July 19, 2022
AGENDA REPORT
TO: Edward D. Reiskin FROM: Guillermo Cespedes
City Administrator Chief, Violence Prevention
SUBJECT: DVP Data Management System –
SUPPLEMENTAL Report
DATE: July 13, 2022
City Administrator Approval Date: Jul 14, 2022
RECOMMENDATION
Staff Recommends That The City Council Adopt A Resolution (1) Authorizing The City Administrator To Waive the Local and Small Local Business Enterprise Program (L/SLBE) and the Competitive Bidding Process and Award a Five-Year Contract, From August 1, 2022 To June 30, 2027, To Social Solutions Global, Inc. For The Development Of An Apricot 360 Data Management System and For Annual Licensing And Technical Assistance Fees For a Total Amount Not To Exceed Five Hundred Thirty-Three Thousand Fifty-Six Dollars ($533,056); And (2) Adopting The Surveillance Use Policy Attached Hereto As Exhibit A Pertaining To The Apricot 360 Data Management System.
REASON FOR SUPPLEMENTAL REPORT
The Privacy Advisory Commission (PAC) met in a special meeting on July 12, 2022, to review two versions of the Apricot 360 Use Policy (Version A and Version B) created by the Department of Violence Prevention (DVP). At this meeting, the PAC voted to approve Version A of the Apricot 360 Use Policy (Attachment A), which is the version that DVP staff also recommend City Council approve. This supplemental report also provides a letter (Attachment B) written in support of the Apricot 360 data management system by David Muhammad, Executive Director of the National Institute for Criminal Justice Reform and a facilitator of the Reimaginging Public Safety Task Force.
The vote to approve was conditional on the use policy being amended to include a broader definition of personally-identifiable information (PII) and an amended participant consent form to include a broader definition of PII, additional information about data sharing risks, and the ability for participants to decline sharing their PII with the DVP.
The approval motion by the PAC also included approval of the draft contract between the City of Oakland and Social Solutions Global, Inc. Six commissioners were present at the special meeting; 4 voted to approve the motion and 2 voted to abstain.
City Council
City Council
July 19, 2022
Edward D. Reiskin, City Administrator
Subject: DVP Data Management System - SUPPLEMENTAL
Date: July 13, 2022 Page 2
In accordance with the PAC’s recommendation, DVP staff has included a broader definition of PII in the attached use policy. The DVP will also update the participant consent form to provide greater detail on the definition of PII, data sharing risks, and data sharing recipients.
Findings Required by Municipal Code Section 9.64.030(2)(B)
CitySpan, the DVP’s current data management system vendor, does not provide the functionality that DVP needs to comprehensively monitor and coordinate services provided to clients by DVP grantees.
The Apricot Use Policy will safeguard civil liberties and civil rights by allowing staff access to data records only on a need-to-know and right-to-know basis, meaning that they will only have access to data that is essential to their job function. Apricot 360 allows administrators to restrict access to client records and individual fields within client records for staff members based on their pre-determined access requirements. Unauthorized use of the system by any staff person with any level of access will lead to disciplinary action, which could include termination of a service provider’s grant agreement and cessation of funding and, with respect to City employees, discipline up to and including termination. The Apricot 360 software meets current Housing and Urban Development Domestic Violence, Homeless Management Information System, and Social Security Administration data management and security protocols, as well as minimum required Family Educational Rights and Privacy Act (FERPA) and HIPAA standards.
Additionally, all staff who access the Apricot 360 system will first be extensively trained by Apricot 360 trainers and/or the DVP’s data and evaluation staff, and they will be trained in the DVP’s Apricot 360 Surveillance Use Policy.
DVP staff evaluated the proposals submitted by Salesforce and Microsoft Corporation and believe that Social Solutions Global, Inc. provides the best data management system for the cost because no alternative with a lesser economic cost or impact on civil rights or civil liberties would be as effective.
