Supplemental Information for Parents About DOE Agreements With Outside Entities

New York Education Law §2-d gives parents the right to access certain information about agreements the NYC DOE has entered into with outside entities (such as vendors) who are permitted to receive or to access identifiable student information from the DOE. These entities are required to answer a number of questions about their privacy and data security practices. Responses from such outside entities to these questions are found below. Please note that this page will be updated on a periodic basis with responses from additional outside entities.

COVID Testing

BioReference Laboratories, Inc.

  1. The exclusive purposes for which Protected Information will be used, and how students and staff members will benefit from the Contractor’s services: Protected Information will be used by BioReference Laboratories, Inc. (“BRL”) for the sole purpose of performing COVID-19 testing under its contractual agreement with New York City Health and Hospitals Corporation.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your written agreement with the NYC DOE: BRL will not utilize any subcontractors for the testing, and will only report COVID-19 test results to the patients (or, if a minor, the parent or guardian), the ordering physician, and public health authorities including the Centers for Disease Control and Prevention, the NYS Department of Health, the NYC Department of Health, and NYC Health + Hospitals’ NYC Test + Trace program as required or permitted by law.
  3. When the written agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: This Agreement is effective October 1, 2020 and will continue for so long as the Contractor will be providing the NYC DOE services with respect to COVID-19 testing. Under the federal Clinical Laboratory Improvement Amendments of 1988 as well as New York state laboratory laws and regulations, BRL is required to retain test orders and requisitions, consents to testing, and test results. This Protected Information will be retained in the same secure manner as BRL retains information for the approximately 60,000-70,000 tests that it performs daily.
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Contractor will work with the NYC DOE in processing requests for copies of student Protected Information, and challenges to the accuracy of student data in the custody of the Contractor. Such requests should be directed to studentprivacy@schools.nyc.gov. However, if a parent of a student who was tested wishes to obtain a copy of their child’s laboratory testing records, the request should be directed to patientportal@bioreference.com.
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): The Protected Information is stored in the US. Please see question #3 above.
  6. How the data will be encrypted (described in such a manner as to protect data security): BRL employs industry standard encryption method and strength for data at rest and in transit.

See the full BioReference Laboratories, Inc. agreement.

Fulgent Genetics, Inc.

  1. The exclusive purposes for which Protected Information will be used, and how students and staff members will benefit from the Contractor’s services: Protected Information will be used by Fulgent Genetics, Inc. (“Fulgent”) for the sole purpose of performing COVID-19 testing under its contractual agreement with New York City Health and Hospitals Corporation.
  2.  How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your written agreement with the NYC DOE: Fulgent will not utilize any subcontractors for the testing, and will only report COVID-19 test results to the patients (or, if a minor, the parent or guardian), the ordering physician, and public health authorities including the Centers for Disease Control and Prevention, the NYS Department of Health, the NYC Department of Health, and NYC Health + Hospitals’ NYC Test + Trace program as required or permitted by law.
  3. When the written agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: This Agreement is effective October 1, 2020 and will continue for so long as the Contractor will be providing the NYC DOE services with respect to COVID-19 testing. Under the federal Clinical Laboratory Improvement Amendments of 1988 as well as New York state laboratory laws and regulations, Fulgent is required to retain test orders and requisitions, consents to testing, and test results. This Protected Information will be retained in the same secure manner as Fulgent retains information for the approximately 60,000 – 70,000 tests that it performs daily.
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Contractor will work with the NYC DOE in processing requests for copies of student Protected Information, and challenges to the accuracy of student data in the custody of the Contractor. Such requests should be directed to studentprivacy@schools.nyc.gov. However, if a parent of a student who was tested wishes to obtain a copy of their child’s laboratory testing records, the request should be directed to Fulgent.
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): The Protected Information is stored in the US. Please see question #3 above.
  6. How the data will be encrypted (described in such a manner as to protect data security): Fulgent employs industry standard encryption method and strength for data at rest and in transit.

See the full Fulgent Genetics, Inc. agreement.

Somos Healthcare Inc. D/B/A Somos Community Care

  1. The exclusive purposes for which Protected Information will be used, and how students and staff members will benefit from the Vendor’s services: Protected Information will be used by Vendor, as such is defined within the Agreement, for the sole purpose of performing COVID-19 testing under its contractual agreement with New York City Health and Hospitals Corporation.
  2. How you will ensure that the Vendor or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your written agreement with the NYC DOE: Vendor will provide the Services as detailed within the Specimen Collection Agreement and will only report COVID-19 test results to parents or guardians of the Tested Students, Tested Students over 18 years of age and Tested Staff, as required or permitted by law and will further ensure that all personnel involved in the specimen collection and reporting comply with all confidentiality and privacy obligations equivalent to and no less protective than those found within this Agreement.
  3. When the written agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: This Agreement is effective October 1, 2020 and will continue for so long as the Contractor will be providing the NYC DOE services with respect to COVID-19 testing. Somos abides by NIST 800-53 controls to as well as applicable New York state laws and regulations to safeguard Protected Information. BioReference Laboratories (“BRL”) under its Agreement with H+H will be required to retain test orders and requisitions, consents to testing, and test results. This Protected Information will be retained in the same secure manner as BRL retains information for the approximately 60,000-70,000 tests that it performs daily. Vendor shall retain any PHI it receives from BRL in accordance with all law and regulation.
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, Vendor will work collectively with the NYC DOE in processing requests for copies of student Protected Information, and challenges to the accuracy of student data in the custody of the Vendor. Any received requests will be directed to studentprivacy@schools.nyc.gov. However, if a parent of a student who was tested wishes to obtain a copy of their child’s laboratory testing records, the request should be directed to BRL through its portal at patientportal@bioreference.com.
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): The Protected Information is stored in the US. Please see question #3 above.
  6. How the data will be encrypted (described in such a manner as to protect data security): Vendor employs industry standard encryption method and strength for data at rest and in transit.

See the full Somos Healthcare Inc. D/B/A Somos Community Care agreement

Vendors

DreamBox Learning, Inc.

  1. The exclusive purposes for which Protected Information will be used:
    To provide hosted services and adaptive math software to the district.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: DreamBox does not utilize subcontracts in its delivery of software or services; however, DreamBox will ensure that all authorized persons are aware of the confidential nature of the information being share and have been trained on data protect and security best practices.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: Personally Identifiable Student Information (PISI) will be removed from the DreamBox system and returned to the district at the district’s request. [NYC DOE comment: The current agreement became effective starting on October 1, 2019 and terminates when all NYC DOE schools and/or offices cease using DreamBox Learning, Inc.’s products/services. The terms of the agreement remain effective through the period during which DreamBox Learning, Inc. possesses or otherwise is in control of covered protected information.]
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.] 
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): PISI will be store in the US. DreamBox is ISO27001 certified and meets industry best practices for data security including encrypted at rest and in transit.
  6. How the data will be encrypted (described in such a manner as to protect data security): At rest and in transit.

Everbridge, Inc.

  1. The exclusive purposes for which Protected Information will be used: Data/assets the client provides to the Everbridge platform are utilized solely by the client for their critical event management and communication purposes. Everbridge does not leverage/utilize client data beyond what is outlined in the Everbridge MSA
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: Everbridge providers must align to Everbridge’s security requirements as otherwise, Everbridge is unable to obtain and maintain our security and compliance attestations. At no time is any third party granted access to the Everbridge platform or the client data therein. Everbridge is a SOC2, SOC3, FISMA, Safety Act, ISO 27001, EU-US Privacy Shield, G-Cloud 9, UK ICO, and BSI C5 certified organization and we have achieved FedRAMP “Authorized” status. Our security policies are governed by NIST 800-53 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Controls for Moderate Impact systems, and an overview of our security policies and attestations can be found here: https://www.everbridge.com/company/legal/. All policies and attestations are reviewed and updated annually.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: Regarding records management and data retention, Everbridge’s controls align to our security framework (which is governed by NIST 800-53 controls, FedRAMP, and ISO 27001 compliance) and there are several facets to this:
    • Product system reporting data, available for all client campaigns, is available in the web based console and product suite for 18 months. At any time, clients may download and archive reports available in Everbridge in various formats (HTML, CSV, PDF) and store these internally within their organization;
    • Security Event Report data is available to authorized client administrators in the web based console and is accessible for up to the prior 6 months from when the report is generated by the administrator;
    • Data that clients store as contacts or assets within the Everbridge platform is not purged or managed by Everbridge, in any way, throughout the life of an active services agreement. However, when an organization’s contract expires, the organization’s account will be deactivated and listed for deletion. Thirty-days from the contract expiration date, the organization’s data will be flagged for purging and all of the organization’s data will be removed from the active system. Everbridge retains the organization’s data for one month in the event the organization wishes to extend its subscription;
    • For clients using our Safety Connection functionality, travel itineraries are stored for 12 months in the past and for 12 months into the future; Last Know Location is kept from the last report from the source and until it is overwritten by the source
    • Business records are kept by Everbridge for 7 years and/or as required by law

      [NYC DOE comment: The current agreement became effective starting on March 19, 2020 and terminates when all NYC DOE schools and/or offices cease using Everbridge, Inc.’s products/services. The terms of the agreement remain effective through the period during which Everbridge, Inc. possesses or otherwise is in control of covered protected information.]

