Public Safety Committee
September 24, 2024

Public Safety Committee September 24, 2024
AGENDA REPORT TO: Jestin D. Johnson FROM: Holly Joshi City Administrator Chief of Violence Prevention SUBJECT: Apricot 360 Amended Use Policy and Annual Report DATE: August 26, 2024 City Administrator Approval Date: August 26, 2024 RECOMMENDATION Staff Recommends That The City Council Adopt A Resolution Authorizing The City Administrator To Apricot 360 Annual Report And Approve The Amended Use Policy For The Use Of The Apricot 360 Data Management System As Approved By The Privacy Advisory Commission On June 4, 2024. EXECUTIVE SUMMARY The Department of Violence Prevention (DVP) uses a data management system called Apricot 360 to collect information from its staff and funded agencies related to service delivery and grant management. City Council approved a five-year Apricot 360 system in July 2022 (Resolution 89380 C.M.S.). At that time, City Council also accepted was approved by the Privacy Advisory Commission in July 2022. The DVP returned to the Privacy Advisory Commission on June 6, 2024, to present its first annual report and request amendments to the existing use policy, both of which the Privacy Advisory Commission approved. The proposed resolution, if adopted, will accept the 2024 Apricot 360 Annual Report and approve the amended Apricot 360 Use Policy. BACKGROUND / LEGISLATIVE HISTORY The DVP is charged with reducing group violence, intimate partner violence, and commercial sexual exploitation in Oakland. To do this, the DVP invests in immediate crisis response services and near-term interventions that stabilize victims and prevent additional violence, as well as longer-term, intensive support services for individuals caught in cycles of violence. Specifically, the DVP performs three primary functions: 1. Supervise and deploy a team of direct service staff who perform intensive life coaching and violence interruption work with individuals at highest risk of imminent violence.

Jestin Johnson (Sep 12, 2024 17:41 PDT)
Sep 12, 2024
Jestin D, Johnson, City AdministratorSubject: Apricot 360 Amended Use Policy and Annual Report Date: August 26, 2024 Page 2 Public Safety Committee September 24, 2024

2. Fund community organizations to deliver a range of violence intervention and healing services to community members impacted by violence. In Fiscal Year (FY) 2023-2024, the DVP funded 31 community-based organizations (CBOs) through 35 grant agreements to deliver services in the areas of group and gun violence, gender-based violence, and community healing and restoration. 3. Convene and build capacity among community organizations that form the ecosystem of violence intervention services in Oakland to enhance our collective capacity to prevent violence, deliver effective, coordinated services, and create a safer and healthier Oakland. To adequately monitor and evaluate services delivered and funded by the DVP, the DVP requires a data management system that allows staff from the DVP and funded agencies to enter information related to service delivery and grant management. On July 26, 2022, City Council approved a five-year contract with Bonterra, Inc. (formerly known as Social Solutions Global, Inc.) in the amount of $533,056 for the term of August 1, 2022, to June 30, 2027, for the . At that time, City Council also Policy, which was approved by the Privacy Advisory Commission on July 12, 2022 (Resolution 89380 C.M.S.). In June 2023, the City Council approved adding $91,451 with Bonterra, Inc. to fund additional user licenses, for a total contract amount of $624,597 (Resolution 89797 C.M.S.). Since its implementation in January 2023, Apricot 360 has been used by DVP and CBO staff in the following ways: Direct service staff and supervisors from the DVP and funded CBOs use the system to track and monitor enrollment, service engagement, milestones, and outcomes for individual services, as well as attendance, duration, and content of group services. DVP staff who coordinate shooting and homicide response use the system to ensure that individuals receive timely, comprehensive, and coordinated services and follow-up. DVP data and evaluation staff use Apricot 360 to monitor service delivery and outcome data across each strategy and prepare reports about services delivered for a range of external stakeholders. Fiscal and grant staff within the DVP and CBOs use the system to manage grant budgets, monitor grant deliverables, and prepare quarterly invoices. External evaluators use service delivery and outcome data collected through Apricot 360 to evaluate DVP programs and services. establishing ordinance (Ordinance No. 13349 C.M.S.) states that annual reports and recommendations on the use of the surveillance technology must be reviewed and approved by the Privacy Advisory Commission and City Council. The DVP presented its 2024 Apricot 360 Annual Report and amended Apricot 360 Use Policy to the Privacy Advisory Commission on June 6, 2024, and both items received unanimous approval.

Jestin D, Johnson, City AdministratorSubject: Apricot 360 Amended Use Policy and Annual Report Date: August 26, 2024 Page 3 Public Safety Committee September 24, 2024
ANALYSIS AND POLICY ALTERNATIVES This resolution, if adopted, will allow City Council to accept 2024 Apricot 360 Annual Report and amended Apricot 360 Use Policy, as recommended by the Privacy Advisory Commission. It will also enable the DVP to continue using Apricot 360 to support service delivery and grant management activities with appropriate privacy and security safeguards. Annual report findings details the following information regarding usage of Apricot 360 from February 1, 2023, to January 31, 2024: Apricot 360 was used by approximately 20 DVP staff and 180 CBO staff to track service delivery or perform grant management activities. Individual-level data were entered for over 7,000 participants. The DVP shared deidentified data on services delivered and personally identifiable information for participants who provided their consent with two external evaluation partners, Mathematica and Urban Institute, as approved in the use policy. The DVP did not receive any complaints or concerns about Apricot 360 related to its protection of civil rights and civil liberties. DVP data and evaluation staff communicated with numerous grantees to integrate their feedback regarding ways to improve the user-friendliness of the system. The DVP did not receive any public records requests pertaining to Apricot 360. There were no data breaches or unauthorized access to the Apricot 360 system. Use of the Apricot 360 system has been helpful to the DVP in the following ways: The system has allowed DVP staff to easily access and share aggregate data regarding DVP-funded services in City Council reports, grant applications, and public dashboards. The system has allowed DVP staff to coordinate service delivery within the DVP and across funded agencies related to shooting and homicide response. Data collected through Apricot 360 have served as the primary source of data for Prevention Act, as well as evaluations of external grants from the California Board of State Community Corrections, Gilead Foundation, and Office of Juvenile Justice and Delinquency Prevention, to demonstrate the impact of services. Apricot 360 has allowed the DVP to better understand service usage within the Group Violence Strategy. During the annual report period, 76% of clients accessed only one service, 18% of clients accessed two services, and 6% of clients accessed three or more services. Use Policy Amendments The DVP has proposed the following four amendments to the current Apricot 360 Use Policy, all of which were approved by the Privacy Advisory Commission on June 6, 2024: 1. The approved use policy allows DVP staff who coordinate services related to shooting and homicide response to view personally identifiable information (PII) for activities within the group violence strategy. The DVP would like to modify the use policy to state that DVP staff who coordinate services related to the Group Violence Strategy, which includes shooting and homicide response and referrals to adult life coaching, are able to Jestin D, Johnson, City AdministratorSubject: Apricot 360 Amended Use Policy and Annual Report Date: August 26, 2024 Page 4 Public Safety Committee September 24, 2024
view PII for activities within the Group Violence Strategyrenewed prioritization of those most at-risk of group violence, it is important that DVP direct service staff who refer clients to community organizations for life coaching have visibility into whether clients enroll and the extent of their participation in services. 2. The approved use policy includes three tables (Tables 1-3) that present the Apricot 360 refine its internal service delivery and respond to feedback from grantees about system modifications for ease of use, the names of forms and their application to specific activities may change. The DVP would like to remove these tables since they do not provide important information related to the safeguarding of personal information and they have a high likelihood of being outdated following approval of the use policy. 3. The approved use policy includes a table (Table 4) that listed fields of data collected through Apricot forms. As referenced above, this information may change in response to changes in service delivery or feedback from system users. The DVP would like to potential changes in data fields or form names. Additionally, the DVP would like to remove several forms that are no longer used. 4. The approved use policy includes three tables (Tables 5-7) that identify whether individual-level data and PII are entered in Apricot by funded activity. These tables also identify whether individual records and PII entered by CBOs are visible to DVP staff. The DVP would like to amend these tables to remove the column regarding whether PII entered by CBOs are visible to DVP staff because all PII entered in Apricot are visible to the select DVP staff identified in the use policy; PII is not entered for activities that do not permit visibility to DVP staff. Additionally, the DVP would like to add a column to these tables that identifies whether group-level data are entered. Lastly, school violence intervention and prevention (VIP) teams are now a standalone strategy within the DVP rather than being an activity within the group violence strategy. For that reason, the amended use policy includes a new table with this information for the school VIP teams strategy. In the amended use policy, these tables are now Tables 2-5. The Apricot 360 system supports the citywide priority of holistic community safety by allowing the DVP to collect information needed to effectively coordinate and fund critical violence prevention and intervention services. FISCAL IMPACT There is no fiscal impact associated with approving the updated Apricot 360 Use Policy. The for $624,597 over five years. Table 1 provides the cost by fiscal year.

