FY?;V.-c*
r iltD
OFFICE OF THE CITY CURf
OAKLAND APPROVED AS TO FORM AND LEGALITY
22 JUL 23 PM 2: 38
CITY ATTORNEY’S OFFICE
AS AMENDED BY CITY COUNCIL ON JULY 26, 2022
OAKLAND CITY COUNCIL
89 3 80
RESOLUTION NO. C.M.S.
RESOLUTION: (1) AUTHORIZING THE CITY ADMINISTRATOR TO
WAIVE THE LOCAL AND SMALL LOCAL BUSINESS ENTERPRISE
PROGRAM (L/SLBE) AND THE COMPETITIVE BIDDING PROCESS
AND TO AWARD A FIVE-YEAR CONTRACT, FROM AUGUST 1, 2022
TO JUNE 30, 2027, TO SOCIAL SOLUTIONS GLOBAL, INC. FOR THE DEVELOPMENT OF AN APRICOT 360 DATA MANAGEMENT SYSTEM
AND FOR ANNUAL LICENSING AND TECHNICAL ASSISTANCE FEES
FOR A TOTAL AMOUNT NOT TO EXCEED FIVE HUNDRED THIRTY-
THREE THOUSAND FIFTY-SIX DOLLARS ($533,056); AND (2)
ADOPTING ONE OF-THE TWO ALTERNATIVE SURVEILLANCE USE
POLICILY ATTACHED HERETO AS EXHIBITS A AND B PERTAINING TO THE APRICOT 360 DATA MANAGEMENT SYSTEM
WHEREAS, the City of Oakland’s Department of Violence Prevention (DVP) has a mandate to reduce levels of gun violence, intimate partner violence, commercial sexual exploitation, family trauma associated with unsolved homicides, and community trauma associated with ongoing violence in Oakland; and
WHEREAS, the DVP contracts annually with community-based organizations (CBOs) to deliver violence prevention and intervention services using funding from the 2014 Oakland Public Safety and Services Violence Prevention Act (Measure Z) and General Purpose Fund; and WHEREAS, the DVP issued a competitive request for qualifications (RFQ) on December 10, 2021, for violence prevention and intervention services in the strategies of group and gun violence response, gender-based violence response, and community healing and restoration (RFQ #267700); and
WHEREAS, the DVP requires a data management system that is able to record and report on service delivery and contracting data for all CBOs funded through RFQ #267700 and future RFQs issued to fund violence prevention and intervention services through the DVP, as well as service-delivery activities performed by DVP direct service staff, in order to adequately monitor and evaluate DVP-funded programs and services; and
WHEREAS, the DVP requires a data management system that meets its required specifications to be operational by July 1, 2022, or as soon thereafter as possible, for the start of the Fiscal Year (FY) 2022-23 program contracts; and
WHEREAS, the City Council finds that the City lacks the equipment and qualified personnel to perform the necessary work and that the performance of this contract is in the public interest because of economy or better performance; and
WHEREAS, the City Administrator has determined that the service to be provided is professional, scientific, or technical; and
WHEREAS, the City Administrator has determined that the performance of this contract shall not result in the loss of employment or salary by any person having permanent status in the competitive services; and
WHEREAS, the DVP requested an availability analysis from the Department of Workforce and Employment Standards (DWES) of the City’s database of local firms because the DVP had reason to believe that the availability of certified firms would not be sufficient to satisfy the minimum participation requirement for the City’s L/SLBE Program; and WHEREAS, the DWES researched the certification database using the NAICS code of “518210 - Data Processing, Hosting, and Related Services” and identified four (4) certified firms, but the identified firms did not respond to emails from the DWES inquiring about whether the firms could perform the requested services; and
WHEREAS, the DWES determined that based on the lack of response from the four (4) certified firms, the L/SLBE Program’s 50% requirement should be waived for this contract; and WHEREAS, the DVP solicited proposals from Salesforce.com, Inc., Microsoft Corporation, and Social Solutions Global, Inc. to customize a data management system for the DVP and provide 150 licenses and technical assistance for five years, and Social Solutions Global, Inc. submitted the most appropriate service proposal; and WHEREAS, Social Solutions Global, Inc. currently provides data management services to similar social service agencies, including the Oakland Unified School District, the City of Stockton’s Office of Violence Prevention, the Los Angeles Mayor's Office of Gang Reduction and Youth Development (GRYD), and seven CBOs currently funded by the DVP; and WHEREAS, the DVP desires to contract with Social Solutions Global, Inc. to customize a web-based data management system and obtain licenses and ongoing technical assistance for five years through the Apricot 360 platform for an amount not to exceed Five Hundred Thirty- Three Thousand Fifty-Six Dollars ($533,056), which includes Eighty-One Thousand Dollars ($81,000) for initial system development and an average of Ninety Thousand Four Hundred Eleven Dollars ($90,411) for licensing and technical support fees each year; and WHEREAS, the DVP recommends that the City Council make a finding and a determination that it is in the best interests of the City to waive the advertising and competitive