  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Clients are wholly responsible for managing their data set in the Everbridge platform. Thus, any such rights to access, review, update, and correct their personal information will be handled by authorized client administrators. Should Everbridge receive such requests directly from client users, those requests will be re-directed to client administrators to fulfill [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Everbridge maintains four implementation regions around the world for our services: United States, United Kingdom, Germany, and Canada. Clients will choose their implementation region from those listed above and client data will then be stored and processed within the selected implementation region only. Typically, US based clients will be implemented in our US-based implementation of Everbridge (which consists of secure cloud hosting facilities in Northern CA and Northern VA. Regardless of data store chosen, Everbridge is a SOC2, SOC3, FISMA, Safety Act, ISO 27001, EUUS Privacy Shield, G-Cloud 9, UK ICO, and BSI C5 certified organization and we have achieved FedRAMP “Authorized” status. Our security policies are governed by NIST 800-53 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf), Controls for Moderate Impact systems, and an overview of our security policies and attestations can be found here: https://www.everbridge.com/company/legal/. All policies and attestations are reviewed and updated annually
  6. How the data will be encrypted (described in such a manner as to protect data security): Everbridge’s implemented encryption technologies align to FIPS 140-2, NIST 800-53 controls, FedRAMP, and ISO 27001 compliance. HTTPS TLS 1.2 and SFTP using SSH are used for secure communication with the platform. Client data is encrypted at rest using AES 256-Bit encryption (database is encrypted at the file level). Platform backups are secured using AES 256-Bit encryption. All encryption keys are managed internally by Everbridge using a digital key management solution.

EverFi, Inc.

  1. The exclusive purposes for which Protected Information will be used:  Personally Identifiable Student Information (PISI) will be used for registration and use of EverFi courses.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: Everfi requires employees, subcontractors and authorized persons or entities that receive student data or teacher or principal data to sign agreements that include appropriate confidentiality obligations that covers such data.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: EverFi will return or destroy such data in accordance with the terms of this agreement. [NYC DOE comment: The current agreement became effective starting on March 5, 2020 and terminates when all NYC DOE schools and/or offces cease using EverFi, Inc.’s products/services. The terms of the agreement remain effective through the period during which EverFi, Inc. possesses or otherwise is in control of covered protected information.]
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipients.[NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.] 
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): PISI will be sorted in the U.S. (within contiguous 48 states) in accordance with EverFi’s Data Security Policy. Please see EverFi’s “Data Security Policy” for more details.
  6. How the data will be encrypted (described in such a manner as to protect data security): Data is encrypted at rest and in transit (AES-256 encryption algorithm). Database connections are vial SSL protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384.

Suntex International Inc. (First in Math)

  1. The exclusive purposes for which Protected Information will be used: We do not absorb, display or store any sensitive data in this process. As part of a typical data sync, the district will provide information regarding the school buildings, the classroom that exist, and the teachers that are assigned to those classrooms. Lastly, a list of students and what classes they belong to is provided. In the most common application, these files are transmitted nightly through Clever. The syncing process will automatically establish accounts, preserving the teacher/student relationship. As this relationship changes, and students move to a different classroom, or school building this change is reflected in vendor’s website. If student no longer appears in the data feed, the student will be held in a reset/deactivated status until they appear again. Teachers that are no longer teaching the classrooms associated with the program will be removed as indicated by the feed. There are some cases where the relationship is not correctly reflected in the SIS, or the student’s classroom assignment is ambiguous. In this case the teacher may use tools to find students that are deactivated or exist in an unassigned pool for that grade level using a drag and drop tool. The teacher may also examine a roster and determine that a student is either no longer in that classroom, or that they no longer exist within that school, or reset a password, though passwords are not relevant when an SSO sign in method is being used. A building level administrator may have additional tools to move students to different classrooms within the building.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE:  Suntex does not use subcontractors. Company employees follow proper policy in handling data for initial import of district data, trouble-shooting, customer service. We take reasonable measures to protect the confidentiality of the Data as required by federal and state laws and regulations applicable. We establish technical and physical security measures to ensure the confidentiality, integrity and availability of the Data.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: Traditionally, we retain the current school year and one-year prior of data. Before each school year we purge any older data. At the end of the contract period or upon request, information will be returned to a NYC DOE, or at such point that the Data are no longer needed for the purpose referenced in this Agreement, or, at the sole discretion of NYC DOE, securely destroyed, and all electronic Data purged from the network in a manner that does not permit retrieval of the data.
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Data will be stored within the Atlanta Data Center of Aptum Technologies, 106 Jefferson Street, Suite 300, San Antonio TX 78205 (Formerly Cocego-Peer1), a top-tier and leading hosting provider. Multiple approaches to data security include physical security (CCTV, biometric access control, on-site guards), network and application protection, including DDoS protection, hardware fire, load balancer, and access through VPN only. The next layer of security includes alert logic monitoring and McAfee enterprise anti-virus. Web Site access is only allowed using SSL (2048-bit). The environment is kept clean, installing only the necessary applications and features, and is kept up-to-date with the latest security patches. 
  6. How the data will be encrypted (described in such a manner as to protect data security): All data in motion will be encrypted either via Secure HTTP (HTTPS), SFTP, or another approved encryption mechanism. In general, Email send and receive is protected by TLS in its transmission, but is not generally an acceptable means of passing confidential information.

Grouptrail

  1. The exclusive purposes for which Protected Information will be used: NYC DOE Bridge for All Program.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE:  There is no sharing of the student data by Grouptrail for NYC DOE Bridge for All. If there was, we will have the subcontractor sign an amendment to our agreement that includes these data protection and security requirements required by this non-disclosure agreement with the NYC DOE.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement:  Upon termination of our relationship with the NYC DOE related to this agreement, the protected information is deleted. Decommissioned media utilizes techniques detailed in NIST 800-88. [NYC DOE comment: The current agreement became effective starting on June 26, 2020 and terminates when all NYC DOE schools and/or offices cease using FMYI, Inc.’s products/services. The terms of the agreement remain effective through the period during which FMYI, Inc. possesses or otherwise is in control of covered protected information.]
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Processor will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Processor. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Protected Information is stored in the US. 
  6. How the data will be encrypted (described in such a manner as to protect data security):  SSL for data in transit, network firewall, and encryption at rest.

Imagine Learning, Inc.