ACTION REQUESTED OF THE CITY COUNCIL
Adopt A Resolution:
(1) Authorizing The City Administrator To Waive the Local and Small Local Business Enterprise Program (L/SLBE) and the Competitive Bidding Process and Award a Five-Year Contract, From August 1, 2022 To June 30, 2027, To Social Solutions Global, Inc. For The Development Of An Apricot 360 Data Management System and For Annual Licensing And Technical Assistance Fees For a Total Amount Not To Exceed Five Hundred Thirty-Three Thousand Fifty-Six Dollars ($533,056); And (2) Adopting The Surveillance Use Policy Attached Hereto As Exhibit A Pertaining To The Apricot 360 Data Management System.
City Council
July 19, 2022
Edward D. Reiskin, City Administrator
Subject: DVP Data Management System - SUPPLEMENTAL
Date: July 13, 2022 Page 3
For questions regarding this report, please contact Guillermo Cespedes at 510-238-2916.
Respectfully submitted,
Guillermo Cespedes (Jul 14, 2022 09:08 PDT)
GUILLERMO CESPEDES
Chief, Department of Violence Prevention
Reviewed by:
Mailee Wang, Administrative Services Manager
Prepared by:
Jenny Linchey, Budget and Grants
Administrator
Attachments (2):
A: Apricot 360 Surveillance Use Policy – Version A
B: Letter in support of Apricot 360 data management system from David Muhammad Exhibit A to Resolution Apricot 360 Surveillance Use Policy – Version A
Attachment
Apricot 360 Use Policy – VERSION A
City of Oakland Department of Violence Prevention
The Department of Violence Prevention (DVP) formed in 2020 with a mandate to reduce levels of gun violence, intimate partner violence, commercial sexual exploitation, family trauma associated with unsolved homicides, and community trauma associated with ongoing violence in Oakland. The DVP applies a public health approach to violence prevention and intervention efforts that focuses resources on people, neighborhoods, and times of day that are most likely to be impacted by violence. The department also applies different prevention and intervention strategies based on whether individuals are exposed to violence, at risk for violence, or at the center of violence. Each fiscal year, the DVP distributes millions of dollars in funding to community-based organizations (CBOs) in Oakland that deliver prevention and intervention services in the areas of group and gun violence, gender-based violence, and community healing. The DVP also provides direct services in the areas of adult life coaching, violence interruption, and shooting and homicide response.
A. Purpose
The Apricot 360 data management system (Apricot 360), developed by Bonterra (formerly Social Solutions Global, Inc.), will enable the DVP and its contracted CBOs to track information related to service delivery and contract management in the DVP’s three strategy areas of group and gun violence, gender-based violence, and community healing. Apricot 360 will be used by direct service staff within the DVP and CBOs to track client enrollment, service engagement, milestones, and outcomes for individual services as well as attendance, duration, and content of group services. Supervisory staff within the DVP and CBOs will use the system to ensure that direct service staff are engaging clients with the expected frequency and delivering services appropriately to facilitate behavior change. The DVP’s data and evaluation staff will use Apricot 360 to monitor service delivery and outcome data across each strategy, oversee the activities and deliverables of individual CBOs to ensure alignment with scopes of work and service models, and identify challenges with service delivery that require remediation. Fiscal and contract staff within the DVP and CBOs will use the system to store contract documents, communicate about contract questions, track budget spenddown, and process invoices based on completion of deliverables. Finally, service delivery and outcome data collected through Apricot 360 will be available to external evaluators contracted by the City of Oakland to conduct an evaluation of DVP programs and services.
B. Authorized Use
Data stored in Apricot 360 will be accessed on a need-to-know and right-to-know basis, meaning that DVP and CBO staff members will only have to access information that is essential to their job function.
Categories of Apricot 360 system usage are described below.
• Service delivery: Direct service and supervision staff employed by the DVP and contracted CBOs will use Apricot 360 to track information on client enrollment, contacts, progress towards milestones, accomplishments, referrals, and other aspects of service delivery. The system will identify upcoming staff member tasks related to service delivery and present summarized data on clients served though dashboards that are helpful to staff. Direct service staff include individuals such as case managers and life coaches who work directly with clients to deliver services or programming. Supervision staff are supervisors of direct service staff.