Jestin D, Johnson, City AdministratorSubject: Apricot 360 Amended Use Policy and Annual Report Date: August 26, 2024 Page 5 Public Safety Committee September 24, 2024
Table 1. Bonterra, Inc. contract costs by fiscal year. Fiscal year Description of fees Total proposed amount 2022-2023 System development $71,000 User accounts & training/support $49,014 Contingency $10,000 2023-2024 User accounts & training/support $120,505 2024-2025 User accounts & training/support $120,505 2025-2026 User accounts & training/support $124,150 2026-2027 User accounts & training/support $129,423 Total $624,597 PUBLIC OUTREACH / INTEREST The 2024 Apricot 360 Annual Report and the amended Apricot 360 Use Policy were publicly noticed, presented, and approved at the June 6, 2024, meeting of the Privacy Advisory Commission. COORDINATION In preparation of this report and resolution, the DVP Office and Finance Department. The DVP also sought review and approval of the 2024 Apricot 360 Annual Report and amended Apricot 360 Use Policy from the Privacy Advisory Commission. PAST PERFORMANCE, EVALUATION AND FOLLOW-UP The Apricot 360 system was implemented in January 2023 and currently has 200 users. Thus to better understand how programs are being implemented and who is being served, as detailed under Analysis and Policy Alternatives. Additionally, data collected through Apricot 360 have Safety and Services Violence Prevention Act, as well as evaluations of external grants from the California Board of State Community Corrections, Gilead Foundation, and Office of Juvenile Justice and Delinquency Prevention, to demonstrate the impact of services. SUSTAINABLE OPPORTUNITIES Economic: There are no economic benefits. Environmental: There are no environmental benefits.

Jestin D, Johnson, City AdministratorSubject: Apricot 360 Amended Use Policy and Annual Report Date: August 26, 2024 Page 6 Public Safety Committee September 24, 2024
Race & Equity: Group violence and gender-based violence in Oakland disproportionately impact people of color. Since July 1, 2023, 55% of clients receiving services funded by the DVP related to group violence or gender-based violence have been African American, and 29% have been Latinx. The Apricot 360 system will support enhanced service delivery and coordination for residents impacted by group violence and gender-based violence, leading to greater healing and reduced victimization. It will also allow the DVP to evaluate its services and focus resources on practices that are most effective in reducing racial disparities. ACTION REQUESTED OF THE CITY COUNCIL Staff Recommends That The City Council Adopt A Resolution Authorizing The City Administrator To Accept The Department Of Violence Apricot 360 Annual Report And Approve The Amended Use Policy For The Use Of The Apricot 360 Data Management System As Approved By The Privacy Advisory Commission On June 6, 2024. For questions regarding this report, please contact Dr. Holly Joshi, Chief of Violence Prevention at [email protected] Respectfully submitted, Holly Joshi, Chief of Violence Prevention Department of Violence Prevention Reviewed by: Jenny Linchey, Deputy Chief of Grants, Programs, and Evaluation Department of Violence Prevention Prepared by: Caitlin Grey, Data and Evaluation Planner Department of Violence Prevention Attachments (3): A: Apricot 360 Current Use Policy B: Apricot 360 Proposed Amended Use Policy C: 2024 Apricot 360 Annual Report

Apricot 360 Use Policy
City of Oakland Department of Violence Prevention

The Department of Violence Prevention (DVP) formed in 2020 with a mandate to reduce levels of gun violence, intimate partner violence, commercial sexual exploitation, family trauma associated with unsolved homicides, and community trauma associated with ongoing violence in Oakland. The DVP applies a public health approach to violence prevention and intervention efforts that focuses resources on people, neighborhoods, and times of day that are most likely to be impacted by violence. The department also applies different prevention and intervention strategies based on whether individuals are exposed to violence, at risk for violence, or at the center of violence. Each fiscal year, the DVP distributes millions of dollars in funding to community-based organizations (CBOs) in Oakland that deliver prevention and intervention services in the areas of group and gun violence, gender-based violence, and community healing. The DVP also provides direct services in the areas of adult life coaching, violence interruption, and shooting and homicide response.

A. Purpose

The Apricot 360 data management system (Apricot 360), developed by Bonterra (formerly Social Solutions Global, Inc.), will enable the DVP and its contracted CBOs to track information related to service delivery and contract management in the DVP’s three strategy areas of group and gun violence, gender-based violence, and community healing. Apricot 360 will be used by direct service staff within the DVP and CBOs to track client enrollment, service engagement, milestones, and outcomes for individual services as well as attendance, duration, and content of group services. Supervisory staff within the DVP and CBOs will use the system to ensure that direct service staff are engaging clients with the expected frequency and delivering services appropriately to facilitate behavior change. The DVP’s data and evaluation staff will use Apricot 360 to monitor service delivery and outcome data across each strategy, oversee the activities and deliverables of individual CBOs to ensure alignment with scopes of work and service models, and identify challenges with service delivery that require remediation. Fiscal and contract staff within the DVP and CBOs will use the system to store contract documents, communicate about contract questions, track budget spenddown, and process invoices based on completion of deliverables. Finally, service delivery and outcome data collected through Apricot 360 will be available to external evaluators contracted by the City of Oakland to conduct an evaluation of DVP programs and services.

B. Authorized Use

Data stored in Apricot 360 will be accessed on a need-to-know and right-to-know basis, meaning that DVP and CBO staff members will only have to access information that is essential to their job function.

Categories of Apricot 360 system usage are described below.

• Service delivery: Direct service and supervision staff employed by the DVP and contracted CBOs will use Apricot 360 to track information on client enrollment, contacts, progress towards milestones, accomplishments, referrals, and other aspects of service delivery. The system will identify upcoming staff member tasks related to service delivery and present summarized data on clients served though dashboards that are helpful to staff. Direct service staff include individuals such as case managers and life coaches who work directly with clients to deliver services or programming. Supervision staff are supervisors of direct service staff.

Attachment A

• Violent incident crisis response coordination: Violence interrupters employed through the DVP and contracted CBOs will receive information about shootings and homicides through Apricot 360 and enter information pertaining to their response. Select staff members within the DVP who coordinate the 24/7 response to shootings and homicides will review data entered by contracted CBOs pertaining to shooting and homicide response activities to ensure that victims and family members receive timely, comprehensive, and coordinated support services. These staff members will also use Apricot 360 to monitor and coordinate violence interruption activities to prevent retaliation.