bidding requirements for this contract given that the new data management system must be fully developed and operational by July 2022, or as soon thereafter as possible, when FY 22-23 program contracts begin in order for program activities to be adequately monitored and evaluated; and
WHEREAS, Oakland Municipal Code (OMC) Section 2.04.042(D) authorizes the City Council to waive the advertising and competitive bidding requirements of OMC Section
2.04.042 after finding and determining that it is in the best interests of the City to do so; and WHEREAS, the DVP developed a Surveillance Use Policy and a Surveillance Impact Report regarding the Apricot 360 data management system that were submitted to the Privacy Advisory Commission (PAC) for review; and
WHEREAS, the DVP attended PAC regular meetings on May 5 and June 2, 2022, and a special PAC meeting on May 18, 2022, during which the PAC considered and discussed the Apricot 360 Surveillance Impact Report and Surveillance Use Policy; and WHEREAS, based on feedback received from the PAC, the D VP developed two different Surveillance Use Policies for consideration by the PAC at its regular meeting on July 7, 2022;and
WHEREAS, the PAC took a vote at a special meeting on July 12, 2022, to approve Version A of the Apricot 360 Use Policy (Exhibit A) provided that personallv-identifiable information fPII) in the Apricot 360 Use Policy be defined accordingly: “Personally identifiable information (PII) is any data that could potentially identify a specific individual. Any information that can be used to distinguish one person from another and can be used to deanonymize previously anonymous data is considered PH.”; and WHEREAS, the PAC’s approval of Version A of the Apricot 360 Use Policy (Exhibit A) was also conditional on the consent form that is administered to all clients enrolling in individual-level services funded through the DVP being amended to include the following: ('l l the definition of PII from the Apricot 360 Use Policy with several illustrative examples, f2) information regarding the risks associated with a data breach, subpoena, or public records act request included in Version A of the Apricot 360 Impact Report that was submitted to the PAC for its meeting on July 7, 2022. and f3J the ability for clients to separately consent to their data being shared with the DVP and external evaluation partners; and WHEREAS, the PAC’s approval of Version A of the Apricot 360 Use Policy (Exhibit A) was also conditional on language within the professional services agreement between the City of Oakland and Social Solutions Global, Inc, pertaining to data ownership and City obligations under Section 4.4 remaining consistent with the contract draft submitted to the PAC for review on July 7, 2022; now, therefore, be it
RESOLVED: That the City Council finds and determines that pursuant to OMC Section
2.04.042(D) and based upon the reasons stated above and in the City Administrator's report accompanying this resolution, it is in the best interest of the City to waive the advertising and competitive bidding requirements of the OMC and the Local and Small Local Business Enterprise Program (L/SLBE) requirements and award a contract to Social Solutions Global, Inc.
for five years in an amount not to exceed Five Hundred Thirty-Three Thousand Fifty-Six Dollars ($533,056) for the development of a new data management system and annual licensing and technical assistance fees; and be it
FURTHER RESOLVED: That, pursuant to Oakland Municipal Code section
9.64.030(2)(B) and based upon the reasons stated in the City Administrator’s Supplemental Report, the City Council finds and determines that the benefits to the community of DVP’s use of the Apricot 360 data management system outweigh the costs, that the selected Surveillance Use Policy will safeguard civil liberties and civil rights, and that no alternative with a lesser economic cost or impact on civil rights or civil liberties would be as effective; and be it FURTHER RESOLVED: That the City Council hereby adopts the Surveillance Use Policy attached hereto as Exhibit A pertaining to the Apricot 360 data management system along with the PAC recommended revised contract, consent form, and definition of PII as further described in the preceding Whereas clauses; and be it
FURTHER RESOLVED: That the City Administrator is hereby authorized to complete all required negotiations, certifications, assurances, agreements, and documentation required to carry out the basic purpose of this resolution; and be it FURTHER RESOLVED: That prior to execution, all agreements shall be reviewed and approved as to form and legality by the Office of the City Attorney and placed on file in the Office of the City Clerk.