• Violent incident crisis response coordination: Violence interrupters employed through the DVP and contracted CBOs will receive information about shootings and homicides through Apricot 360 and enter information pertaining to their response. Select staff members within the DVP who coordinate the 24/7 response to shootings and homicides will review data entered by contracted CBOs pertaining to shooting and homicide response activities to ensure that victims and family members receive timely, comprehensive, and coordinated support services. These staff members will also use Apricot 360 to monitor and coordinate violence interruption activities to prevent retaliation.
• Program monitoring and accountability: DVP data and evaluation staff will use aggregate service delivery data to monitor trends in service delivery within activities and substrategies and ensure that summarized service delivery data are available to a range of external stakeholders, including councilmembers, committee members, grantors, and the public. DVP data and evaluation staff will also review individual-level client data within the group and gun violence strategy to determine how many clients are enrolled in multiple services, ensure that clients are not simultaneously enrolled in the same service through different providers, and ensure that services delivered to individual clients meet DVP expectations in terms of quality, frequency, duration, and reach.
• Contract management: Fiscal and contract staff employed by the DVP and contracted CBOs will use the system to manage grant budgets, monitor contract deliverables, process budget modifications and payments, and communicate about contracts.
• External evaluation: External evaluators contracted by the City of Oakland will use data from Apricot 360 to evaluate the effectiveness of services delivered by the DVP and contracted CBOs.
Evaluators will seek and receive institutional review board (IRB) approval prior to commencing research activities. Once IRB approval is obtained, evaluators will only have access to personally- identifiable information for individuals who have signed a consent form agreeing to have their identifiable data shared with a third-party evaluator. For clients who do not sign a consent form, evaluators will receive deidentified or aggregate data.
C. Data Collection
Service delivery data will be entered into Apricot 360 by direct service staff employed by the DVP and contracted CBOs. For each activity funded through the DVP’s three strategies, Tables 1-3 identify which data entry forms will be completed. Table 4 provides an overview of the types of data collected through each form.
Table 1. Data entry forms completed in Apricot 360 for the DVP’s group and gun violence strategy.
Substrategy Activity Forms completed in Apricot 360 database Client record
Family support
Group activity
Hospital response
Life map goals and
activities
Non-program
service delivery
Program
enrollment & exit
Program intake &
needs assessment
Program service
delivery
Referral to services
Relocation
Triangle incident
response
Violence mediation
Employment &
Education
Support
Services
Adult employment &
education services
x x x x x
Youth job exploration &
education services
x x x x x
School Site
Violence
Intervention &
Prevention
Teams
Community healing x
Gender-based violence:
Individual-level services
x x
Gender-based violence:
Group services
x
Violence interruption x x
Youth life coaching x x x x x x
Violent
incident crisis
response
Emergency relocation x
Family support
following homicide
x x
Hospital intervention x x
Violence interruption x x x
Youth
Diversion and
Youth & Adult
Life Coaching
Adult life coaching x x x x x x
Housing-focused case
management
x x x x
Youth diversion:
Individual-level services
x x
Youth diversion: Group-
level services
x
Youth life coaching x x x x x x
Table 2. Data entry forms completed in Apricot 360 for the DVP’s gender-based violence strategy.
Substrategy Activity Forms completed in Apricot 360 database Client record
Drop-in center
GBV crisis line
Group activity
Life map goals and
activities
Mobile advocacy
Non-program service
delivery
Program enrollment
& exit
Program intake &
needs assessment
Program service
delivery
Referral to services
Relocation
Triangle incident
response
Crisis response Bedside advocacy and
accompaniment
x x
24-hour hotlines x
Housing Emergency shelter:
Hotel vouchers
x
Substrategy Activity Forms completed in Apricot 360 database Client record
Drop-in center
GBV crisis line
Group activity
Life map goals and
activities
Mobile advocacy
Non-program service
delivery
Program enrollment
& exit
Program intake &
needs assessment
Program service
delivery
Referral to services
Relocation
Triangle incident
response
Emergency shelter:
Relocation
x
Transitional housing x x
Wrap-Around
Services
Employment support:
Individual services
x x x
Employment support:
Group services
x
Legal advocacy:
Advice and referral
x x
Legal advocacy: Case
management
x x x
Life coaching x x x x x x
Safe space
alternatives
x x x
Therapeutic support:
Individual services
x x x
Therapeutic support:
Group services
x
Table 3. Data entry forms completed in Apricot 360 for the DVP’s community healing strategy.