• Program monitoring and accountability: DVP data and evaluation staff will use aggregate service delivery data to monitor trends in service delivery within activities and substrategies and ensure that summarized service delivery data are available to a range of external stakeholders, including councilmembers, committee members, grantors, and the public. DVP data and evaluation staff will also review individual-level client data within the group and gun violence strategy to determine how many clients are enrolled in multiple services, ensure that clients are not simultaneously enrolled in the same service through different providers, and ensure that services delivered to individual clients meet DVP expectations in terms of quality, frequency, duration, and reach.

• Contract management: Fiscal and contract staff employed by the DVP and contracted CBOs will use the system to manage grant budgets, monitor contract deliverables, process budget modifications and payments, and communicate about contracts.

• External evaluation: External evaluators contracted by the City of Oakland will use data from Apricot 360 to evaluate the effectiveness of services delivered by the DVP and contracted CBOs.

Evaluators will seek and receive institutional review board (IRB) approval prior to commencing research activities. Once IRB approval is obtained, evaluators will only have access to personally- identifiable information for individuals who have signed a consent form agreeing to have their identifiable data shared with a third-party evaluator. For clients who do not sign a consent form, evaluators will receive deidentified or aggregate data.

C. Data Collection

Service delivery data will be entered into Apricot 360 by direct service staff employed by the DVP and contracted CBOs. For each activity funded through the DVP’s three strategies, Tables 1-3 identify which data entry forms will be completed. Table 4 provides an overview of the types of data collected through each form.

Table 1. Data entry forms completed in Apricot 360 for the DVP’s group and gun violence strategy.

Substrategy Activity Forms completed in Apricot 360 database Client record
Family support
Group activity
Hospital response
Life map goals and
activities
Non-program
service delivery
Program
enrollment & exit
Program intake &
needs assessment
Program service
delivery
Referral to services
Relocation
Triangle incident
response
Violence mediation
Employment &
Education
Support
Services
Adult employment &
education services
x x x x x
Youth job exploration &
education services
x x x x x
School Site
Violence
Intervention &
Prevention
Teams
Community healing x
Gender-based violence:

Individual-level services
x x
Gender-based violence:

Group services
x
Violence interruption x x
Youth life coaching x x x x x x
Violent
incident crisis
response
Emergency relocation x
Family support
following homicide
x x
Hospital intervention x x
Violence interruption x x x
Youth
Diversion and
Youth & Adult
Life Coaching
Adult life coaching x x x x x x
Housing-focused case
management
x x x x
Youth diversion:

Individual-level services
x x
Youth diversion: Group-
level services
x
Youth life coaching x x x x x x

Table 2. Data entry forms completed in Apricot 360 for the DVP’s gender-based violence strategy.

Substrategy Activity

Forms completed in Apricot 360 database
Client record
Drop-in center
GBV crisis line
Group activity
Life map goals and
activities
Mobile advocacy
Non-program service
delivery
Program enrollment
& exit
Program intake &
needs assessment
Program service
delivery
Referral to services
Relocation
Triangle incident
response
Crisis response Bedside advocacy and
accompaniment
x x
24-hour hotlines x
Housing Emergency shelter:

Hotel vouchers
x

Substrategy Activity

Forms completed in Apricot 360 database
Client record
Drop-in center
GBV crisis line
Group activity
Life map goals and
activities
Mobile advocacy
Non-program service
delivery
Program enrollment
& exit
Program intake &
needs assessment
Program service
delivery
Referral to services
Relocation
Triangle incident
response
Emergency shelter:

Relocation
x
Transitional housing x x
Wrap-Around
Services
Employment support:

Individual services
x x x
Employment support:

Group services
x
Legal advocacy:

Advice and referral
x x
Legal advocacy: Case
management
x x x
Life coaching x x x x x x
Safe space
alternatives
x x x
Therapeutic support:

Individual services
x x x
Therapeutic support:

Group services
x

Table 3. Data entry forms completed in Apricot 360 for the DVP’s community healing strategy.

Substrategy Forms completed in Apricot 360 database
Client
record
Family
support
Group
activity
Mini grant
Outreach
Program
enrollment
& exit
Program
service
delivery
Referral to
services
Restorative services x
Mini grants x
Neighborhood and community teams x x
Therapeutic supports: Individual-level services x x x Therapeutic supports: Group-level services x
Town Nights x

Table 4. Types of data collected through Apricot 360 forms.

Form Data fields
Client record 1. Name and date of birth*

2. Contact information*

3. Demographic information (race, gender, education, language spoken at home)

4. Employment status

5. Housing status

6. School information, if applicable

Form Data fields

7. Names and contact information of important people, if client chooses to provide (e.g. probation officer)
Drop-in center 1. Date of visit

2. Basic demographics (age, gender, race)
Family support 1. Name of homicide victim

2. Number of individuals in family

3. Types and amount of support provided (e.g. relocation, funeral/vigil planning, VOC applications, financial)

4. Attendance at funerals/vigils
GBV crisis line 1. Time and date of call

2. Yes/No: Did call relate to GBV?

3. Basic demographic information (age, race, gender)
Group activity 1. Date, location, and duration of activity

2. Number and type (e.g. students, residents, teachers) of people in attendance

3. Type of activity (e.g. training, support group)
Mobile/bedside
advocacy

1. Date and time of contact

2. Basic demographic information (age, gender, race)

3. Yes/No: Was safety plan developed?
Hospital
response

1. Date and time of initial notification

2. Date and time of visits for service

3. Name and date of birth of individual visited

4. Type of support provided (e.g. VOC applications, relocation funding) Life map goals
and activities

1. Case plan goals

2. Planned and accomplished actions associated with goals

3. Start dates, completion dates, and current progress

4. Date and amount of financial incentives provided for completion of life map goals Mini grant 1. Grant amount, term, and recipient

2. Activities planned with grant

3. Number of people served through grant
Non-program
service delivery

1. Name and date of birth*

2. Basic demographic information (age, gender, race)

3. Date of service provided

4. Type of service provided (e.g. housing, legal services)

5. Length of service, if applicable (e.g. length of stay in temporary housing) Outreach 1. Name and contact information

2. Basic demographic information (age, gender, race)

3. Date, method, and outcome of all outreach attempts

4. Referral source
Program
enrollment &
exit

1. Date and source of referral

2. Dates of enrollment and exit

3. Type of program

4. Reason for exit
Program intake
and needs
assessment

1. Date of intake and needs assessment

2. Other questions will be specific to strategy or service provider Program service
delivery

1. Date, duration, method, and outcome of communication with client by service provider

2. Date and amount of financial incentives provided to client

3. Assigned staff member's name
Referral to
services

1. Name and date of birth*

2. Date of referral

3. Type of service referral

Form Data fields

4. Name of organization referred to

5. Status of referral (e.g. sent, received, accepted, denied) Relocation 1. Names of individuals being relocated

2. Yes/No: Was safety assessment conducted?

3. Date and types of relocation support provided

4. Date and result of request for relocation support/funding Triangle
incident
response

1. Date and time of notification

2. Date and time of scene or hospital response

3. Assessment: Victim name and demographics, category of incident, homicide (yes/no), level of retaliation

4. Notes on follow-up: relocation, mediation, peer outreach, family outreach, school outreach, community outreach
Violence
mediation

1. Date and time of mediation conversations

2. Names of individuals involved in conversations

3. Type of mediation: proactive vs. retaliation

4. Other people notified of conflict (e.g. family members, school administrators) *These fields are applicable for activities that require entry of personally-identifiable information.