  1. The exclusive purposes for which Protected Information will be used: The exclusive purposes for which Protected Information will be used:

    Imagine Learning may use PI it collects, either separately or in combination with pre-existing data, for the following educational purposes:

    • To provide, maintain, secure, and operate the Services (such as authenticating users and troubleshooting problems as requested by an authorized person or user);
    • To develop and improve our services for NYC DOE;
    • To customize your experience or content within our Services;
    • To track and assess student development and progress through our Applications;
    • To generate reports that allow parents, teachers, and other Authorized Persons to evaluate student progress, identify students who need intervention, and discover students who can be taught together as a group;
    • To email teachers and other Authorized Persons about new features and other information related to our Services;
    • To conduct aggregate statistical studies and perform research for Authorized Persons;
    • To protect Imagine Learning and our Users, such as conducting audits or notifying NYC DOE of inappropriate or potentially harmful behavior;
    • To assist students who request online help from our state-certified, security-cleared teachers who are employed by Imagine Learning to provide individualized instruction; and other educational purposes requested and sanctioned by NYC DOE
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: Imagine Learning may, at times, share certain pieces of PI with third parties that help us provide our Services. These third-party suppliers are considered “sub-processors” under applicable data protection laws because they process (e.g., store) personal data. We expect and require that these subprocessors implement appropriate security measures to safeguard personal data, and that they comply with applicable data protection la.ws.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: All PI held by Imagine Learning is destroyed or de-identified upon one of the following after termination of our relationship with a School or Authorized Person, (ii) when it is no longer needed for the purpose for which it was provided, (iii) when advised to do so by the School or Authorized Person, or (iv) as directed by agreement with the School. De-identified data (anonymous data with all PI removed) is maintained and used for reporting, analytics, and statistical research. This research helps us evaluate the effectiveness of Imagine. Learning and improve our Services for you and other customers. We do not attempt to re-identify information that has been de-identified. [NYC DOE comment: The current agreement became effective starting on April 14, 2020 and terminates when all NYC DOE schools and/or offices cease using Imagine Learning, Inc’s products/services. The terms of the agreement remain effective through the period during which Imagine Learning, Inc. possesses or otherwise is in control of covered protected information.]    
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.] 
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Personal information collected and processed by Imagine Learning is encrypted in transit and at rest.  It is also stored within the continental United States. See the Security Practices section of the Imagine Learning Privacy Policy FAQ (https://imaginelearning.com/privacy/faq) for additional details. 
  6. How the data will be encrypted (described in such a manner as to protect data security): Personal information collected and processed by Imagine Learning is encrypted in transit and at rest using FIPS 140-2 compliant methods and algorithms.

Curriculum Associates, LLC (i-Ready)

  1. The exclusive purposes for which Protected Information will be used: Personally Identifiable Student Information (PISI) will be used to make online i-Ready product available to the NYC DOE.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: Curriculum Associates does not use subcontractors. Individual contractors sign NDAs and/or Student Data Privacy Acknowledgments. 
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: PISI is deleted upon written request. [NYC DOE comment: The current agreement became effective starting on January 23, 2020 and terminates when all NYC DOE schools and/or offices cease using Curriculum Associates, LLC’s products/services. The terms of the agreement remain effective through the period during which Curriculum Associates, LLC possesses or otherwise is in control of covered protected information.]  
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipients. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.] 
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): PISI is stored in the United States.
  6. How the data will be encrypted (described in such a manner as to protect data security): Application data is encrypted at rest with AES-256 algorithm and in transit is encrypted with TLS 1.2 algorithm.

Kinvolved, Inc.

  1. The exclusive purposes for which Protected Information will be used: KiNVO is an app that is used by educators and administrators to inform parents of a student’s attendance. Educators and administrators can also send contacts information relevant to a student’s education, such as homework assignments, school event, and so forth.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE:  Kinvolved requires subcontractors or other authorized persons or entities to sign non-disclosure agreements and abide by company-driven privacy and security protocols.  
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: PISI is permanently deleted from Kinvoled’s database, Kinvolved does not maintain a record of PISI. Note: Data may exist in backups for a period of 35 days after the data is deleted from the database.  [NYC DOE comment: The current agreement became effective starting on August 22, 2019 and terminates when all NYC DOE schools and/or offices cease using Kinvolved, Inc.’s products/services. The terms of the agreement remain effective through the period during which Kinvolved, Inc. possesses or otherwise is in control of covered protected information.]    
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data and the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.] 
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): PISI is stored in the United States.
  6. How the data will be encrypted (described in such a manner as to protect data security): Data is encrypted in transit and at rest.

McGraw Hill LLC

The exclusive purposes for which Protected Information will be used:  

  1. Processor will use PII to provide the requested service or to process transactions such as information requests or purchases in order to meet our contractual obligations to you. We will also process your PII to meet our legitimate interests, for example to personalize your experience and to deliver relevant content to you; to maintain and improve our services; to generate and analyze statistics about your use of the services; and to detect, prevent, or respond to fraud, intellectual property infringement, violations of law, violations of our rights or Terms of Use, or other misuse of the services. Except as described in this notice, we limit the use, collection, and disclosure of your PII to deliver the service or information requested by you. We do not collect, use, or disclose PII that is not reasonably related to the purposes described within this notice without prior notification. Your information may be combined in an aggregate and de-identified manner in order to maintain and/or improve our services.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: Processor requires any and all subcontractors, persons or entities with which the Processor may share the PII to commit contractually that they will abide by the terms of the Agreement and/or the data protection and security requirements set forth in Education Law §2-d.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: When the Agreement terminates between the NYC DOE and the Processor, upon written request, the Processor shall return to the NYC DOE or, if agreed to by the NYC DOE, destroy the remaining PII that the Processor still maintains in any form. [NYC DOE comment: The current agreement became effective starting on August 3, 2020 and terminates when all NYC DOE schools and/or offices cease using McGraw Hill LLC’s products/services. The terms of the agreement remain effective through the period during which McGraw Hill possesses or otherwise is in control of covered protected information.] 
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Processor will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Processor. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Processor’s products require a minimal amount of PII to be collected and stored for proper use of the program. Our platform is a hybrid cloud-based and physical data center platform fully hosted by Processor. We utilize Amazon Web Services (AWS) cloud services for delivering our content to customers. Processor maintains two geographically separate data centers (East Windsor, NJ and Secaucus, NJ) which are interconnected via high speed private links. All data is stored in the continental United States.
  6. How the data will be encrypted (described in such a manner as to protect data security): Processor uses encryption technology to protect data while in motion or in its custody from unauthorized disclosure as specified in Education Law §2-d;

n2y LLC

  1. The exclusive purposes for which Protected Information will be used: To provide the contracted services which include delivery and support of Software as a Service solutions for use by teachers and their students with special needs in the K-12 classroom.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: Typically n2y does not provide authorized non-employee resources credentials to access the production environment where a customer’s student and teacher data resides.    In the event an authorized non-employee needed access to the production environment to support the contracted services, they would grated the appropriate role and permissions to access n2y’s tenant, not the customer’s tenant where their student or teacher or principal data resides. 
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement:  The data is destroyed within 90 days of termination of the customers subscriptions in accordance with n2y’s Terms of Use and Data Privacy Policy. [NYC DOE comment: The current agreement became effective starting on August 13, 2020 and terminates when all NYC DOE schools and/or offices cease using n2y’s products/services. The terms of the agreement remain effective through the period during which n2y possesses or otherwise is in control of covered protected information.]   
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Processor will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Processor. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Data is stored in the US in multiple Microsoft Azure data centers. Data is encrypted in transit and at rest in the SQL Server data base. The SaaS applications are built on MS Azure App Services platform as a service which includes several levels of security at the app services operations level. MS Azure monitoring tools are also used to monitor the services used to operate n2y SaaS platform.  
  6. How the data will be encrypted (described in such a manner as to protect data security): Using TLS 1.2 in transit and Azure SQL TDE for encryption at rest. 

NTT DATA, Inc.

  1. The exclusive purposes for which Protected Information will be used: The New York City (NYC) Department of Education (DOE) has a requirement for supporting the Learn at Home initiative brought about by the Coronavirus pandemic that has caused the DOE to close its schools for the safety of the students and DOE staff. To continue to meet the education needs of its students, the DOE Learn at home program requested that NTT DATA, Inc., manage the distribution of iPads and smart devices to students and teachers who do not have computer access at home. 
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: NTT DATA, Inc., works with Custom Computer Specialists as their sub-contractors. Only authorized personnel from NTT DATA’s sub-contractor will be allowed to access the protected information in order to carry out and perform required services. All authorized users will be contractually bound by an agreement that will include confidential and data security obligations. In addition, all authorized users with access to confidential information will be trained to understand the privacy and data security obligations of this Agreement.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: All confidential data and PII will be securely stored and access will only be grated to authorized users for the purpose of providing services to the extent mentioned under the contract. Upon completion of project and/or termination all data will be securely destroyed or returned to DOE. [NYC DOE comment: The current agreement became effective starting on June 18, 2020, and terminates when all NYC DOE schools and/or offices cease using NTT DATA, Inc.’s products/services. The terms of the agreement remain effective through the period during which NTT DATA, Inc. possesses or otherwise is in control of covered protected information.]
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Data will be accessed in US and securely on SharePoint. Access to the data is strictly issued based on job requirement and at the minimal to perform the same. The customer data shall be logically and physically separated from other customer data. Data shall be periodically backed up based on the customer requirement. NTT DATA Services encrypts the data at rest which resides in our environment and data in motion which leaves our environment using industry standard cryptographic techniques. In this way confidentiality, integrity and availability of the data in ensured in NTT DATA Services. 
  6. How the data will be encrypted (described in such a manner as to protect data security): NTT DATA Services encrypts the data at rest which resides in our environment and data in motion which leaves our environment using industry standard cryptographic techniques.