IN COUNCIL, OAKLAND, CALIFORNIA,
JUL 26 20U
FIFE, GALLO, KALB, KAPLAN,THAO AND - (n
PRESIDENT FORTUNATO BAS
PASSED BY THE FOLLOWING VOTE:
AYES -
-0
NOES
ABSENT -
ABSTENTION -
~ \
/f
z>(X ~ \ ; .--ATTEST:
SHA REED
City /Cler-k and Clerk of the Council of the
V-City of Oakland, California
3196270v1
Apricot 360 Use Policy - VERSION A
City of Oakland Department of Violence Prevention
The Department of Violence Prevention (DVP) formed in 2020 with a mandate to reduce levels of gun violence, intimate partner violence, commercial sexual exploitation, family trauma associated with unsolved homicides, and community trauma associated with ongoing violence in Oakland. The DVP applies a public health approach to violence prevention and intervention efforts that focuses resources on people, neighborhoods, and times of day that are most likely to be impacted by violence. The department also applies different prevention and intervention strategies based on whether individuals are exposed to violence, at risk for violence, or at the center of violence. Each fiscal year, the DVP distributes millions of dollars in funding to community-based organizations (CBOs) in Oakland that deliver prevention and intervention services in the areas of group and gun violence, gender-based violence, and community healing. The DVP also provides direct services in the areas of adult life coaching, violence interruption, and shooting and homicide response.
A. Purpose
The Apricot 360 data management system (Apricot 360), developed by Bonterra (formerly Social Solutions Global, Inc.), will enable the DVP and its contracted CBOs to track information related to service delivery and contract management in the DVP's three strategy areas of group and gun violence, gender-based violence, and community healing. Apricot 360 will be used by direct service staff within the DVP and CBOs to track client enrollment, service engagement, milestones, and outcomes for individual services as well as attendance, duration, and content of group services. Supervisory staff within the DVP and CBOs will use the system to ensure that direct service staff are engaging clients with the expected frequency and delivering services appropriately to facilitate behavior change. The DVP's data and evaluation staff will use Apricot 360 to monitor service delivery and outcome data across each strategy, oversee the activities and deliverables of individual CBOs to ensure alignment with scopes of work and service models, and identify challenges with service delivery that require remediation. Fiscal and contract staff within the DVP and CBOs will use the system to store contract documents, communicate about contract questions, track budget spenddown, and process invoices based on completion of deliverables. Finally, service delivery and outcome data collected through Apricot 360 will be available to external evaluators contracted by the City of Oakland to conduct an evaluation of DVP programs and services.
B. Authorized Use
Data stored in Apricot 360 will be accessed on a need-to-know and right-to-know basis, meaning that DVP and CBO staff members will only have to access information that is essential to their job function.
Categories of Apricot 360 system usage are described below. • Service delivery: Direct service and supervision staff employed by the DVP and contracted CBOs will use Apricot 360 to track information on client enrollment, contacts, progress towards milestones, accomplishments, referrals, and other aspects of service delivery. The system will identify upcoming staff member tasks related to service delivery and present summarized data on clients served though dashboards that are helpful to staff. Direct service staff include
individuals such as case managers and life coaches who work directly with clients to deliver services or programming. Supervision staff are supervisors of direct service staff. • Violent incident crisis response coordination: Violence interrupters employed through the DVP and contracted CBOs will receive information about shootings and homicides through Apricot 360 and enter information pertaining to their response. Select staff members within the DVP who coordinate the 24/7 response to shootings and homicides will review data entered by contracted CBOs pertaining to shooting and homicide response activities to ensure that victims and family members receive timely, comprehensive, and coordinated support services. These staff members will also use Apricot 360 to monitor and coordinate violence interruption activities to prevent retaliation.
• Program monitoring and accountability: DVP data and evaluation staff will use aggregate service delivery data to monitor trends in service delivery within activities and substrategies and ensure that summarized service delivery data are available to a range of external stakeholders, including councilmembers, committee members, grantors, and the public. DVP data and evaluation staff will also review individual-level client data within the group and gun violence strategy 10 determine how many clients are enrolled in muitipie services, ensure that clients are not simultaneously enrolled in the same service through different providers, and ensure that services delivered to individual clients meet DVP expectations in terms of quality, frequency, duration, and reach.