Substrategy Forms completed in Apricot 360 database
Client
record
Family
support
Group
activity
Mini grant
Outreach
Program
enrollment
& exit
Program
service
delivery
Referral to
services
Restorative services x
Mini grants x
Neighborhood and community teams x x
Therapeutic supports: Individual-level services x x x Therapeutic supports: Group-level services x
Town Nights x
Table 4. Types of data collected through Apricot 360 forms.
Form Data fields
Client record 1. Name and date of birth*
2. Contact information*
3. Demographic information (race, gender, education, language spoken at home)
4. Employment status
5. Housing status
6. School information, if applicable
Form Data fields
7. Names and contact information of important people, if client chooses to provide (e.g. probation officer)
Drop-in center 1. Date of visit
2. Basic demographics (age, gender, race)
Family support 1. Name of homicide victim
2. Number of individuals in family
3. Types and amount of support provided (e.g. relocation, funeral/vigil planning, VOC applications, financial)
4. Attendance at funerals/vigils
GBV crisis line 1. Time and date of call
2. Yes/No: Did call relate to GBV?
3. Basic demographic information (age, race, gender)
Group activity 1. Date, location, and duration of activity
2. Number and type (e.g. students, residents, teachers) of people in attendance
3. Type of activity (e.g. training, support group)
Mobile/bedside
advocacy
1. Date and time of contact
2. Basic demographic information (age, gender, race)
3. Yes/No: Was safety plan developed?
Hospital
response
1. Date and time of initial notification
2. Date and time of visits for service
3. Name and date of birth of individual visited
4. Type of support provided (e.g. VOC applications, relocation funding) Life map goals
and activities
1. Case plan goals
2. Planned and accomplished actions associated with goals
3. Start dates, completion dates, and current progress
4. Date and amount of financial incentives provided for completion of life map goals Mini grant 1. Grant amount, term, and recipient
2. Activities planned with grant
3. Number of people served through grant
Non-program
service delivery
1. Name and date of birth*
2. Basic demographic information (age, gender, race)
3. Date of service provided
4. Type of service provided (e.g. housing, legal services)
5. Length of service, if applicable (e.g. length of stay in temporary housing) Outreach 1. Name and contact information
2. Basic demographic information (age, gender, race)
3. Date, method, and outcome of all outreach attempts
4. Referral source
Program
enrollment &
exit
1. Date and source of referral
2. Dates of enrollment and exit
3. Type of program
4. Reason for exit
Program intake
and needs
assessment
1. Date of intake and needs assessment
2. Other questions will be specific to strategy or service provider Program service
delivery
1. Date, duration, method, and outcome of communication with client by service provider
2. Date and amount of financial incentives provided to client
3. Assigned staff member's name
Referral to
services
1. Name and date of birth*
2. Date of referral
3. Type of service referral
Form Data fields
4. Name of organization referred to
5. Status of referral (e.g. sent, received, accepted, denied) Relocation 1. Names of individuals being relocated
2. Yes/No: Was safety assessment conducted?
3. Date and types of relocation support provided
4. Date and result of request for relocation support/funding Triangle
incident
response
1. Date and time of notification
2. Date and time of scene or hospital response
3. Assessment: Victim name and demographics, category of incident, homicide (yes/no), level of retaliation
4. Notes on follow-up: relocation, mediation, peer outreach, family outreach, school outreach, community outreach
Violence
mediation
1. Date and time of mediation conversations
2. Names of individuals involved in conversations
3. Type of mediation: proactive vs. retaliation
4. Other people notified of conflict (e.g. family members, school administrators) *These fields are applicable for activities that require entry of personally-identifiable information.