ParentSquare, Inc.

  1. The exclusive purposes for which Protected Information will be used: ParentSquare uses PISI for the purposes of school-home communication, as administered by districts, schools, teachers, and parents.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: When ParentSquare contracts with a third party, their organizations must maintain privacy policies as stringent as ours if we share PII with them.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: At the end of a customer's usage of the ParentSquare platform, the customer may request that ParentSquare make their data unavailable. At this point ParentSquare will disable access to the customer's data by configuring the software to disallow access. If a customer has other specific requirements, ParentSquare will engage with the customer to define the next steps. Data can be exported in a CSV file and sent to the customer. In the case that a customer has a need to permanently remove a piece of data that was mistakenly entered into ParentSquare, they can engage with ParentSquare's support organization to permanently obfuscate that data item from the live system and all future backups. [NYC DOE comment: The current agreement became effective starting on June 4, 2020 and terminates when all NYC DOE schools and/or offices cease using ParentSquare’s products/services. The terms of the agreement remain effective through the period during which ParentSquare possesses or otherwise is in control of covered protected information.]
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): ParentSquare’s physical infrastructure is hosted and managed within Amazon’s secure data centers and utilize the Amazon Web Service (AWS) technology. ParentSquare’s primary data center is on the East coast and the backup is on the West coast. We backup our data on AWS S3 and in multiple zones. ParentSquare uses AWS security best practices such as virtual private cloud, firewalls, and recommended intrusion detection. AWS’ highly secure data centers have been accredited under: SOC 1/SSAE 16/ISAE 3402, SOC 2 (formerly SAS70), PCI Level 1, ISO 27001, and FISMA.
  6. How the data will be encrypted (described in such a manner as to protect data security): With ParentSquare, data is encrypted in transit and at rest to provide protection of sensitive data at all critical points in its lifecycle. All data is transmitted over HTTPS connection to and from the ParentSquare application.

Perfection Learning Corporation

  1. The exclusive purposes for which Protected Information will be used: The Personally Identified Information (PII) access collected for Perfection Next is used exclusively for the purpose of delivering the educational experience for students and teachers. The information collected is to identify the user in the system and ultimately associate progress of assignments.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: In the event, that a subcontractor or other authorized persons or entities are provided access to student, teacher, or principal data, the resource(s) will have to have completed a background check and training on handling Personally Identifiable Information.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: When the agreement ends, we will terminate the student/teacher data from our systems. [NYC DOE comment: The current agreement became effective starting on April 22, 2020 and terminates when all NYC DOE schools and/or offices cease using Perfection Learning’s products/services. The terms of the agreement remain effective through the period during which Perfection Learning possesses or otherwise is in control of covered protected information.]
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.] 
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Perfection Learning has processes and auditing in place to identify breaches and unauthorized disclosures. Should any data breach or unauthorized disclosure be identified by Perfection Learning, NYC DOE will be notified within 24 hours.
  6. How the data will be encrypted (described in such a manner as to protect data security): All data is encrypted via SSL in transit. All Personally Identifiable Information (PII) contained within Perfection Next is stored encrypted in the database at rest state.

PowerMyLearning, Inc.

  1. The exclusive purposes for which Protected Information will be used: PISI consists of basic identifying information (student name, etc.) that is used exclusively to enable access to the PowerMyLearning Application. The Application does not hold any information received from the DOE beyond basic identifying information. For example, the application does not hold teacher personnel data, student grades, student discipline history, student IEP records, or student health data.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: No subcontractors have access rights to the Application containing DOE Information. Per PowerMyLearning’s Information Security Policy, access rights to the Application production system containing DOE Information are granted only to three employees (1) Managing Director of Technology & Architecture, (2) Senior Developer, and (3) Senior Data Analyst.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: Upon expiration of the DOE non-disclosure agreement or upon written request from the DOE, PowerMyLearning will erase from the Application any DOE confidential information. When a Microsoft Azure customer deletes a storage object (e.g., blob, file, queue, table), the pointer to this object is immediately deleted from the storage index used to locate and access the data. This operation is replicated asynchronously for Geo-Redundant Storage, which is the system that PowerMyLearning deploys for redundancy. With the storage index updated, the data is immediately unavailable. Azure Storage interfaces do not permit direct disk reads, mitigating the risk of another customer (or even the same customer) from accessing the deleted data before it is overwritten. [NYC DOE comment: The current agreement became effective starting on August 19, 2019 and terminates when all NYC DOE schools and/or offices cease using PowerMyLearning’s products/services. The terms of the agreement remain effective through the period during which PowerMyLearning possesses or otherwise is in control of covered protected information.] 
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.] 
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): All PISI is stored in the US.
  6. How the data will be encrypted (described in such a manner as to protect data security): All PISI encrypted in transit. All PISI is encrypted at rest at the hard disk level. Encryption methodologies used are HTTPS SSL – SHA 256 with RSA encryption and RSA-SHA1 encryption.

Savvas Learning Company LLC (f/k/a Pearson)

  1. The exclusive purposes for which Protected Information will be used: To facilitate the use of the enVisionmath 2.0 program by the NYC DOE’s students.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: Savvas employees with access to customer data receive training regarding data privacy best practices and applicable legal requirements. Subcontractors are bound to process data only for the purpose for which it was provided and not to disclose such data without Savvas’ permission, and are required to implement industry standard procedures and safeguards for the protection of data.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: March 1, 2019 to June 30, 2024. If, within thirty days of termination of this Agreement, the BOE has not requested surrender or destruction of Confidential Information, Savvas shall request in writing that the BOE inform Savvas whether it should continue to hold Confidential Information, or whether it should surrender or destroy it. If the BOE has failed to reply with further instructions to Savvas’ written request within sixty days of it being sent, Savvas shall destroy all Confidential Information.
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.] 
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): PISI will be stored solely in the United States. Customer data will all be contained within the United States. The PISI is contained within an individual service, isolated from other mechanisms that make up the software. Those mechanisms refer back to the service using a unique identifier that minimizes the exposure of PISI. Furthermore, the PISI is encrypted at rest, encrypted in transmission, and firewall contained to specific systems that may require access to it, within our Virtual Private Cloud (VPC) in AWS. Access to this VPC is also restricted through a bastion system with strictly limited role based access and auditable. AWS uses FIPS 140-2 validated HSM's (Hardware Security Module). Separation of duties and rolebased access control limits AWS employees to only monitor, maintain the health and provide audit logs. AWS employees are not able to export or use our encryption keys. In addition, AWS complies with ISO 27018, a code of practice that focuses on protection of personal data in the cloud. It is based on ISO information security standard 27002 and provides implementation guidance about ISO 27002 controls that is applicable to personally identifiable information (PII) processed by public cloud service providers. For more information, please visit this link: https://aws.amazon.com/compliance/iso-27018-faqs/
  6. How the data will be encrypted (described in such a manner as to protect data security): Beginning with data at it's stored (rest) state, it is encrypted using database Transparent Data Encryption (TDE). The data is restricted to and accessed only by the dedicated service tasked with mapping relations from the unique identifier to an individual. All data in this transmission to and from the service is also secured.

The Sparkler

  1. The exclusive purposes for which Protected Information will be used: To provide the service, directly and in coordination with the BOE. Aggregated non-identifiable data may also be used to improve the service.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: Data protection and security requirements that meet or exceed these requirements are a part of Sparkler’s privacy policy and all employment and contracting agreements used by Sparkler.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: The agreement starts on signing, and will extend no more than a year, or until terminated by either party. Protected information held by Sparkler will be deleted at any time at the instigation of either users or the DOE, and at any rate under Sparkler’s policies will be deleted no later than one year after the end of the agreement. [NYC DOE comment: The current agreement became effective starting on April 1, 2020 and terminates when all NYC DOE schools and/or offices cease using Sparkler’s products/services. The terms of the agreement remain effective through the period during which Sparkler possesses or otherwise is in control of covered protected information.] 
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Data is stored in the US, using the commercially reasonable protections afforded by AWS. Further provisions are described in the Recipients Terms of Use and Privacy Policy.
  6. How the data will be encrypted (described in such a manner as to protect data security): Sparkler is using the industry standard AES-256 encryption algorithm to encrypt all data on the server. For encrypting network communications and establishing the identity of the app, Sparkler is using industry standard SSL/TLS protocols.