For each strategy and activity, Tables 5-7 identify whether CBOs will be expected to enter individual- level client records and personally-identifiable information (PII). PII is any data that could potentially identify a specific individual. Any information that can be used to distinguish one person from another and can be used to deanonymize previously anonymous data is considered PII. In situations where individual client records are required but PII is not, agencies will be able to leave the first and last name fields blank.

Tables 5-7 also identify whether select DVP staff (described under Data Access) will be able to view individual-level client records and PII for purposes of data quality assurance, process evaluation, and service coordination For minor clients whose parent/guardian do not consent to share information with the DVP, CBOs will have the option of using unique identifiers in lieu of PII. Unique identifiers are numeric codes that link to a key with client names and dates of birth by CBOs outside the Apricot 360 database. Evaluation of CBOs in the DVP network will not be contingent on the rate of consent. If a CBO has a consent rate that is less than 80%, the DVP will work with the CBO to explore options for increasing rates. As is current policy, CBOs are required to submit ancillary data during an onsite program monitoring visit to ensure that the service delivery and outcomes, for which DVP has contracted, are accurately reflected and are being achieved.

Table 5. Entry and visibility of individual-level client records and PII for the DVP’s group and gun violence strategy.

Substrategy Activity Are individual
client records
entered?
Is PII entered? Are individual
records and
PII entered by
CBOs visible
to DVP staff?
Employment &
Education Support
Services
Adult employment & education services Yes Yes Yes
Youth job exploration & education
services
Yes Yes Yes
School Site
Violence
Community healing No No No
Gender-based violence: Individual-level
services
Yes Provider
choice
No

Substrategy Activity Are individual
client records
entered?
Is PII entered? Are individual
records and
PII entered by
CBOs visible
to DVP staff?
Intervention &
Prevention Teams
Gender-based violence: Group services No No No
Violence interruption Yes Yes Yes
Youth life coaching Yes Yes Yes
Violent incident
crisis response
Emergency relocation Yes Yes Yes
Family support following homicide Yes Yes Yes
Hospital intervention Yes Yes Yes
Violence interruption Yes Yes Yes
Youth Diversion
and Youth & Adult
Life Coaching
Adult life coaching Yes Yes Yes
Housing-focused case management Yes Yes Yes
Youth diversion: Individual-level services Yes Yes Yes
Youth diversion: Group-level services No No No
Youth life coaching Yes Yes Yes

Table 6. Entry and visibility of individual-level client records and PII for the DVP’s gender-based violence strategy.

Substrategy Activity Are individual
client records
entered?
Is PII entered? Are individual
records and PII
entered by
CBOs visible to
DVP staff?
Crisis response Bedside advocacy and
accompaniment
Yes Provider choice No
24-hour hotlines Provider choice Provider choice No
Housing Emergency shelter: Hotel
vouchers
Provider choice Provider choice No
Emergency shelter: Relocation Yes Provider choice No
Transitional housing Yes Provider choice No
Wrap-Around
Services
Employment support: Individual
services
Yes Provider choice No
Employment support: Group
services
No No No
Legal advocacy: Advice and
referral
Provider choice Provider choice No
Legal advocacy: Case
management
Yes Provider choice No
Life coaching Yes Provider choice No
Safe space alternatives Provider choice Provider choice No Therapeutic support: Individual
services
Yes Provider choice No
Therapeutic support: Group
services
No No No

Table 7. Entry and visibility of individual-level client records and PII for the DVP’s community healing strategy.

Substrategy Are individual
client records
entered?
Is PII entered? Are individual
records and PII
entered by
CBOs visible to
DVP staff?
Restorative services No No No
Mini grants No No No
Neighborhood and community teams Yes Yes No
Therapeutic supports: Individual-level services Yes Yes No Therapeutic supports: Group-level services No No No
Town Nights No No No

For activities that collect PII, regardless of visibility to DVP staff, CBOs will be encouraged to notify clients that their name and date of birth will be documented in Apricot 360 for purposes of effective service delivery and coordination. Clients will also be asked to sign a consent form regarding potential access to their PII by a third-party evaluator. Completion of this consent form is strongly encouraged but is not a requirement of service delivery for any strategy, and clients will be able to decline having their PII accessed by a third-party evaluator if they wish.

D. Data Access

The DVP will take special care to ensure that data within Apricot 360 are accessed on a need-to-know and right-to-know basis, meaning that staff will only be able to access information that is essential to their job function. Apricot 360 allows administrators to restrict access to individual forms, records, and fields for staff members based on their pre-determined access requirements. An overview of data access levels for categories of staff employed by the DVP and contracted CBOs is provided below:

Contracted CBOs

▪ Direct service staff and supervisors will have access to individual- and group-level service delivery data entered by members of their agency only. Direct service staff and supervisors will NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.

▪ Fiscal and contract staff will have access to contract and fiscal documents such as budgets, scopes of work, invoices, and payments for their agency only. These staff members will also have access to aggregate service delivery data pertaining to contract deliverables, which will be automatically calculated based on data entered by direct service staff. Fiscal and contract staff will not have access to individual client records or PII.

DVP
▪ Direct service staff and supervisors will have access to individual- and group-level service delivery data entered by members of the DVP only. Direct service staff and supervisors within the DVP will NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.

▪ Violent incident crisis response coordination staff will have access to data entered by staff within the DVP and contracted CBOs pertaining to the violence incident crisis response

substrategy to ensure timely coordination of support services and violence interruption activities to prevent retaliation.

▪ Fiscal and contract staff will have access to contract and fiscal documents such as budgets, scopes of work, invoices, and payments for all grantees. These staff members will also have access to aggregate service delivery data pertaining to contract deliverables, which will be automatically calculated based on data entered by direct service staff. Fiscal and contract staff will not have access to individual client records or PII.

▪ Data and evaluation staff within the DVP will have access to client-level data and PII for DVP clients across all substrategies. For clients engaged by contracted CBOs, DVP data and evaluation staff will also have access to client-level data and PII for activities within the group and gun violence strategy for the purpose of identifying and remediating issues related to service delivery within or across CBOs.

▪ External data and evaluation staff employed by evaluation firms contracted by the City of Oakland will have access to PII for clients who have previously consented to having their PII shared with an external evaluator. For clients who have not consented to having their PII shared, external evaluation firms will only receive access to deidentified or aggregate service delivery data. All data shared with external evaluators will be downloaded from Apricot 360 by Bonterra technical support staff and shared via a secure file transfer method.

Unauthorized use of the system by any staff person with any level of access will lead to disciplinary action, which could include the termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.

E. Data Protection

Apricot 360 has comprehensive measures in place to maintain data privacy and security. The system sits behind a firewall that extensively controls, tracks, and reports access to the system’s internal infrastructure. Apricot 360 meets current U.S. Department of Housing and Urban Development (HUD) domestic violence standards, Homeless Management Information System (HMIS) standards, and Social Security Administration data management and security protocols, as well as minimum required Family Educational Rights and Privacy Act (FERPA) and HIPAA standards. Data entered into Apricot 360 are automatically encrypted while in transit between a user’s computer and the system’s servers, as well as while at rest. Additionally, users accessing Apricot 360 servers do so via a secure HTTPS connection.

More information on privacy and security for the Apricot 360 system is included in Attachment A.

