechanisms
Practices related to the transmission of data and who has access to information
Single point of access: Electronic information is only shared among trained service providers through the UWSL Partner Database, our secure online data management system. One of our contracted conditions of use is that no individual-level information may be downloaded from the UWSL Partner Database onto any physical hard drive.
Limited user access: UWSL staff limit access to information, only giving users access to the minimum level of information necessary for them to support students.
Patch management: UWSL and the UWSL Partner Database staff ensure all systems are current with system updates, patches, and security hotfixes.
Anti-virus management: UWSL and the UWSL Partner Database staff run anti-virus software. The system is updated daily for new virus definitions and is scanned regularly.
Account/password management: UWSL staff keep active user accounts up to date and delete or disable accounts that are no longer in use. UWSL Partner Database staff require end users to use a users highly sensitive password protection and management tool. One of our contracted conditions of use is that end users must lock their computer or sign out of the system when they leave. UWSL staff has configured the UWSL Partner Database so that an inactive user is logged out after 15 minutes.
Audit trails and logging: All activity is logged and auditable to maintain records of data access and use. UWSL staff maintain an auditable log of individual-level information received and when.
Security audits: The UWSL Partner Database contracts with a security firm to conduct security audits and perform penetration testing of all data transfer system components. The UWSL Partner Database provides UWSL upon request information as to when they complete security audits.
Encryption: UWSL staff accept individual-level information only through a secure file transfer system that encrypts data prior to transmitting it. The UWSL Partner Database software solution includes multiple technical safeguards designed to ensure all information is maintained and transmitted securely. The system uses 128 bit encryption during transit, data hashing, and 256 bit encryption for data at rest.
Technical Security Mechanisms to Guard Against Breaches and Unauthorized Use
Practices related to the storage of data
Secure hosting and infrastructure: The UWSL Partner Database complies with federal FedRAMP requirements. The UWSL Partner Database has provided and maintains current documentation outlining its security management processes, intrusion detection methods, physical security controls, and regulatory compliance certifications.
Local machines: UWSL policy prohibits the storage of individual-level information on local workstations or cloud-based folders. All UWSL machines employ full-disk encryption.
Physical media: UWSL requires that Promise Partners physically protect (i.e. lock in a secure cabinet) physical media (servers, hard drives, CDs, etc.) containing individual-level information and destroy it as soon as it is not needed. One of our contracted conditions of use is that student data is kept in secure and locked places. Please note that while we have the most state-of-the-art mechanisms to prevent unauthorized data access, no organization can make absolute guarantees against hacking.
Regulation and practices
Practices related to understanding and abiding by application privacy laws
FERPA and written consent: The collection, use, and sharing of information must comply with federal and state laws. These include the Family Educational Rights and Privacy Act (FERPA), a federal law designed to protect the confidential information of individuals related to education and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a federal law designed to protect the confidential information of individuals related to their medical care and history. No individual-level information may be shared among trained service providers who work directly with students in Promise Partnership Community Schools, verbally or electronically, without appropriate written consent from a parent or guardian.
Training and agreements for users and staff: Data entry into the UWSL Partner Database may only be done by trained and certified users who work for Promise Partners and have signed data privacy agreements and end user agreements. Each UWSL Partner Database employee and each UWSL employee with access to individual-level information is required to sign and comply with Data Privacy/Sharing Policies and to participate in regular privacy trainings as a condition for employment.
Discretion when discussing individuals: Information about students may be discussed only in discreet locations where other students cannot hear.
Destruction of records: Paper and digital records are destroyed once the student is no longer receiving services within a Promise Partnership. (We do maintain, as allowed by law, information required for historical analyses.)
Any suspected violation of these security practices is brought to the Governance Committee of the UWSL Board of Directors.
What is a FERPA Waiver?
Students at Promise Partnership Community Schools receive – with education – opportunities for health care, afterschool, tutoring, mentoring, English and citizenship classes, and other services. If the organizations offering these services can share select information about individual students, they can better support students academically and connect them to resources. A federal law called the Family Educational Rights and Privacy Act (FERPA) protects our students’ educational information. It says that, if a parent or guardian gives written permission, organizations that help their students can share select educational information. By choosing to sign a FERPA Waiver (copies of the waiver are at the bottom of this page), a parent or guardian allows information about his or her child’s demographics, grades, enrollments, credit hours, GPA, attendance, and test scores to be shared with the Promise Partners that work – at the request of the principal – in their school. The parent or guardian also allows information collected by Promise Partners to be shared back with the school and with other Promise Partners. Student information is only used to help the student succeed in school and is not shared with anyone outside of our Promise Partnerships. The students of parents or guardians who choose not to sign a FERPA waiver can still receive services. Signing the FERPA Wavier does not affect any kind of immigration status.
When and how is physical and electronic information destroyed?
If a student’s parent or guardian (or the student, if he or she is over the age of 18) revokes in writing their consent to share information, UWSL will alter relevant data fields in the UWSL Partner Database so that the student’s identity is hidden. Please note: physical student information often exists in many places and that UWSL can only remove information from the UWSL Partner Database. To remove a student’s information from other locations (such as a school record), a parent, guardian, or adult student must contact the organization that holds the information.Promise Partners also shred (or place in a secure shred bin) physical student information that is no longer needed.
Who should I contact if I have questions?
We review questions and input regularly and thoughtfully. Please call United Way of Salt Lake at 801.736.7702 or email us at email@example.com. Please provide your contact information, so we can respond.