MIND Research Institute (ST Math)

  1. The exclusive purposes for which Protected Information will be used: Personally Identifiable Student Information (PISI) will be used to enroll/roster students into the ST Math program as well as collect usage and performance data as related to the program (i.e. progression through the program, mastery of standard, time on the program). 
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: MIND Research Institute requires all employees that will handle PISI to agree to and sign our employee handbook which details requirements each employee must adhere to in order to ensure the security of user data. Additionally, MIND Research Institute provides scheduled training and refresher training on best practices in the handling of data and requires employees to participate. 
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: PISI received from a LEA is de-identified or deleted in a reasonable period of time after the relationship between MIND Research Institute and the LEA has been terminated. [NYC DOE comment: The current agreement became effective starting on September 18, 2019 and terminates when all NYC DOE schools and/or offices cease using ST Math’s products/services. The terms of the agreement remain effective through the period during which ST Math possesses or otherwise is in control of covered protected information.]        
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): MIND Research Institute's infrastructure is hosted within the United States. We design and implement our systems to provide resiliency against server, segment, and geographic failure, through the implementation of a clustered redundant architecture that yields highly available service endpoints. which provide resiliency against server, segment, and geographic failure. We utilize service providers whose systems have been certified for compliance with security standards including ISO 27001. 
  6. How the data will be encrypted (described in such a manner as to protect data security): Unauthorized access of User data is a real risk facing the users of today's electronic information services. MIND Research Institute strives to keep informed of these risks, and we work diligently to combat them. One method of protecting User data is to utilize cryptography to prevent data visibility in the event of its unauthorized access. MIND Research Institute leverages cryptography to protect user data in the following two ways:
  • Data in Transit. Our services support Transport Layer Security (“TLS”) to encrypt User communications (TLS 1.0 or greater and only the strongest ciphers). Data transferred between our Site and its end Users (including credential submission, data uploads, and data downloads) are sent over TLS connections, which protect such data using strong encryption, so that data in transit is kept in a private channel between the intended User and our systems.
  • Data at Rest. User data that contains personally identifying information, when “at-rest” (i.e., when in storage) is encrypted using industry standard AES-256. There are two types of "at rest" storage:
  • Database. Database server disk storage is “volume” encrypted (i.e., encrypted at the level of the database).
  • User Files. User files are individually encrypted before being recorded on long-term, secondary storage systems.

Evolution Labs (EL) (Suite 360)

  1. The exclusive purposes for which Protected Information will be used: For the purposes of administering and assessing learning related to the subject material of the program.  
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: Data is only shared with Evolution Labs employees with a demonstrated need for that information (i.e. developers, DBAs, Client Services etc).  Each EL employee receives annual training on protecting user data. Data is never shared outside of EL.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: NDA begins on August 27, 2020 and is sustained indefinitely until/unless either party terminates the agreement. Upon expiration of the agreement, archived data is kept for 12 calendar months upon which time it is destroyed. Accelerated deletion of data can occur upon request.
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.] 
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Data is stored in the US and all databases are encrypted and protected with industry standard security.
  6. How the data will be encrypted (described in such a manner as to protect data security): Databases are encrypted at rest. All programs utilize industry standard encryption.

TalkingPoints

  1. The exclusive purposes for which Protected Information will be used: To provide a two-way translated messaging platform between school & district administrators, teachers and parents.
  2. How you will ensure that the subcontractors or other authorized persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements required by your non-disclosure agreement with the NYC DOE: As described in Attachment B, TalkingPoints has implemented strict controls over physical, environmental, and software security for all employees and contractors.
  3. When the non-disclosure agreement with the NYC DOE starts and ends and what happens to Protected Information upon expiration of the agreement: TalkingPoints will either delete or return, within a commercially reasonable period of time but not to exceed 45 days, all personally identifiable information upon the expiration of any agreement when requested to do so by notification from the contracting party; [NYC DOE comment: The current agreement became effective starting on May 29, 2020 and terminates when all NYC DOE schools and/or offices cease using Talking Points’ products/services. The terms of the agreement remain effective through the period during which Talking Points possesses or otherwise is in control of covered protected information.] 
  4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Processor will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Processor. Any parent, student, eligible student, teacher or principal may correct inaccurate student data or teacher or principal data that is collected. [NYC DOE comment: requests for copies of student data or to challenge the accuracy such data should be directed to your child’s school, or to studentprivacy@schools.nyc.gov.]
  5. Whether the Protected Information will be stored in the US or outside of the US (and if outside of the US, where), and the security protections taken to ensure such data will be protected (described in such a manner as to protect data security): Protected Information will be stored in the U.S. As described in Attachment B of the Agreement, TalkingPoints’s infrastructure is built on industry-tested technology and security practices.
    • TalkingPoints uses encryption, firewall, and network security software.
    • TalkingPoints uses single sign-on (SSO) and twofactor authentication (TFA).
    • Low-level auditing software is supported for all external providers (AWS, Atlas) to record potentially malicious actions that may take place.
    • TalkingPoints runs periodic penetration tests, then logs and resolves discovered issues.
    • All TalkingPoints clients use TLS/SSL when communicating with our servers.
    • TalkingPoints has a host-based intrusion detection system to detect unauthorized access to production hosts.
    • Audit logs are sent to a central location for storage and analysis. Access to production servers and interaction with production systems is audited and logged.
  6. How the data will be encrypted (described in such a manner as to protect data security): All student data or teacher or principal data is stored on cloud servers within the United States and protected with industry standard and best practices procedures, including AES256-CBC encryption when in transit and when stored at rest.

Research

American Institute for Research

1. The exclusive purposes for which PISI will be used: The PISI data collection will allow us to match student across data sets and to assess the impact of BARR on the three primary outcomes: (1) credit accumulation in core courses, (2) standardized assessment reading achievement, and (3) standardized assessment mathematics achievement. AIR will estimate program impacts using three-level hierarchical models, with students nested within schools, nested within regions. Each impact model will include student-level background characteristics (e.g., prior test score, gender, race, ELL status, special education status, free and reduced-price lunch eligibility), a treatment indicator, school level characteristics, and a set of regional dummy variables to account for the randomization blocks.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: All staff who will be working with data related to human subjects will have passed IRB certification. To protect confidential data, any identifiable variables, raw data, or derived variables will be stored on a secure data management site hosted by AIR. Access to this site will be limited to staff assigned to the project.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: After the study time period is complete, all data will be securely erased from hard drives using the PGP Whole Disk Encryption Shredder, that meets DoD 5220.22-M standards. If applicable, hard copy media will be destroyed by a cross cut or diamond cut shredder shall be used to ensure proper destruction beyond reconstruction/recognition. The AIR shredding service (containers are located in common work areas), may be used for high bulk requirements. Hard drives that include sensitive data that are designated for re-use by IT are sanitized as per NIST SP 800-88 Rev I. A "Certificate of Media Sanitization" will be provided to the project or client upon request.

[NYC DOE additional information: The current agreement became effective starting on February 1, 2019 and remains effective through the period during which American Institute for Research possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Participants have access to the AIR evaluation team at any time to discuss challenges and/or accuracy of the data that is collected. A meeting will be scheduled with the participant and the AIR evaluation team to discuss concerns regarding data collected and reported as needed. Lastly, all participants are given the option to decline to participate in the study.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov] 

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: The requested PISI data will be stored on a secured server managed by the AIR evaluation team.

American Institute for Research 2

1. The exclusive purposes for which PISI will be used: The data requested here will be used in our analyses to understand factors that influence the impact of the TeacherRead intervention and will be reported through articles in peer-reviewed journals and research briefs. Specifically, HLMs will be used to compare the relative impacts of the TeacherRead conditions and the control condition on children's language/literacy skills long-term (end of K school year). For K language and literacy outcomes, we will estimate the TeacherRead impact at posttest by analyzing residualized gain. Note: We will need kindergarten placement of each study child to gather children's language/literacy skill data at the end of the K year. 