F. Data Retention

Agencies that collect PII for clients based on their funded activities will be required to retain the PII for three years following service completion to ensure that data are available for evaluations conducted by external evaluators, which can last for up to three years following service delivery. At the end of three years, agencies will delete PII unless exempted based on legal requirements. Anonymous service delivery data will be retained for an additional four years to allow the DVP to monitor trends in service delivery over time. At the conclusion of seven years, individual-level data will be permanently deleted from Apricot 360 unless exempted due to legal requirements.

G. Public Access

There will be absolutely no public access to individual-level client data in Apricot 360. As with any government record, a member of the public may submit a Public Records Act request, but only aggregate data (no PII) would be released subject to applicable federal, state, and local privacy or confidentiality laws. If the DVP receives a request of this nature, staff will work with the City Attorney’s Office to respond to the request without sharing PII. The DVP will also notify any contracted CBOs impacted by the data request as soon as reasonably possible. To date, the City of Oakland has only received requests through the Public Records Act for aggregate-level data pertaining to its violence prevention and intervention services (e.g. how many participants were served in a year).

Aggregate data from Apricot 360 will be available in evaluation reports published by third-party evaluation firms and may be shared through public tables, charts, or dashboards created by the DVP.

H. Third Party Data Sharing

Outside of the DVP, DVP-funded CBOs, and evaluation firms contracted by the City of Oakland, no other agency will have access to data collected in Apricot 360. External evaluators contracted by the City of Oakland will use data in Apricot 360 to evaluate the effectiveness of funded programs. External evaluators will only have access to PII for individuals who sign a consent form allowing their PII to be shared with a third-party evaluator. For clients who do not sign a consent form allowing access to their PII, external evaluators will receive deidentified or aggregate data.

I. Training

The DVP’s data and evaluation staff will attend Apricot 360 train-the-trainer and custom end user training sessions, which will review Apricot 360’s configuration and tips and tricks for training end users.

In addition, DVP staff will have access to the Apricot basic training package, which includes unlimited access to the following:

▪ Live Apricot setup webinar
▪ Live Apricot insights webinar
▪ Administrative video library
▪ End user training library

Using these tools, the DVP’s data and evaluation staff will train direct service staff, supervisors, and contract and fiscal staff within the DVP and contracted CBOs on how to use Apricot 360. This will include general trainings, trainings specific to substrategies and activities, and ongoing options for one-on-one training, support, and technical assistance. All trainings will specify appropriate usage of the system pertaining to data privacy and security as outlined in this use policy, and all trained staff members will sign a copy of the use policy indicating that they have read and understand it. Trainings will also discuss consequences of inappropriate system usage, which could include termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.

Additionally, all staff within the DVP who have access to client-level data and PII entered into Apricot 360 by contracted CBOs will maintain current certifications in HIPAA and Collaborative Institutional Training Initiative (CITI) research, ethics, and compliance training.

J. Auditing and Oversight

The DVP’s data and evaluation staff will monitor compliance with this use policy of staff within the DVP and contracted CBOs. All actions in the system (add, edit, delete, view, etc.) are accessible through audit log reports built into the system for administrator monitoring. On a quarterly basis, the DVP’s data and evaluation staff will receive these logs from Apricot 360 administrators and review them for any signs of inappropriate system usage. Any indication of inappropriate system usage will be thoroughly investigated by the DVP in consultation with the City Attorney’s Office. Inappropriate system usage could result in termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.

K. Maintenance

Bonterra’s security mechanisms and procedures are built on the Soc2 Type II Framework with HIPAA amendment and audited by third-party security experts annually to ensure compliance with best-in- class technical safeguards, processes, policies, and procedures. Bonterra has an extensive cloud security team led by their Chief Information Security Officer that uses a broad set of tools for monitoring security, vulnerability, integrity, and uptime across over 19,000 customers. A complete copy of Bonterra’s Soc2 Type II has been shared with City of Oakland staff who have signed a non-disclosure agreement, including data and evaluation staff from the DVP and staff from the Information Technology Department.

L. Evaluation

Within one (1) year of the adoption of this Use Policy, DVP shall return to the Privacy Advisory Commission and, subsequently to the City Council, which may include the Public Safety Committee, for an evaluation. Such evaluation shall include, but not be limited to, what data was collected, how it was used, consent rates of contracted CBOs, and any recommended changes such as to data collection for minor clients and future scoring, funding levels, or other actions related to consent rates of contracted CBOs.

Updated 03.26.24
Apricot 360 Use Policy
City of Oakland Department of Violence Prevention

The Department of Violence Prevention (DVP) formed in 2020 with a mandate to reduce levels of group violence, intimate partner violence, commercial sexual exploitation, and trauma associated with these forms of violence in Oakland. Each fiscal year, the DVP distributes millions of dollars in funding to community-based organizations (CBOs) in Oakland that deliver prevention and intervention services in the following four strategy areas: (1) Group violence, (2) Gender-based violence (GBV), (3) Community healing, and (4) School violence intervention and prevention (VIP) teams. The DVP also provides direct services in the areas of intensive life coaching, violence interruption, and GBV crisis response.

A. Purpose

The Apricot 360 data management system (Apricot 360), developed by Bonterra (formerly Social Solutions Global, Inc.), enables the DVP and its funded CBOs to track information related to service delivery and grant management in the DVP’s four strategy areas. Apricot 360 is used by direct service staff from the DVP and funded CBOs to track enrollment, service engagement, milestones, and outcomes for individual services, as well as attendance, duration, and content of group services.

Supervisory staff within the DVP and CBOs use the system to ensure that direct service staff are delivering services appropriately to facilitate behavior change. The DVP’s data and evaluation staff use Apricot 360 to monitor service delivery and outcome data across each strategy, oversee the activities and deliverables of individual CBOs to ensure alignment with their scopes of work, and identify challenges with service delivery that require remediation. Fiscal and grant staff within the DVP and CBOs use the system to store grant documents, track budget spenddown, track progress on scope of work deliverables, and process invoices based on completion of deliverables. Finally, for participants who have provided their consent, service delivery and outcome data collected through Apricot 360 are available to external evaluators contracted by the City of Oakland to conduct an evaluation of DVP programs and services.

B. Authorized Use

Data stored in Apricot 360 is accessed on a need-to-know and right-to-know basis, meaning that DVP and CBO staff members only have to access information that is essential to their job function. Categories of Apricot 360 system usage are described below.

• Service delivery: Direct service and supervision staff employed by the DVP and funded CBOs use Apricot 360 to track information on client enrollment, contacts, progress towards milestones, referrals, and other aspects of service delivery. The system identifies upcoming staff member tasks related to service delivery and presents summarized data on clients served though dashboards that are helpful to staff. Direct service staff include individuals such as case managers and life coaches who work directly with clients to deliver services or programming.

Supervision staff are supervisors of direct service staff.

• Service coordination: Select staff members within the DVP who coordinate services within the Gun Violence Strategy, such as the shooting and homicide response or Ceasefire referrals to life coaching, have access to service data entered by funded CBOs to ensure that individuals receive timely, comprehensive, and coordinated services and follow-up.

Attachment B

Updated 03.26.24
• Program monitoring and accountability: DVP data and evaluation staff use aggregate service delivery data to monitor trends in service delivery within activities and ensure that summarized service delivery data are available to a range of external stakeholders, including councilmembers, committee members, grantors, and the public. DVP data and evaluation staff also review individual-level client data within the group and gun violence strategy to determine how many clients are enrolled in multiple services, ensure that clients are not simultaneously enrolled in the same service through different providers, and ensure that services delivered to individual clients meet DVP expectations in terms of quality, frequency, duration.

• Contract management: Fiscal and contract staff employed by the DVP and funded CBOs use the system to manage grant budgets, monitor grant deliverables, and prepare quarterly invoices.