• Contract management: Fiscal and contract staff employed by the DVP and contracted CBOs will use the system to manage grant budgets, monitor contract deliverables, process budget modifications and payments, and communicate about contracts. • External evaluation: External evaluators contracted by the City of Oakland will use data from Apricot 360 to evaluate the effectiveness of services delivered by the DVP and contracted CBOs.
Evaluators will seek and receive institutional review board (IRB) approval prior to commencing research activities. Once IRB approval is obtained, evaluators will only have access to personally- identifiable information for individuals who have signed a consent form agreeing to have their identifiable data shared with a third-party evaluator. For clients who do not sign a consent form, evaluators will receive deidentified or aggregate data.
C. Data Collection
Service delivery data will be entered into Apricot 360 by direct service staff employed by the DVP and contracted CBOs. For each activity funded through the DVP's three strategies, Tables 1-3 identify which data entry forms will be completed. Table 4 provides an overview of the types of data collected through each form.
Table 1. Data entry forms completed in Apricot 360 for the DVP's group and gun violence strategy.
Employment &
Education
Support
Services
Adult employment &
education services
x x x x x
Youth job exploration &
education services
x x x x x
School Site
Violence
Intervention &
Prevention
Teams
Community healing x
Gender-based violence:
Individual-level services
x x
Gender-based violence:
Group services
Violence interruption
x
x x
Youth life coaching x x x x x x
Violent
incident crisis
response
Emergency relocation x
Family support
following homicide
x x
Hospital intervention x x
Violence interruption x x x
Youth
Diversion and
Youth & Adult
Life Coaching
Adult life coaching x x x x x x
Housing-focused case
management_______
x x x x
Youth diversion:
Individual-level services
x x
Youth diversion: Group-
level services
x
Youth life coaching x x x x x x
Table 2. Data entry forms completed in Apricot 360 for the DVP's gender-based violence strategy.
Crisis response Bedside advocacy and
accompaniment____
x x
24-hour hotlines x
Housing Emergency shelter:
Hotel vouchers
x
Emergency shelter:
Relocation
x
Transitional housing x x
Wrap-Around
Services
Employment support:
Individual services
x x x
Employment support:
Group services_____
x
Legal advocacy:
Advice and referral
X x
Legal advocacy: Case
management
x x x
Life coaching x x x x x x
Safe space
alternatives
x x X
Therapeutic support:
Individual services
x x x
Therapeutic support:
Group services
X
Table 3. Data entry forms completed in Apricot 360 for the DVP's community healing strategy.
Restorative services x
Mini grants x
Neighborhood and community teams x x
Therapeutic supports: Individual-level services x x x
Therapeutic supports: Group-level services x
Town Nights x
Table 4. Types of data collected through Apricot 360 forms.
1. Name and date of birth*
2. Contact information*
3. Demographic information (race, gender, education, language spoken at home)
4. Employment status
5. Housing status
6. School information, if applicable
Client record
7. Names and contact information of important people, if client chooses to provide (e.g. probation officer)_________________________________________________________