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: All project staff are briefed on the data security plan for the project and their responsibility to report data breaches or suspicious activities. AIR data users who access data in Azure are required to utilize two-factor authentication after confirmation of authentication using a strong 12-character password that meets AIR's password complexity requirement. AIR's company-issued laptops also have PGP AES encryption.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: Data will be archived to conform to AIR policy. Unless otherwise directed, hard-copy data will be shredded and destroyed 3 years after the life of the project; electronic records will be maintained for 10 years beyond the life of the project to comply with the grant requirement of the Institute of Education Sciences.

[NYC DOE additional information: The current agreement became effective starting on February 18, 2020 and remains effective through the period during which American Institute for Research possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: N/A - there is no student-specific data. Personally identifiable data will be stripped from any data collection materials so that only a study ID is used to identify participants. A crosswalk linking study IDs and personally identifiable information will be stored securely and separate from the data. Data will only be reported in the aggregate.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov] 

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: Electronic project files will be stored in an AIR managed secure data portal hosted in the FedRAMP-certified Azure cloud. The AIR Project Director manages permissions to the file folders, in coordination with the IT Department, limiting access to project personnel with the "need to know." Permissions are updated quarterly per AIR’s corporate policy.

City University of New York (CUNY) Data Sharing

1. The exclusive purposes for which PISI will be used: The course and exam data provided by the DOE will serve as applicants’ official high school transcripts and be used to evaluate applicants’ admissibility to the CUNY colleges to which they have applied. CUNY will use the biographical data provided by the DOE to match the academic records provided by the DOE to CUNY applications. CUNY will use immunization records provided by the DOE as proof of students’ immunization status, as required for college enrollment. CUNY will use the research dataset solely for research projects designed to improve instruction or program administration at CUNY colleges. 

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: Access to the biographical, course, and exam data files will be limited to the staff of CUNY’s University Application Processing Center, who are informed of their responsibilities for handling personally identifiable data in writing and required to sign data use and access agreements.

Access to the Research Data Set will be limited to employees of CUNY’s research offices, who are informed of their responsibilities for handling personally identifiable data in writing and required to sign data use and access agreements. In addition, all employees in these offices must acknowledge, by signature, receiving a copy of the University’s Policy on Acceptable Use of Computer Resources and IT Security Policies.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: This agreement expires on December 31, 2028. CUNY can purge DOE data if requested by the DOE due to the expiration or termination of the Memorandum of Understanding.

[NYC DOE additional information: The current agreement became effective starting on May 21, 2019 and remains effective through the period during which City University of New York possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its obligations in its Memorandum of Understanding with the DOE, CUNY will work with the DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: Data provided by the DOE will be stored and protected in a manner consistent with other CUNY confidential, personally identifiable, and protected health data. Common security controls include firewall, intrusion prevention, limited authorized access, and data center physical security. The data is encrypted during transmission.

City University of New York (CUNY) Office of Research, Evaluation, and Program Support

1. The exclusive purposes for which PISI will be used: The Office of Research, Evaluation, and Program Support (REPS) at the City University of New York (CUNY) is conducting reporting and evaluations of programs under CUNY's K-16 Initiatives that serve students in grades 6-12, including the Early College Initiative (EC!), College Now, LINCT to Success, Tutor Corps, CUNY Peer-Enabled Restructured Classrooms (PERC), and College Bridge for All. The reports and studies will investigate the impact of these programs by examining what effect these programs had on student outcomes such as math and computer science course performance; college matriculation; and postsecondary momentum, persistence, and degree attainment. PISI is used to retrieve information about students participating in the programs and, in some cases, to identify a valid comparison group.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: No data under this agreement will be shared with external parties. REPS analysts and research fellows working on the various projects will have access to the data. The data will be stored on CUNY's secure network in a folder restricted to the REPS research team. The data will not be circulated via email or stored on zip drives or other electronic devices. The data will be considered confidential. All REPS analysts and research fellows have signed a non-disclosure agreement, protecting all data and information to which they have access.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: Data received from this request will be used to furnish the evaluation and any necessary revisions to analyses. In keeping with the standard in research, data will be kept for five years from the time of receipt to allow for any follow-up evaluation analyses. Data destruction will be conducted according to established procedures in REPS. Data will be deleted from REPS's network drive and a request will be sent to CUNY's network administrator to delete the data permanently from the mainframe.

[NYC DOE additional information: The current agreement became effective starting on April 29, 2019 and remains effective through the period during which City University of New York – Office of Research, Evaluation, and Program Support possesses or otherwise is in control of covered protected information, not to exceed five years from date of receipt.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: All data will be shared via the CUNY-approved secure online document-sharing platform-Axway Secure Transport (https://stedge.cuny.edu/). CUNY currently receives data from the NYCDOE via this platform under an established data sharing agreement. The existing NYCDOE-CUNY Axway Secure Transport account will be used to transmit the data and a separate folder will be created for this request. Once the data file has been uploaded. REPS will download the file and save it on CUNY's secure network in a restricted folder. The data will not be circulated via email or stored on zip drives or other electronic devices. After download, REPS will delete the file from Axway Secure Transport.

ExpandED Schools

1. The exclusive purposes for which PISI will be used: ExpandED Schools will link together data from various data sources (test scores, report card grades, attendance, m1d demographics). We will then strip the data file of all student-identifiers before conducting analyses. All state-mandated analyses are reported in the aggregate. ExpandED Schools will conduct descriptive analysis of the proportion of students within the individual programs hitting each of the 2 IC targets outlined previously (i.e. what proportion are proficient in Math or ELA, what proportion have met the required attendance rate), as well as an examination of whether there have been positive changes in academic and social emotional outcomes based on self-report survey data. Ratings from the Out-of-School Time Observation Tool will be shared with after-school programs along with a narrative report that provides qualitative observations and recommendations from the site visit. Intended audiences include program managers, site coordinators, CBO and School staff members, NYSED, and 21st CCLC state evaluator.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: All data that is sent to external partners or entities will be de-identified and aggregated at the program or school level.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: After seven years, data will be destroyed. All electronic data files will be purged while all paper files will be shredded using ExpandED Schools' secure data shredding system.

[NYC DOE additional information: The current agreement became effective starting on December 4, 2018 and remains effective through the period during which ExpandED Schools possesses or otherwise is in control of covered protected information, not to exceed seven years.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: Hard copy data will be stored in locked cabinets. Digital data is stored on our secure servers and in secure electronic files.

ExpandED Schools 2

1. The exclusive purposes for which PISI will be used: All data collected and used as part of the 21CCLC program is for the purposes of program evaluation and continuous improvement. Analysis of data allows for the targeting of individualized supports to sites. Unit-level data are never shared; results are always presented in aggregate. Data is always suppressed for groups where the sample size is less than five (5) individuals.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: ExpandED Schools will not share data that is provided by the NYC DOE with parties outside of the organization. For data not under the purview of this NDA (e.g. student-level afterschool program attendance data housed in DYCD online), our process is to enter into a Memorandum of Understanding with the organization that clearly outlines the data regulations required.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: After five years of receipt of data, they will be destroyed/wiped clean from our server.

[NYC DOE additional information: The current agreement became effective starting on July 2, 2020 and remains effective through the period during which ExpandED possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: All protected information collected by ExpandED is stored in the United States on ExpandED’s servers. Further, data is only accessible to members of the ExpandED Research Team. As stated previously, unit-level data are never shared; results are always presented in aggregate. Data is always suppressed for groups where the sample size is less than five (5) individuals. All data is stored electronically on ExpandED’s servers. All communication to the file server is encrypted.

Fordham University

1. The exclusive purposes for which PISI will be used: The data requested will be used exclusively for research purposes to investigate linkages between sleep and academic outcomes among participants in our study. All data will be de-identified for analyses and data will be reported in the aggregate. At no point will an individual child's data be shared in an identifiable manner.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: All members of our research team have successfully completed the CITI human subjects training and understand the importance of keeping the data confidential. The principal investigator and the lab manager monitor data protection regularly.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: Data will be destroyed upon expiration of the agreement.

[NYC DOE additional information: The current agreement became effective starting on January 24, 2019 and remains effective through the period during which Fordham University possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: The data are stored in a secure network as part of Fordham University's institutional network. Only members of our research team have access to the data files and access is routinely monitored and updated as personnel changes occur among the research team.