• External evaluation: External evaluators contracted by the City of Oakland use data from Apricot 360 to evaluate the effectiveness of services delivered by the DVP and funded CBOs.

Evaluators seek and receive institutional review board (IRB) approval prior to commencing research activities. Once IRB approval is obtained, evaluators only have access to personally- identifiable information for individuals who have signed a consent form agreeing to have their identifiable data shared with a third-party evaluator. For clients who do not sign a consent form, evaluators receive deidentified or aggregate data.

C. Data Collection

Service delivery data are entered into Apricot 360 by direct service staff employed by the DVP and contracted CBOs. For each activity funded through the DVP’s three strategies, Table 1 provides an overview of the types of data collected through each form.

Table 1. Types of data collected through Apricot 360 forms.

Form Types of data fields
Group activity 1. Date, location, and duration of activity

2. Number and type (e.g. students, residents, teachers) of people in attendance

3. Type of activity (e.g. training, support group)

4. Attendance
Housing
placement

1. Dates housed

2. Housing type (e.g. permanent, transitional, shelter) Job placement:

Employer profile

1. Name of employer

2. Contact information for employer

3. Type of employment field
Job placement:

Work
experience

1. Dates employed

2. Wages at beginning and end of employment

3. Weekly hours worked at beginning and end of employment

4. Type of employment (subsidized vs. permanent)
Mobile &
bedside
advocacy

1. Date and time of contact

2. Basic demographic information (age, gender, race)

3. Yes/No: Was safety plan developed?
Hospital
response

1. Date and time of initial notification

2. Date and time of visits for service

3. Name and date of birth of individual visited

4. Type of support provided (e.g. VOC applications, relocation funding)

Updated 03.26.24
Form Types of data fields
Intake and
needs
assessment

1. Date of intake and needs assessment

2. Other questions specific to strategy or service provider Life map goals
and activities

1. Case plan goals

2. Planned and accomplished actions associated with goals

3. Start dates, completion dates, and current progress

4. Date and amount of financial incentives provided for completion of life map goals Outreach 1. Date, method, and outcome of outreach attempts Participant
record

1. Name and date of birth

2. Contact information

3. Demographic information (race, gender, education, language spoken at home)

4. Employment status

5. Housing status

6. School information, if applicable

7. Names and contact information of important people, if client chooses to provide (e.g. probation officer)
Program
enrollment

1. Date and source of referral

2. Dates of enrollment and exit

3. Type of program

4. Reason for exit
Referral to
services

1. Date of referral

2. Type of service referral

3. Name of organization referred to

4. Status of referral (e.g. sent, received, accepted, denied) Relocation 1. Names of individuals being relocated

2. Number of individuals in the family

3. Yes/No: Was safety assessment conducted?

4. Date and types of relocation support provided

5. Date and result of request for relocation support/funding Service notes 1. Date, duration, method, and outcome of communication with client by service provider

2. Date and amount of financial incentives provided to client

3. Assigned staff member's name

4. Types and amount of support provided (e.g. stipends, relocation, funeral/vigil planning)

5. Attendance at funerals/vigils (when applicable)
Shooting and
homicide
response

1. Date and time of notification

2. Date and time of scene or hospital response

3. Assessment: Victim initials and demographics, category of incident, homicide (yes/no), level of retaliation

4. Notes on follow-up and referral
Violence
mediation

1. Date and time of mediation conversations

2. Number of individuals involved in conversations

3. Type of mediation: proactive vs. retaliation

4. Other people notified of conflict (e.g. family members, school administrators)

For each strategy and activity, Tables 2-5 identify whether CBOs are expected to enter individual-level and group-level service delivery data. For CBOs that are expected to enter individual-level data, Tables 2-5 also identify whether personally-identifiable information (PII) is entered. PII is any information that can be used to distinguish one person from another and can be used to deanonymize previously anonymous data is considered PII. In situations where individual client records are required but PII is not, and for minor clients whose parent/guardian do not consent to share information with the DVP,

Updated 03.26.24
CBOs will have the option of using unique identifiers in lieu of PII. Unique identifiers are numeric codes that link to a key with client names and dates of birth by CBOs outside the Apricot 360 database.

Evaluation of CBOs in the DVP network will not be contingent on the rate of consent. If a CBO has a consent rate that is less than 80%, the DVP will work with the CBO to explore options for increasing rates. As is current policy, CBOs are required to submit ancillary data during an onsite program monitoring visit to ensure that the service delivery and outcomes, for which DVP has contracted, are accurately reflected and are being achieved.

Table 2. Categories of data entered in Apricot 360 for the DVP’s group violence strategy.

Activity Is individual-
level data
entered?
Is PII entered? Is group-level
data entered?
Adult employment & education services Yes Yes Yes
Adult life coaching Yes Yes Yes
Emergency relocation Yes Yes No
Hospital-based intervention Yes Yes No
Violence interruption Yes No No
Youth diversion Yes Yes No
Youth job exploration & education services Yes Yes Yes
Youth life coaching Yes Yes Yes

Table 3. Categories of data entered in Apricot 360 for the DVP’s gender-based violence strategy.

Activity Is individual-
level data
entered?
Is PII entered? Is group-level
data entered?
Bedside advocacy and accompaniment No No No
24-hour hotlines No No No
Emergency shelter Yes No No
Transitional housing Yes No No
Employment support Yes No Yes
Legal advocacy Yes No No
Life coaching Yes No No
Safe space alternatives Yes No Yes
Therapeutic support Yes No Yes

Table 4. Categories of data entered in Apricot 360 for the DVP’s community healing strategy.

Activity Is individual-
level data
entered?
Is PII entered? Is group-level
data entered?
Restorative services No No Yes
Neighborhood and community teams No No Yes
Therapeutic supports Yes Yes Yes
Family support following a homicide Yes Yes Yes
Town Nights No No Yes

Updated 03.26.24
Table 5. Categories of data entered in Apricot 360 for the DVP’s school VIP teams strategy.

Activity Is individual-
level data
entered?
Is PII entered? Is group-level
data entered?
Community healing No No Yes
Gender-based violence Yes No Yes
Violence interruption No No Yes
Youth life coaching Yes Yes No

For activities that collect PII, regardless of visibility to DVP staff, CBOs are encouraged to notify clients that their name and date of birth are documented in Apricot 360 for purposes of effective service delivery and coordination. Clients are also asked to sign a consent form regarding potential access to their PII by a third-party evaluator. Completion of this consent form is strongly encouraged but is not a requirement of service delivery for any strategy, and clients are able to decline having their PII accessed by a third-party evaluator if they wish. Additionally, CBOs in the DVP network are not evaluated based on their rates of client consent to sharing data with an external evaluator.

D. Data Access

The DVP takes special care to ensure that data within Apricot 360 are accessed on a need-to-know and right-to-know basis, meaning that staff are only be able to access information that is essential to their job function. Apricot 360 allows administrators to restrict access to individual forms, records, and fields for staff members based on their pre-determined access requirements. An overview of data access levels for categories of staff employed by the DVP and contracted CBOs is provided below:

Funded CBOs

▪ Direct service staff and supervisors have access to individual- and group-level service delivery data entered by members of their agency only. Direct service staff and supervisors do NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.

▪ Fiscal and grant staff have access to contract and fiscal documents such as budgets, scopes of work, and invoices for their agency only. These staff members also have access to aggregate service delivery data pertaining to contract deliverables, which are automatically calculated based on data entered by direct service staff. Fiscal and grant staff do not have access to individual client records or PII.

