How to develop and manage a data sharing agreement

Determine if you need to use the IDEA

Use the IDEA for data that needs protection and can’t be freely shared across state entities. This is usually due to federal or state law for privacy or security reasons.

You don’t need to use the IDEA if the data is:

• Public and non-confidential data
• Non-confidential, internal use data you share with other state entities

Confirm that all parties are signatories to IDEA

Review the list of IDEA signers to make sure everyone has signed the agreement.

If one party hasn’t signed the IDEA, you can use the IDEA as a starting point for a separate agreement.

Draft the BUCP

Have the program staff who will use the data at the Data Recipient draft the BUCP using the template. Work with the Data Provider’s program team on the draft. Involve your executive sponsor and other reviewers later.

Use one of these Word documents to draft your BUCP:

• BUCP template for one Data Provider and one Data Recipient
• BUCP template for more than one Data Provider or Data Recipient

Data field definitions

One of the best ways to improve data use is to have well-documented data. You don’t need to do this when you make your BUCP, but it can help you later. Use these data field definitions to build a common understanding of the data you will share.

• Field name: A brief name a human could understand. Make it unique in the data set. Use the singular. Don’t use abbreviations or acronyms.
• Type: The format of the data. This could be:
  • Numbers
  • Text
  • Time
  • Currency
  • Yes/no (Boolean)
  • Coordinates
• Definition: A descriptive phrase or sentence about the data. State what it is, not what it isn’t. Make sure it can stand alone. Be precise, unambiguous, and concise. Make it unique in the data set. Use the singular. Define the unit of measurement, like miles, meters, or feet.
• Required: Yes or no.
• Valid inputs: If it’s a category, give the list of allowable values. If it’s a date or number, give the allowable range.
• Source: Define how the data enters the system.
• Notes: Describe known quality issues or concerns.
• Guide for use: Tell people how to use the field.

Submit the draft BUCP to the Data Provider

• Once you have a first draft of the BUCP, send it to the data coordinator at the Data Provider. It’s their job to:
• Send it for the required legal, privacy, and security reviews at their organization
• Share feedback from those reviewers with you.

Use the email template to start a request to begin the conversation.

Complete the BUCP

Update the BUCP based on their feedback and get input from your legal, privacy, and security teams.

Follow the dispute resolution process. Disputes fall into 3 categories:

• Data Provider objects to the data exchange
• Disagreement on how to de-identify data
• Disagreement on costs

Submit the final BUCP to the Statewide Chief Data Officer

Use the BUCP Inventory Form to submit the final BUCP. This lets ODI track and audit BUCPs. We don’t approve BUCPs.

Exchange and manage the data per the agreement

Follow the terms of the agreement to exchange and manage the data.

What to do if you get an external request for data

If you get an external request for data you get through a BUCP, tell the Data Provider. Meet as soon as possible to decide how to respond. These requests could come through:

• The California Public Records Act
• A subpoena
• A court order
• A litigation-related request

What to do if there’s a data breach

If there’s a data breach affects data shared through a BUCP, the Data Recipient must tell the Data Provider. If possible, identify who is responsible. Use the unauthorized access template to alert the Data Provider.

If the breach involves HIPAA-protected data, follow the breach provisions in Addendum A of the IDEA.

Update or end the BUCP.

Your BUCP can be affected if if:

• New laws or contracts change the rules for sharing data
• Your legal or privacy experts say something changed

If you can still share data under the new rules, update the BUCP to match the new legal and privacy rules. Get approvals from the relevant department and file the BUCP again.

If you can’t share data under the new rules, end the BUCP. You have to tell people when you’re ending a BUCP if:

• There’s been a statutory, regulatory, or contractual change. The Data Provider must tell the Agency Chief Data Officer or the Agency Information Officer why they’re ending the agreement.
• The Data Provider determines the Data Recipient violated the agreement. The Data Provider must tell the Data Recipient and Chief Data Officer that they’re ending the agreement.