Impact Development & Assessment

1. The exclusive purposes for which PISI will be used: To manage the data that is used to assess the effectiveness of the HMI OST program, and make program adjustments and maintain successes accordingly. PISI are transformed into code numbers, which are connected to data, so there is no threat of identifiable data being linked to data. Where permissible, and through separate agreements, findings may be shared as part of grant submissions or aggregated results in academic publications or conferences to help improve the field. In those cases, all identifying information will be removed.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: They will complete training and provide signed documentation indicating that they will act in alignment with the ethics of the IRB, Impact and the BOE regarding PISI and all data.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: These data will be deleted and therefore destroyed.

[NYC DOE additional information: The current agreement became effective starting on December 4, 2018 and remains effective through the period during which Impact Development & Assessment possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the recipient will work with the NYC BOE in processing challenges to the accuracy of student data in the custody of the recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: These data will be stored in a secure cloud-based storage system that is password protected. Only the research team will have access to these files. Materials will be kept for three years after study completion, and then may be destroyed. Each participant will be linked with a code. The document with participant information will be stored in a password protected file on the recipient's password protected computer.

Impact Development & Assessment 2

1. The exclusive purposes for which PISI will be used: To manage the data that is used to assess the effectiveness of the l-lI\11 OST program, and make program adjustments and maintain successes accordingly. PISI are transformed into code numbers, which are connected to data, so there is no threat of identifiable data being linked to data. Where permissible, and through separate agreements, findings may be shared as part of grant submissions or aggregated results in academic publications or conferences to help improve the field. In those cases, all identifying information will be removed. 

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: They will complete training and provide signed documentation indicating that they will act in alignment with the ethics of the IRB, Impact and the BOE regarding PISI and all data.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: These data will be deleted and therefore destroyed.

[NYC DOE additional information: The current agreement became effective starting on June 17, 2019 and remains effective through the period during which Impact Development & Assessment possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the recipient will work with the NYC BOE in processing challenges to the accuracy of student data in the custody of the recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: These data will be stored in a secure storage facility on-site at the Impact office. Since all Impact staff are IRB certified, they are equipped to handle data ethically. Only the research team will have access to these files. Materials will be kept for three years after study completion, and then may be destroyed. Each participant will be linked with a code. The document with participant information will be stored in a password protected file on the recipient's password protected computer.

L&G Research and Evaluation

1. The exclusive purposes for which PISI will be used: PISI will be used to conduct an outcome evaluation to determine the extent to which 21st CCLC. Programming impacted students’ academic performance as measured by report card grades, test scores, and school day attendance. Recipients of the Round 7 21st CCLC grant are required to report the results of this outcome evaluation annually to New York State Education Department.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: L&G Research and Evaluation Consulting, Inc. (L&G) will not share any raw student datasets or identifiable data received from NYC DOE with any entity. The data will be analyzed and reported in aggregate only. L&G will abide by all protection and security requirements by ensuring that data is received on an FTP server that enables full encryption.

3. When the agreement expires and what happens to P1Sl upon expiration of the agreement: The data will be destroyed after being kept for three years. All files downloaded to password-protected computers and SPSS or STATA databases will be permanently deleted using an overwrite utility that makes the file unrecoverable. Any paper copies of data will be shredded with a professional grade shredder. We will also submit the Certificate Records of Disposal.

[NYC DOE additional information: The current agreement became effective starting on June 22, 2020 and remains effective through the period during which L&G Research and Evaluation possesses or otherwise is in control of covered protected information.]

 4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. Pursuant to its contractual obligations, L&G Research and Evaluation Consulting, Inc. will work with the NYC DOE, in processing challenges to the accuracy of any student data that is collected following protocol established for handling such challenges.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov] 

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: We are requesting that all student data is transferred to L&G via a secure FTP site, Filezilla Pro solution, which enables full encryption. The datasets will then be downloaded to password protected computers only accessible by the L&G research staff. In order to further protect students' anonymity students will be assigned a unique identification number so that all identifiers (OSIS number, date of birth, names, etc.) can be removed from datasets stored on computers.

L&G Research and Evaluation 2

1. The exclusive purposes for which PISI will be used: PISI will be used to conduct an outcome evaluation to determine the extent to which 21st CCLC

Programming impacted students’ academic performance as measured by report card grades, test scores, and school day attendance. Recipients of the Round 7 21st CCLC grant are required to report the results of this outcome evaluation annually to New York State Education Department.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: L&G Research and Evaluation Consulting, Inc. (L&G) will not share any raw student datasets or identifiable data received from NYC DOE with any entity. The data will be analyzed and reported in aggregate only. L&G will abide by all protection and security requirements by ensuring that data is received on an FTP server that enables full encryption.

3. When the agreement expires and what happens to P1Sl upon expiration of the agreement: The data will be destroyed after being kept for three years. All files downloaded to password-protected computers and SPSS or STATA databases will be permanently deleted using an overwrite utility that makes the file unrecoverable. Any paper copies of data will be shredded with a professional grade shredder. We will also submit the Certificate Records of Disposal.

[NYC DOE additional information: The current agreement became effective starting on June 22, 2020 and remains effective through the period during which L&G Research and Evaluation possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

Pursuant to its contractual obligations, L&G Research and Evaluation Consulting, Inc. will work with the NYC DOE, in processing challenges to the accuracy of any student data that is collected following protocol established for handling such challenges.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov] 

5. Where the PlSI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: We are requesting that all student data is transferred to L&G via a secure FTP site, Filezilla Pro solution, which enables full encryption. The datasets will then be downloaded to password protected computers only accessible by the L&G research staff. In order to further protect students' anonymity students will be assigned a unique identification number so that all identifiers (OSIS number, date of birth, names, etc.) can be removed from datasets stored on computers.

Laurus Grant-Writing and Evaluation Services

1. The exclusive purposes for which PISI will be used: PISI will be used to conduct an outcome evaluation to determine the extent to which 21st CCLC. Programming impacted students’ academic performance as measured by report card grades, test scores, and school day attendance. Recipients of the Round 7 21st CCLC grant are required to report the results of this outcome evaluation annually to New York State Education Department.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: L&G Research and Evaluation Consulting, Inc. (L&G) will not share any raw student datasets or identifiable data received from NYC DOE with any entity. The data will be analyzed and reported in aggregate only. L&G will abide by all protection and security requirements by ensuring that data is received on an FTP server that enables full encryption.

3. When the agreement expires and what happens to PISl upon expiration of the agreement: The data will be destroyed after being kept for three years. All files downloaded to password-protected computers and SPSS or STATA databases will be permanently deleted using an overwrite utility that makes the file unrecoverable. Any paper copies of data will be shredded with a professional grade shredder. We will also submit the Certificate Records of Disposal.

[NYC DOE additional information: The current agreement became effective starting on June 22, 2020 and remains effective through the period during which L&G Research and Evaluation possesses or otherwise is in control of covered protected information.] 

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. Pursuant to its contractual obligations, L&G Research and Evaluation Consulting, Inc. will work with the NYC DOE, in processing challenges to the accuracy of any student data that is collected following protocol established for handling such challenges.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov] 

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: We are requesting that all student data is transferred to L&G via a secure FTP site, Filezilla Pro solution, which enables full encryption. The datasets will then be downloaded to password protected computers only accessible by the L&G research staff. In order to further protect students' anonymity students will be assigned a unique identification number so that all identifiers (OSIS number, date of birth, names, etc.) can be removed from datasets stored on computers.

Long Island University – Brooklyn Campus

1. The exclusive purposes for which PISI will be used: PISI is used to measure the outcomes of goals and objectives for planning, implementing, and evaluating GEAR UP services. PISI is never communicated in state and federal reporting.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: Data transfer will occur through secure FTP and data will be encrypted.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: PISI and the NYGEAR UP database via Measurement Inc. will be archived in a secure electronic data warehouse for 7 years which is the industry standard timeframe for retaining data.

[NYC DOE additional information: The current agreement became effective starting on July 7, 2020 and remains effective through the period during which Long Island University – Brooklyn Campus possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: For the duration of the NYGEAR UP grant, PISI are housed in a secure, password-protected database on an MI server. Data are backed up each night. At the heart of MI’s security are 15 separate firewalls to provide layered and redundant protection against internal and external threats. These firewalls utilize statful packet inspection, port blocking, proxying, address translations, heuristics, and trend analysis.