1. Date of visit
2. Basic demographics (age, gender, race)
Drop-in center
Family support 1. Name of homicide victim
2. Number of individuals in family
3. Types and amount of support provided (e.g. relocation, funeral/vigil planning, VOC applications, financial)
4. Attendance at funerals/vigils___________________________________________ GBV crisis line 1. Time and date of call
2. Yes/No: Did call relate to GBV?
3. Basic demographic information (age, race, gender)
Group activity 1. Date, location, and duration of activity
2. Number and type (e.g. students, residents, teachers) of people in attendance
3. Type of activity (e.g. training, support group)
Mobile/bedside
advocacy
1. Date and time of contact
2. Basic demographic information (age, gender, race)
3. Yes/No: Was safety plan developed?
1. Date and time of initial notificationFlospital
response 2. Date and time of visits for service
3. Name and date of birth of individual visited
4. Type of support provided (e.g. VOC applications, relocation funding) Life map goals
and activities
1. Case plan goals
2. Planned and accomplished actions associated with goals
3. Start dates, completion dates, and current progress
4. Date and amount of financial incentives provided for completion of life map goals Mini grant 1. Grant amount, term, and recipient
2. Activities planned with grant
3. Number of people served through grant
1. Name and date of birth*Non-program
service delivery 2. Basic demographic information (age, gender, race)
3. Date of service provided
4. Type of service provided (e.g. housing, legal services)
5. Length of service, if applicable (e.g. length of stay in temporary housing) Outreach 1. Name and contact information
2. Basic demographic information (age, gender, race)
3. Date, method, and outcome of all outreach attempts
4. Referral source
1. Date and source of referral
2. Dates of enrollment and exit
3. Type of program
4. Reason for exit
Program
enrollment &
exit
1. Date of intake and needs assessment
2. Other questions will be specific to strategy or service provider Program intake
and needs
assessment
1. Date, duration, method, and outcome of communication with client by service provider
2. Date and amount of financial incentives provided to client
3. Assigned staff member's name______________________________________________ Program service
delivery
1. Name and date of birth*Referral to
services 2. Date of referral
3. Type of service referral
4. Name of organization referred to
5. Status of referral (e.g. sent, received, accepted, denied) Relocation 1. Names of individuals being relocated
2. Yes/No: Was safety assessment conducted?
3. Date and types of relocation support provided
4. Date and result of request for relocation support/funding
1. Date and time of notification
2. Date and time of scene or hospital response
3. Assessment: Victim name and demographics, category of incident, homicide (yes/no), level of retaliation
4. Notes on follow-up: relocation, mediation, peer outreach, family outreach, school outreach, community outreach___________________________________________________________ Triangle
incident
response
Violence
mediation
1. Date and time of mediation conversations
2. Names of individuals involved in conversations
3. Type of mediation: proactive vs. retaliation
4. Other people notified of conflict (e.g. family members, school administrators) ‘These fields are applicable for activities that require entry of personally-identifiable information.
For each strategy and activity, Tables 5-7 identify whether CBOs will be expected to enter individual- level client records and personally-identifiable information (Pll). Pll is any data that could potentially identify a specific individual. Any information that can be used to distinguish one person from another and can be used to deanonymize previously anonymous data is considered Pll. In situations where individual client records are required but Pll is not, agencies will be able to leave the first and last name fields blank.
Tables 5-7 also identify whether select DVP staff (described under Data Access) will be able to view individual-level client records and Pll for purposes of data quality assurance, process evaluation, and service coordination For minor clients whose parent/guardian do not consent to share information with the DVP, CBOs will have the option of using unique identifiers in lieu of Pll, Unique identifiers are numeric codes that link to a key with client names and dates of birth by CBOs outside the Apricot 360 database. Evaluation of CBOs in the DVP network will not be contingent on the rate of consent. If a CBO has a consent rate that is less than 80%, the DVP will work with the CBO to explore options for increasing rates. As is current policy, CBOs are required to submit ancillary data during an onsite program monitoring visit to ensure that the service delivery and outcomes, for which DVP has contracted, are accurately reflected and are being achieved.
Table 5. Entry and visibility of individual-level client records and Pll for the DVP's group and gun violence strategy.
Employment &
Education Support
Services
Adult employment & education services Yes Yes Yes
Youth job exploration & education
services
Yes Yes Yes
Community healing No No No
School Site
Violence
Intervention &
Prevention Teams
Gender-based violence: Individual-level
services
Yes Provider
choice
No
Gender-based violence: Group services No No No
Violence interruption Yes Yes Yes
Youth life coaching Yes Yes Yes
Violent incident
crisis response
Emergency relocation Yes Yes Yes
Family support following homicide Yes Yes Yes
Hospital intervention Yes Yes Yes
Violence interruption Yes Yes Yes
Youth Diversion
and Youth & Adult
Life Coaching
Adult life coaching Yes Yes Yes
Housing-focused case management Yes Yes Yes
Youth diversion: Individual-level services Yes Yes Yes
Youth diversion: Group-level services No No No
Youth life coaching Yes Yes Yes
Table 6. Entry and visibility of individual-level client records and Pll for the DVP's gender-based violence strategy.