For each strategy and activity, Tables 5-7 identify whether CBOs will be expected to enter individual- level client records and personally-identifiable information (PII). For this use policy, PII refers to any data that could potentially identify a specific individual, such as an individual’s full name and date of birth. In situations where individual client records are required but PII is not, agencies will be able to leave the first and last name fields blank. Tables 5-7 also identify whether select DVP staff (described under Data Access) will be able to view individual-level client records and PII for purposes of data quality assurance, process evaluation, and service coordination.
Table 5. Entry and visibility of individual-level client records and PII for the DVP’s group and gun violence strategy.
Substrategy Activity Are individual
client records
entered?
Is PII entered? Are individual
records and
PII entered by
CBOs visible
to DVP staff?
Employment &
Education Support
Services
Adult employment & education services Yes Yes Yes
Youth job exploration & education
services
Yes Yes Yes
School Site
Violence
Intervention &
Prevention Teams
Community healing No No No
Gender-based violence: Individual-level
services
Yes Provider
choice
No
Gender-based violence: Group services No No No
Violence interruption Yes Yes Yes
Youth life coaching Yes Yes Yes
Violent incident
crisis response
Emergency relocation Yes Yes Yes
Family support following homicide Yes Yes Yes
Hospital intervention Yes Yes Yes
Violence interruption Yes Yes Yes
Youth Diversion
and Youth & Adult
Life Coaching
Adult life coaching Yes Yes Yes
Housing-focused case management Yes Yes Yes
Youth diversion: Individual-level services Yes Yes Yes
Substrategy Activity Are individual
client records
entered?
Is PII entered? Are individual
records and
PII entered by
CBOs visible
to DVP staff?
Youth diversion: Group-level services No No No
Youth life coaching Yes Yes Yes
Table 6. Entry and visibility of individual-level client records and PII for the DVP’s gender-based violence strategy.
Substrategy Activity Are individual
client records
entered?
Is PII entered? Are individual
records and PII
entered by
CBOs visible to
DVP staff?
Crisis response Bedside advocacy and
accompaniment
Yes Provider choice No
24-hour hotlines Provider choice Provider choice No
Housing Emergency shelter: Hotel
vouchers
Provider choice Provider choice No
Emergency shelter: Relocation Yes Provider choice No
Transitional housing Yes Provider choice No
Wrap-Around
Services
Employment support: Individual
services
Yes Provider choice No
Employment support: Group
services
No No No
Legal advocacy: Advice and
referral
Provider choice Provider choice No
Legal advocacy: Case
management
Yes Provider choice No
Life coaching Yes Provider choice No
Safe space alternatives Provider choice Provider choice No Therapeutic support: Individual
services
Yes Provider choice No
Therapeutic support: Group
services
No No No
Table 7. Entry and visibility of individual-level client records and PII for the DVP’s community healing strategy.
Substrategy Are individual
client records
entered?
Is PII entered? Are individual
records and PII
entered by
CBOs visible to
DVP staff?
Restorative services No No No
Mini grants No No No
Neighborhood and community teams Yes Yes No
Therapeutic supports: Individual-level services Yes Yes No Therapeutic supports: Group-level services No No No
Town Nights No No No
For activities that collect PII, regardless of visibility to DVP staff, CBOs will be encouraged to notify clients that their name and date of birth will be documented in Apricot 360 for purposes of effective service delivery and coordination. Clients will also be asked to sign a consent form regarding potential access to their PII by a third-party evaluator. Completion of this consent form is strongly encouraged but is not a requirement of service delivery for any strategy, and clients will be able to decline having their PII accessed by a third-party evaluator if they wish.
D. Data Access
The DVP will take special care to ensure that data within Apricot 360 are accessed on a need-to-know and right-to-know basis, meaning that staff will only be able to access information that is essential to their job function. Apricot 360 allows administrators to restrict access to individual forms, records, and fields for staff members based on their pre-determined access requirements. An overview of data access levels for categories of staff employed by the DVP and contracted CBOs is provided below:
Contracted CBOs
Direct service staff and supervisors will have access to individual- and group-level service delivery data entered by members of their agency only. Direct service staff and supervisors will NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.