DVP
▪ Direct service staff and supervisors have access to individual- and group-level service delivery data entered by DVP staff. Direct service staff and supervisors within the DVP do NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.

• Service coordination: Select staff members within the DVP who coordinate services, such as the shooting and homicide response or Ceasefire referrals to life coaching, have access to service

Updated 03.26.24
data entered by funded CBOs to ensure that individuals receive timely, comprehensive, and coordinated services and follow-up.

▪ Fiscal and grant staff have access to contract and fiscal documents such as budgets, scopes of work, invoices, and payments for all grantees. These staff members also have access to aggregate service delivery data pertaining to contract deliverables, which are automatically calculated based on data entered by direct service staff. Fiscal and contract staff do not have access to individual client records or PII.

▪ Data and evaluation staff within the DVP have access to individual-level data and PII for DVP clients across all activities. For clients served by contracted CBOs, DVP data and evaluation staff also have access to client-level data and PII for the purpose of identifying and remediating issues related to service delivery within or across CBOs.

▪ External data and evaluation staff employed by evaluation firms contracted by the City of Oakland have access to PII for clients who have previously consented to having their PII shared with an external evaluator. For clients who have not consented to having their PII shared, external evaluation firms only receive access to deidentified or aggregate service delivery data.

All data shared with external evaluators are shared via a secure file transfer method.

Unauthorized use of the system by any staff person with any level of access will lead to disciplinary action, which could include the termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.

E. Data Protection

Apricot 360 has comprehensive measures in place to maintain data privacy and security. The system sits behind a firewall that extensively controls, tracks, and reports access to the system’s internal infrastructure. Apricot 360 meets current U.S. Department of Housing and Urban Development (HUD) domestic violence standards, Homeless Management Information System (HMIS) standards, and Social Security Administration data management and security protocols, as well as minimum required Family Educational Rights and Privacy Act (FERPA) and HIPAA standards. Data entered into Apricot 360 are automatically encrypted while in transit between a user’s computer and the system’s servers, as well as while at rest. Additionally, users accessing Apricot 360 servers do so via a secure HTTPS connection.

More information on privacy and security for the Apricot 360 system is included in Attachment A.

F. Data Retention

Agencies that collect PII for clients based on their funded activities are required to retain the PII for three years following service completion to ensure that data are available for evaluations conducted by external evaluators, which can last for up to three years following service delivery. At the end of three years, agencies will delete PII unless exempted based on legal requirements. Anonymous service delivery data is retained for an additional four years to allow the DVP to monitor trends in service delivery over time. At the conclusion of seven years, individual-level data will be permanently deleted from Apricot 360 unless exempted due to legal requirements.

Updated 03.26.24
G. Public Access

There is absolutely no public access to individual-level client data in Apricot 360. As with any government record, a member of the public may submit a Public Records Act request, but only aggregate data (no PII) would be released subject to applicable federal, state, and local privacy or confidentiality laws. If the DVP receives a request of this nature, staff will work with the City Attorney’s Office to respond to the request without sharing PII. The DVP will also notify any contracted CBOs impacted by the data request as soon as reasonably possible. To date, the City of Oakland has only received requests through the Public Records Act for aggregate-level data pertaining to its violence prevention and intervention services (e.g. how many participants were served in a year).

Aggregate data from Apricot 360 is available in evaluation reports published by third-party evaluation firms and may be shared through public tables, charts, or dashboards created by the DVP.

H. Third Party Data Sharing

Outside of the DVP, DVP-funded CBOs, and evaluation firms contracted by the City of Oakland, no other agency has access to data collected in Apricot 360. External evaluators contracted by the City of Oakland use data in Apricot 360 to evaluate the effectiveness of funded programs. External evaluators only have access to PII for individuals who sign a consent form allowing their PII to be shared with a third-party evaluator. For clients who do not sign a consent form allowing access to their PII, external evaluators receive deidentified or aggregate data.

I. Training

The DVP’s data and evaluation staff have attended Apricot 360 training sessions, such as the Certified Apricot Administrator Training, which review Apricot 360’s configuration and tips and tricks for training end users. In addition, DVP staff has access to numerous Apricot trainings through the training library.

Using these tools, the DVP’s data and evaluation staff train direct service staff, supervisors, and contract and fiscal staff within the DVP and contracted CBOs on how to use Apricot 360. This includes general trainings, trainings specific to activities, and ongoing options for one-on-one training, support, and technical assistance. All trainings specify appropriate usage of the system pertaining to data privacy and security as outlined in this use policy, and all trained staff members sign a copy of the use policy indicating that they have read and understand it. Trainings also discuss consequences of inappropriate system usage, which could include termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.

Additionally, all staff within the DVP who have access to client-level data and PII entered into Apricot 360 by contracted CBOs maintain current certifications in HIPAA and Collaborative Institutional Training Initiative (CITI) research, ethics, and compliance training.

J. Auditing and Oversight

The DVP’s data and evaluation staff monitor compliance with this use policy of staff within the DVP and contracted CBOs. All actions in the system (add, edit, delete, view, etc.) are accessible through audit log reports built into the system for administrator monitoring that DVP’s data and evaluation staff review regularly. Any indication of inappropriate system usage is thoroughly investigated by the DVP in consultation with the City Attorney’s Office. Inappropriate system usage could result in termination of a

Updated 03.26.24
CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.

K. Maintenance

Bonterra’s security mechanisms and procedures are built on the Soc2 Type II Framework with HIPAA amendment and audited by third-party security experts annually to ensure compliance with best-in- class technical safeguards, processes, policies, and procedures. Bonterra has an extensive cloud security team led by their Chief Information Security Officer that uses a broad set of tools for monitoring security, vulnerability, integrity, and uptime across over 19,000 customers. A complete copy of Bonterra’s Soc2 Type II has been shared with City of Oakland staff who have signed a non-disclosure agreement, including data and evaluation staff from the DVP and staff from the Information Technology Department.

L. Evaluation

Within one (1) year of the adoption of this Use Policy, DVP shall return to the Privacy Advisory Commission and, subsequently to the City Council, which may include the Public Safety Committee, for an evaluation. Such evaluation shall include, but not be limited to, what data was collected, how it was used, consent rates of contracted CBOs, and any recommended changes such as to data collection for minor clients and future scoring, funding levels, or other actions related to consent rates of contracted CBOs.

Security and Hosting
Social Solutions Global, Inc. (“SSG”) takes comprehensive measures to ensure that data is kept safe, confidential and recoverable in the case of a disaster. Social Solutions’ office sits behind a firewall which extensively controls, tracks, and reports access to our internal infrastructure. Our software meets current HUD Domestic Violence, HMIS, and Social Security Administration data management and security protocols, FedRAMP ready, as well as minimum required FERPA and HIPAA standards.

Data Security
Apricot® uses user names and passwords to prevent unauthorized access and to restrict user access within the application. Each unique user account is assigned access to programs and permission sets to restrict access to data and features in the system.

Customer data is housed in two locations (U.S. and Canada) based on the location of the client. Data is stored using redundant AWS hardware technologies, SSG fault tolerant software, and journaling file systems.

PASSWORDS

a can be set to have a minimum length
a can be set to contain non-alpha-numeric characters
a can be set to expire
a can be locked after a set # of invalid login attempts a can be changed by a local administrator
a are not displayed upon entry and are encrypted
Encryption
Social Solutions uses state-of-the-art equipment and technology to safeguard the confidential nature of your data. Your data is automatically encrypted while in transit between your computer and our servers as well as while in the database. Users access Apricot® software web application servers via secure HTTPS connection.