Crisis response Bedside advocacy and
accompaniment
Yes Provider choice No
24-hour hotlines Provider choice Provider choice No
Housing Emergency shelter: Hotel
vouchers
Provider choice Provider choice No
Emergency shelter: Relocation Yes Provider choice No
Transitional housing Yes Provider choice No
Wrap-Around
Services
Employment support: Individual
services
Yes Provider choice No
Employment support: Group
services
No No No
Legal advocacy: Advice and
referral
Provider choice Provider choice No
Legal advocacy: Case
management
Yes Provider choice No
Life coaching Yes Provider choice No
Safe space alternatives Provider choice Provider choice No Therapeutic support: Individual
services
Yes Provider choice No
Therapeutic support: Group
services
No No No
Table 7. Entry and visibility of individual-level client records and Pll for the DVP's community healing strategy.
Restorative services No No No
Mini grants No No No
Neighborhood and community teams Yes Yes No
Therapeutic supports: Individual-level services Yes Yes No Therapeutic supports: Group-level services No No No
Town Nights No No No
For activities that collect Pll, regardless of visibility to DVP staff, CBOs will be encouraged to notify clients that their name and date of birth will be documented in Apricot 360 for purposes of effective service delivery and coordination. Clients will also be asked to sign a consent form regarding potential access to their Pll by a third-party evaluator. Completion of this consent form is strongly encouraged but is not a requirement of service delivery for any strategy, and clients will be able to decline having their Pll accessed by a third-party evaluator if they wish.
D. Data Access
The DVP will take special care to ensure that data within Apricot 360 are accessed on a need-to-know and right-to-know basis, meaning that staff will only be able to access information that is essential to their job function. Apricot 360 allows administrators to restrict access to individual forms, records, and fields for staff members based on their pre-determined access requirements. An overview of data access levels for categories of staff employed by the DVP and contracted CBOs is provided below:
Contracted CBOs
Direct service staff and supervisors will have access to individual- and group-level service delivery data entered by members of their agency only. Direct service staff and supervisors will NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.
Fiscal and contract staff will have access to contract and fiscal documents such as budgets, scopes of work, invoices, and payments for their agency only. These staff members will also have access to aggregate service delivery data pertaining to contract deliverables, which will be automatically calculated based on data entered by direct service staff. Fiscal and contract staff will not have access to individual client records or Pll.
DVP
Direct service staff and supervisors will have access to individual- and group-level service delivery data entered by members of the DVP only. Direct service staff and supervisors within the DVP will NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.
Violent incident crisis response coordination staff will have access to data entered by staff within the DVP and contracted CBOs pertaining to the violence incident crisis response
substrategy to ensure timely coordination of support services and violence interruption activities to prevent retaliation.
■ Fiscal and contract staff will have access to contract and fiscal documents such as budgets, scopes of work, invoices, and payments for all grantees. These staff members will also have access to aggregate service delivery data pertaining to contract deliverables, which will be automatically calculated based on data entered by direct service staff. Fiscal and contract staff will not have access to individual client records or Pll. ■ Data and evaluation staff within the Dl/P will have access to client-level data and Pll for DVP clients across all substrategies. For clients engaged by contracted CBOs, DVP data and evaluation staff will also have access to client-level data and Pll for activities within the group and gun violence strategy for the purpose of identifying and remediating issues related to service delivery within or across CBOs.
■ External data and evaluation staff employed by evaluation firms contracted by the City of Oakland will have access to Pll for clients who have previously consented to having their Pll shared with an external evaluator. For clients who have not consented to having their Pll shared, external evaluation firms will only receive access to deidentified or aggregate service delivery data. All data shared with external evaluators will be downloaded from Apricot 360 by Bonterra technical support staff and shared via a secure file transfer method.
Unauthorized use of the system by any staff person with any level of access will lead to disciplinary action, which could include the termination of a CBO's grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.
E. Data Protection
Apricot 360 has comprehensive measures in place to maintain data privacy and security. The system sits behind a firewall that extensively controls, tracks, and reports access to the system's internal infrastructure. Apricot 360 meets current U.S. Department of Flousing and Urban Development (FIUD) domestic violence standards, Homeless Management Information System (HMIS) standards, and Social Security Administration data management and security protocols, as well as minimum required Family Educational Rights and Privacy Act (FERPA) and HIPAA standards. Data entered into Apricot 360 are automatically encrypted while in transit between a user's computer and the system's servers, as well as while at rest. Additionally, users accessing Apricot 360 servers do so via a secure HTTPS connection.
More information on privacy and security for the Apricot 360 system is included in Attachment A.