Fiscal and contract staff will have access to contract and fiscal documents such as budgets, scopes of work, invoices, and payments for their agency only. These staff members will also have access to aggregate service delivery data pertaining to contract deliverables, which will be automatically calculated based on data entered by direct service staff. Fiscal and contract staff will not have access to individual client records or PII.
DVP
Direct service staff and supervisors will have access to individual- and group-level service delivery data entered by members of the DVP only. Direct service staff and supervisors within the DVP will NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.
Violent incident crisis response coordination staff will have access to data entered by staff within the DVP and contracted CBOs pertaining to the violence incident crisis response substrategy to ensure timely coordination of support services and violence interruption activities to prevent retaliation. This will include access to names of individuals involved in violent incident crisis response activities and services.
Fiscal and contract staff will have access to contract and fiscal documents such as budgets, scopes of work, invoices, and payments for all grantees. These staff members will also have access to aggregate service delivery data pertaining to contract deliverables, which will be automatically calculated based on data entered by direct service staff. Fiscal and contract staff will not have access to individual client records or PII.
Data and evaluation staff within the DVP will have access to client-level data and PII for DVP clients across all substrategies. For clients engaged by contracted CBOs, DVP data and evaluation staff will also have access to client-level data and PII for activities within the group and gun violence strategy for the purpose of identifying and remediating issues related to service delivery within or across CBOs.
External data and evaluation staff employed by evaluation firms contracted by the City of Oakland will have access to PII for clients who have previously consented to having their PII shared with an external evaluator. For clients who have not consented to having their PII shared, external evaluation firms will only receive access to deidentified or aggregate service delivery data. All data shared with external evaluators will be downloaded from Apricot 360 by Bonterra technical support staff and shared via a secure file transfer method.
Unauthorized use of the system by any staff person with any level of access will lead to disciplinary action, which could include the termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.
E. Data Protection
Apricot 360 has comprehensive measures in place to maintain data privacy and security. The system sits behind a firewall that extensively controls, tracks, and reports access to the system’s internal infrastructure. Apricot 360 meets current U.S. Department of Housing and Urban Development (HUD) domestic violence standards, Homeless Management Information System (HMIS) standards, and Social Security Administration data management and security protocols, as well as minimum required Family Educational Rights and Privacy Act (FERPA) and HIPAA standards. Data entered into Apricot 360 are automatically encrypted while in transit between a user’s computer and the system’s servers, as well as while at rest. Additionally, users accessing Apricot 360 servers do so via a secure HTTPS connection.
More information on privacy and security for the Apricot 360 system is included in Attachment A.
F. Data Retention
Agencies that collect PII for clients based on their funded activities will be required to retain the PII for three years following service completion to ensure that data are available for evaluations conducted by external evaluators, which can last for up to three years following service delivery. At the end of three years, agencies will delete PII unless exempted based on legal requirements. Anonymous service delivery data will be retained for an additional four years to allow the DVP to monitor trends in service delivery over time. At the conclusion of seven years, individual-level data will be permanently deleted from Apricot 360 unless exempted due to legal requirements.
G. Public Access
There will be absolutely no public access to individual-level client data in Apricot 360. As with any government record, a member of the public may submit a Public Records Act request, but only aggregate data (no PII) would be released subject to applicable federal, state, and local privacy or confidentiality laws. If the DVP receives a request of this nature, staff will work with the City Attorney’s Office to respond to the request without sharing PII. The DVP will also notify any contracted CBOs impacted by the data request as soon as reasonably possible. To date, the City of Oakland has only
received requests through the Public Records Act for aggregate-level data pertaining to its violence prevention and intervention services (e.g. how many participants were served in a year).
Aggregate data from Apricot 360 will be available in evaluation reports published by third-party evaluation firms and may be shared through public tables, charts, or dashboards created by the DVP.