Mathematica Policy Research

1. The exclusive purposes for which PISI will be used: The YCC grant program is authorized under Section 414(c) of the American Competitiveness and Workforce Improvement Act of 1998, as amended (29 USC 2916a). As a condition of receiving a YCC grant, each YCC grantee must participate and fully cooperate in the YCC evaluation by providing the independent evaluation contractor, Mathematica, with information on and access to program records, student records, and information on YCC participants collected as part of DOL performance measurement. In addition, DOE has reserved the right to award a follow-on contract for Mathematica to continue to track employment and post-secondary outcomes for students in YCC grantee school districts to determine long-term outcomes of the program ("YCC Follow-On Evaluation"). PISI will be used as required for the YCC evaluation and the YCC Follow-on Evaluation.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: To safeguard the confidentiality and integrity of all information and data received, to place limitations on its use, and to maintain compliance with all privacy laws, Mathematica requires all evaluation staff to comply with the data security and confidentiality requirements set forth in the Memorandum of Understanding and Non-Disclosure Agreement. In addition, Mathematica will limit access to PISI to members of the study team performing duties necessary for the YCC evaluation and YCC follow-on evaluation.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: The agreement expires when the PISI received are no longer needed for the YCC evaluation and YCC follow-on evaluation, the latter of which is anticipated to end in 2030, unless terminated earlier or extended by agreement of Mathematica and NYC DOE. When the agreement expires, Mathematica will destroy all confidential data obtained under the agreement and will confirm the destruction in writing. All files containing confidential data will be erased or overwritten using Eraser software.

[NYC DOE additional information: The current agreement became effective starting on November 1, 2018 and remains effective through the period during which Mathematica Policy Research possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its obligations under its Non-Disclosure Agreement, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted:  Data will be transmitted using a secure File Transfer Protocol (FTP) site, which is owned and operated by Mathematica Policy Research. Data will be stored on a Mathematica owned and operated project specific, access-controlled network folder. The storage device is encrypted at rest is protected by the Mathematica network firewall. Anti-malware and host-based intrusion detection/prevention are installed on all servers and storage devices.

Measurement Incorporated

1. The exclusive purposes for which PISI will be used: MI uses PISI for performing data analyses required for federal and state reporting on the progress of LIU's NYGEAR UP grant. The PISI allows us to ensure that data are accurate (no duplicate students). PISI (name and DOB) are also collected to verify college enrollment in the 7th year of the grant--a federal requirement. PISI are not identified in reports.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: All subcontractors to MI are bound by NDA. Data transfer will occur through secure FTP and data will be encrypted.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: The agreement expires December 2021 when the grant ends. PISI and the NYGEAR UP database will be archived in a secure electronic data warehouse for 7 years which is the industry standard timeframe. However, upon the expiry of the agreement, we will ask NYCDOE and LIU for authorization for data disposal.

[NYC DOE additional information: The current agreement became effective starting on July 7, 2020 and remains effective through the period during which Measurement Incorporated possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYCDOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: For the duration of the NYGEAR UP grant, PISI are housed in a secure, password-protected data base on the MI server and encryption occurs whenever data are transferred through FTP. There are 15 separate firewalls to provide layered and redundant protection against internal and external threats. They use statful packet inspection, port blocking, proxying, etc. MI regularly deploys software that detects, removes and destroys viruses, and spyware.

Owens Consulting Inc.

1. The exclusive purposes for which PISI will be used: PISI will only be used in aggregated form to conduct statistical analyses and generate descriptive data summaries.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: All subcontractors, persons or entities employed by Owen Consulting have been trained to work with PISI and have years of experience working with DOE data and are knowledgeable on data protection and security issues. Additionally they signed confidentiality agreements with Owen Consulting Inc.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: All PISI will be deleted once the agreement expires.

[NYC DOE additional information: The current agreement became effective starting on January 25, 2019 and remains effective through the period during which Owens Consulting Inc. possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with Columbia TLC staff and the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient. 

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: PISI stored in a secured FTP site, managed by the NYC DOE, and accessible to only project managers. In addition, PISI imported into Excel or SPSS will be password encrypted and stored on a password-protected computer that is only accessible by individual staff members affiliated with the project.

Owens Consulting Inc. 2

1. The exclusive purposes for which PISI will be used: PISI will only be used in aggregated form to conduct statistical analyses and generate descriptive data summaries.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: All subcontractors, persons or entities employed by Owen Consulting Inc. have been trained to work with PISI and have years of experience working with DOE data and are knowledgeable on data protection and security issues. Additionally they signed confidentiality agreements with Owen Consulting Inc.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: All PISI will be deleted once the agreement expires.

[NYC DOE additional information: The current agreement became effective starting on June 12, 2019 and remains effective through the period during which Owens Consulting Inc. possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations the Recipient will work with Zone 126 and the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: PISI stored in a secured FTP site, managed by the NYC DOE, and accessible to only project managers. In addition, PISI imported into Excel or SPSS will be password encrypted and stored on a password-protected computer that is only accessible by individual staff members affiliated with the project.

PowerMyLearning

1. The exclusive purposes for which PISI will be used: PISI will be used to determine the impact the Family Playlist program has on select students' Math achievement scores.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: Individual student data will only be accessible to a small number of PowerMyLearning staff directly responsible for the initial matching and analysis of the data. We will ensure that these staff members are aware of data protection and security requirements around storage and use of data. Data will not be shared with other PowerMyLearning staff or external persons such as teachers or principals. The analysis results may be shared externally but will not contain any identifiable information. 

3. When the agreement expires and what happens to PISI upon expiration of the agreement: Identifiable information will be deleted from all servers upon expiration.

[NYC DOE additional information: The current agreement became effective starting on January 31, 2019 and remains effective through the period during which PowerMyLearning possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: The data will be stored on a cloud based service (box.com). Every file is maintained and encrypted using AES 256-bit encryption. The files will only be accessed by Power My Learning staff with the appropriate credentials.

RAND Corporation

1. The exclusive purposes for which PISI will be used: PISI will inform our evaluation of the OBD initiative and allow Recipient to test whether the initiative is having a positive impact on student outcomes. Recipient will test the effect of the initiative on measures of student learning, attainment, and socio-emotional skills, using a matched comparison group design.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: Recipient will not share student, principal, or teacher data with subcontractors.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: Recipient will destroy the data.

[NYC DOE additional information: The current agreement became effective starting on January 24, 2020 and remains effective through the period during which RAND Corporation possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: To ensure data security, PISI will be encrypted and stored on password protected, encrypted RAND computers and servers, accessible only to project staff. Recipient will assign each participant a study identifier and maintain a link file. Access to the link file will be restricted to a research team member who de-identifies student data upon receipt. All analysis files will include only study IDs.

University of California – Davis Campus

1. The exclusive purposes for which PISI will be used: Data will be used to test the effectiveness of a growth mindset intervention on students' motivation and achievement in school, and for moderation of these effects by demographic characteristics.

2. How you will ensure that the subcontractors, persons or entities that you will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements: Any shared data will be completely de-identified with regard to district, school, and individual teacher and student.

3. When the agreement expires and what happens to PISI upon expiration of the agreement: PISI will be destroyed according to the current strictest IRB standards.

[NYC DOE additional information: The current agreement became effective starting on May 29, 2019 and remains effective through the period during which University of California – Davis Campus possesses or otherwise is in control of covered protected information.]

4. If and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected: Pursuant to its contractual obligations, the Recipient will work with the NYC DOE in processing challenges to the accuracy of student data in the custody of the Recipient.

[NYC DOE additional information: such requests, including requests for copies of student data, may be sent to studentprivacy@schools.nyc.gov]

5. Where the PISI will be stored (described in such a manner as to protect data security), and the security protection taken to ensure such data will be protected, including whether such data will be encrypted: Data will be uploaded to an SSH server on the UC Davis campus via SSH keys. Keys will be generated by the uploader, and the public key will be shared with UC Davis. The private key will never be transmitted or shared. All data received from the department of education will be stored on a highly secure SSH server and only researchers at the University of California, Davis who are working on the project will have access to this server. The server will be accessed through password protected computers. The university forbids the sharing of computer login and password information. Data files will be stored with an unidentifiable identification number.

Back to Top