F. Data Retention
Agencies that collect Pll for clients based on their funded activities will be required to retain the Pll for three years following service completion to ensure that data are available for evaluations conducted by external evaluators, which can last for up to three years following service delivery. At the end of three years, agencies will delete Pll unless exempted based on legal requirements. Anonymous service delivery data will be retained for an additional four years to allow the DVP to monitor trends in service delivery over time. At the conclusion of seven years, individual-level data will be permanently deleted from Apricot 360 unless exempted due to legal requirements.
G. Public Access
There will be absolutely no public access to individual-level client data in Apricot 360. As with any government record, a member of the public may submit a Public Records Act request, but only aggregate data (no Pll) would be released subject to applicable federal, state, and local privacy or confidentiality laws. If the DVP receives a request of this nature, staff will work with the City Attorney's Office to respond to the request without sharing Pll. The DVP will also notify any contracted CBOs impacted by the data request as soon as reasonably possible. To date, the City of Oakland has only received requests through the Public Records Act for aggregate-level data pertaining to its violence prevention and intervention services (e.g. how many participants were served in a year).
Aggregate data from Apricot 360 will be available in evaluation reports published by third-party evaluation firms and may be shared through public tables, charts, or dashboards created by the DVP.
H. Third Party Data Sharing
Outside of the DVP, DVP-funded CBOs, and evaluation firms contracted by the City of Oakland, no other agency will have access to data collected in Apricot 360. External evaluators contracted by the City of Oakland will use data in Apricot 360 to evaluate the effectiveness of funded pi ograrns. External evaluators will only have access to Pll for individuals who sign a consent form allowing their Pll to be shared with a third-party evaluator. For clients who do not sign a consent form allowing access to their Pll, external evaluators will receive deidentified or aggregate data.
I. Training
The DVP's data and evaluation staff will attend Apricot 360 train-the-trainer and custom end user training sessions, which will review Apricot 360's configuration and tips and tricks for training end users.
In addition, DVP staff will have access to the Apricot basic training package, which includes unlimited access to the following:
■ Live Apricot setup webinar
■ Live Apricot insights webinar
■ Administrative video library
■ End user training library
Using these tools, the DVP's data and evaluation staff will train direct service staff, supervisors, and contract and fiscal staff within the DVP and contracted CBOs on how to use Apricot 360. This will include general trainings, trainings specific to substrategies and activities, and ongoing options for one-on-one training, support, and technical assistance. All trainings will specify appropriate usage of the system pertaining to data privacy and security as outlined in this use policy, and all trained staff members will sign a copy of the use policy indicating that they have read and understand it. Trainings will also discuss consequences of inappropriate system usage, which could include termination of a CBO's grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.
Additionally, all staff within the DVP who have access to client-level data and Pll entered into Apricot 360 by contracted CBOs will maintain current certifications in HIPAA and Collaborative Institutional Training Initiative (CITI) research, ethics, and compliance training.
J. Auditing and Oversight
The DVP's data and evaluation staff will monitor compliance with this use policy of staff within the DVP and contracted CBOs. All actions in the system (add, edit, delete, view, etc.) are accessible through audit log reports built into the system for administrator monitoring. On a quarterly basis, the DVP's data and evaluation staff will receive these logs from Apricot 360 administrators and review them for any signs of inappropriate system usage. Any indication of inappropriate system usage will be thoroughly investigated by the DVP in consultation with the City Attorney's Office. Inappropriate system usage could result in termination of a CBO's grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.
K. Maintenance
Bonterra's security mechanisms and procedures are built on the Soc2 Type II Framework with HIPAA amendment and audited by third-party security experts annually to ensure compliance with best-in class technical safeguards, processes, policies, and procedures. Bonterra has an extensive cloud security team led by their Chief Information Security Officer that uses a broad set of tools for monitoring security, vulnerability, integr ity, and uptime au oss over 19,000 cusLomei s. A complete copy of Bonterra.'s Soc2 Type II has been shared with City of Oakland staff who have signed a non-disclosure agreement, including data and evaluation staff from the DVP and staff from the Information Technology Department.
L. Evaluation
Within one (1) year after the adoption of this Use Policy, DVP shall return to the Privacy Advisory Commission and, subsequently to the City Council, which may include the Public Safety Committee, for an evaluation. Such evaluation shall include, but not be limited to, what data was collected, how it was used, consent rates of contracted CBOs, and any recommended changes such as to data collection for minor clients and future scoring, funding levels, or other actions related to consent rates of contracted CBOs.