H. Third Party Data Sharing
Outside of the DVP, DVP-funded CBOs, and evaluation firms contracted by the City of Oakland, no other agency will have access to data collected in Apricot 360. External evaluators contracted by the City of Oakland will use data in Apricot 360 to evaluate the effectiveness of funded programs. External evaluators will only have access to PII for individuals who sign a consent form allowing their PII to be shared with a third-party evaluator. For clients who do not sign a consent form allowing access to their PII, external evaluators will receive deidentified or aggregate data.
I. Training
The DVP’s data and evaluation staff will attend Apricot 360 train-the-trainer and custom end user training sessions, which will review Apricot 360’s configuration and tips and tricks for training end users.
In addition, DVP staff will have access to the Apricot basic training package, which includes unlimited access to the following:
Live Apricot setup webinar
Live Apricot insights webinar
Administrative video library
End user training library
Using these tools, the DVP’s data and evaluation staff will train direct service staff, supervisors, and contract and fiscal staff within the DVP and contracted CBOs on how to use Apricot 360. This will include general trainings, trainings specific to substrategies and activities, and ongoing options for one-on-one training, support, and technical assistance. All trainings will specify appropriate usage of the system pertaining to data privacy and security as outlined in this use policy, and all trained staff members will sign a copy of the use policy indicating that they have read and understand it. Trainings will also discuss consequences of inappropriate system usage, which could include termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.
Additionally, all staff within the DVP who have access to client-level data and PII entered into Apricot 360 by contracted CBOs will maintain current certifications in HIPAA and Collaborative Institutional Training Initiative (CITI) research, ethics, and compliance training.
J. Auditing and Oversight
The DVP’s data and evaluation staff will monitor compliance with this use policy of staff within the DVP and contracted CBOs. All actions in the system (add, edit, delete, view, etc.) are accessible through audit log reports built into the system for administrator monitoring. On a quarterly basis, the DVP’s data and evaluation staff will receive these logs from Apricot 360 administrators and review them for any signs of inappropriate system usage. Any indication of inappropriate system usage will be thoroughly investigated by the DVP in consultation with the City Attorney’s Office. Inappropriate system usage
could result in termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.
K. Maintenance
Bonterra’s security mechanisms and procedures are built on the Soc2 Type II Framework with HIPAA amendment and audited by third-party security experts annually to ensure compliance with best-in- class technical safeguards, processes, policies, and procedures. Bonterra has an extensive cloud security team led by their Chief Information Security Officer that uses a broad set of tools for monitoring security, vulnerability, integrity, and uptime across over 19,000 customers. A complete copy of Bonterra.’s Soc2 Type II has been shared with City of Oakland staff who have signed a non-disclosure agreement, including data and evaluation staff from the DVP and staff from the Information Technology Department.
Attachment
July 8, 2022
RE: In support of the Oakland Department of Violence Prevention transition to Apricot Data Management System
Dear Oakland Privacy Advisory Commission:
I am pleased to support the Oakland Department of Violence Prevention (DVP) as it transitions from CitySpan to the Apricot data management system.
I am the Executive Director of the National Institute for Criminal Justice Reform (NICJR), and in previous positions I have known and worked with CitySpan since Oakland first began using the system nearly 20 years ago. I have also worked with Oakland Unite and now DVP on the city's gun violence reduction strategies for the past 10 years, including as Interim Executive Director of Community and Youth Outreach. (CYO)
CitySpan is an outdated system that is inefficient and challenging to navigate, especially for front line workers. The City desperately needs a new system. The Apricot data management system is both user friendly and complex enough to provide the type of management reports needed from the database.
NICJR works with an array of organizations, including government agencies, nonprofit organizations, and philanthropic foundations and operates the National Office of Violence Prevention Network. Many of the jurisdictions and agencies we work with are also transitioning to the Apricot system.
In addition to a new data management system, DVP needs to continue to collect client-level data, as it currently does with the vast majority of its contracted community-based organizations. There are many reasons to collect client level data, one of them being to ensure that there aren’t duplicative efforts from different community-based organizations serving the same client or families, as well as for much needed evaluation purposes.
Thank you for your consideration and feel free to reach out with any questions.
Sincerely,
David Muhammad
David Muhammad
Executive Director
www.nicjr.org