SOC2
Our SOC2 Type 2 (SSAE18) report is a comprehensive document that describes Social Solutions security controls in the domains of Administrative, Physical, and Technical security. Apricot is certified SOC 2 Type II compliant. SSG security controls are reviewed by independent external auditors during audits for our SOC compliance.

Amazon Web Services (AWS) Server Security
Each of our servers is individually governed by a system that is designed to prevent unexpected Internet data from being processed by our server software. IDS, virus scanning, automated system checks, and remote logging guard against unauthorized access.

AWS implements electronic surveillance and multi-factor access control systems to secure its data centers. Data centers are staffed 24x7 by trained security guards, and access must be strictly authorized. Multiple availability zones allow Apricot to remain resilient in the face of most failure modes, including natural disasters or system failures1. In case of a disaster in our main AWS region, Social Solutions will have Apricot up and running between 24-48 hours in a backup AWS region.

REDUNDANT INFRASTRUCTURE AND BACKUPS

a 24/7/365 monitoring of uptime across the infrastructure a Redundant water, power, telecommunications, and Internet connectivity to maintain continuous operations
a Uninterrupted power supply to reduce possible service outages

RETENTION POLICY

a Keep daily backups for 12 months
SOCIALSOLUTIONS.COM
Compliance
The AWS cloud infrastructure has been designed and managed by Amazon.com 2. AWS adheres to:
aSOC 1/SSAE 16/ISAE 3402 (formerly SAS70) aSOC 2 aSOC 3 aPCI DSS Level 1 aISO 270012 1 For additional information visit: https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Whitepaper.pdf 2 For additional information visit: https://d0.awsstatic.com/whitepapers/compliance/AWS_Compliance_Quick_Reference.pdf

City of Oakland
Annual Surveillance Report for Surveillance Technology

Department of Violence Prevention Apricot 360 Data Management System

A. System Use

• Prompt: Provide a description of how the surveillance technology was used, including the type and quantity of data gathered or analyzed by the technology.

• Response: The Apricot 360 data management system (Apricot 360) was used by approximately 20 staff from the Department of Violence Prevention (DVP) and 180 staff from community-based organizations funded by the DVP to deliver violence prevention and intervention services. Direct service staff used the system to track enrollment, service engagement, milestones, and outcomes for individual services as well as attendance, duration, and content of group services. Supervisory staff used the system to ensure that services are delivered with the expected scope and reach. Fiscal and grant staff used the system to store grant documents, track budget spenddown, track progress on scope of work deliverables, and process invoices based on completion of deliverables. Lastly, the DVP’s data and evaluation staff used the system to monitor service delivery and outcome data across each strategy, review deliverables for CBOs to ensure alignment with their scopes of work, and identify challenges with service delivery that require remediation.

Many services funded by the DVP and delivered by direct service staff require the collection of individual-level data. Users enter individual-level data in Apricot 360 by first completing a participant record and then completing forms related to the type of service delivery. Table 1 provides the number of participant records and related service forms entered by users in Apricot 360 from February 1, 2023, to January 31, 2024.

Table 1. Apricot 360 forms completed for services that require the collection of individual-level data from February 1, 2023, to January 31, 2024.

Apricot form Approximate number of
records entered
Participant record 7,000
Program enrollment 4,500
Service notes 50,000
Referral 3,500
Life map goals and incentives 2,000
Intake and needs assessment 200
Family assessments 50
Housing placement 200
Emergency relocation 20
Work experience/job placement 500

Attachment C

Users also enter data in Apricot 360 related to services for which individual data is not collected or recorded. Table 2 provides the approximate number of forms completed for these services.

Table 2. Apricot 360 forms completed for services that do not require the collection of individual-level data from February 1, 2023, to January 31, 2024.

Apricot form Approximate number of
records entered
Outreach 1,500
Group activities and events 1,800
Hospital response 200
Mini grants 55
Mobile and bedside advocacy visits 200
Violence mediations 550
Shooting and homicide responses 800

B. Data Sharing

• Prompt: Please provide information about whether and how often data acquired through the use of the surveillance technology was shared with outside entities, the name of any recipient entity, the type(s) of data disclosed, under what legal standard(s) the information was disclosed, and the justification for the disclosure(s).

• Response: Deidentified data on services delivered and personally identifiable information (PII) for participants who provided their consent was shared with the following two parties, as approved in the use policy:

i. Urban Institute, for the independent third-party evaluation of Measure Z spending and programs, as authorized by the City Council Resolution No. 89139, Professional Services Agreement 16527, and the corresponding data- sharing agreement.

ii. Mathematica, for the independent third-party evaluation of the DVP’s Board of State and Community Corrections’ California Violence Intervention and Prevention (CalVIP) grant, as authorized by the City Council Resolution No. 88679, Professional Services Agreement 13898, and the corresponding data- sharing agreement.

C. Installation & Application

• Prompt: Where applicable, provide a breakdown of what physical objects the surveillance technology hardware was installed upon; using general descriptive terms so as not to reveal the specific location of such hardware; for surveillance technology software, a breakdown of what data sources the surveillance technology was applied to.

• Response: Not applicable – Apricot 360 is a cloud-based software.

D. Deployment Breakdown

• Prompt: Where applicable, provide a breakdown of where the surveillance technology was deployed geographically, by each Police Area in the relevant year.

• Response: Not applicable – Apricot 360 is a cloud-based software.

E. Community Complaints

• Prompt: Provide a summary of community complaints or concerns about the surveillance technology, and an analysis of the technology’s adopted use policy and whether it is adequate in protecting civil rights and civil liberties. The analysis shall also identify the race of each person that was subject to the technology’s use. The Privacy Advisory Commission may waive this requirement upon making a determination that the probative value in gathering this information to evaluate the technology’s impact on privacy interests is outweighed by the City’s administrative burden in collecting or verifying this information and the potential greater invasiveness in capturing such data. If the Privacy Advisory Commission makes such a determination, written findings in support of the determination shall be included in the annual report submitted for City Council review.

• Response: There have been no complaints or concerns raised about Apricot 360 related to its protection of civil rights and civil liberties. DVP data and evaluation staff have communicated with numerous grantees to integrate their feedback regarding ways to improve the user-friendliness of the system.

The adopted use policy is adequate in protecting civil rights and liberties. Service delivery information entered in Apricot is limited to high-level information about the number and duration of service contacts and service outcomes. PII is only entered for services related to group violence and limited activities related to community healing; it is not entered for services related to gender-based violence. For services that involve the collection and entry of PII, data are only visible to staff within the agency entering the data and select DVP staff who perform data and evaluation or service coordination roles; they are not visible to other agencies funded by the DVP. PII is not entered for youth clients whose parents/caregivers do not consent to the entry of their child’s PII in Apricot 360. Additionally, PII is only shared with external evaluation partners for clients who consent to having their data shared externally for the purposes of evaluation. Table 3 provides race and ethnicity data for participants whose data was entered in Apricot 360 from February 1, 2023, to January 31, 2024.

Table 3. Race and ethnicity data for participants who data was entered in Apricot 360 from February 1, 2023, to January 31, 2024.

Race Percentage
African American 52%

Race Percentage
Asian 3%
Hispanic or Latino 25%
Multi-Racial 5%
White 3%
Missing 12%

F. Internal Audits & Compliance
• Prompt: Provide the results of any internal audits, any information about violations or potential violations of the Surveillance Use Policy, and any actions taken in response unless the release of such information is prohibited by law, including but not limited to confidential personnel file information.

• Response: DVP data and evaluation staff regularly review record audits of Apricot 360. There have not been any violations or potential violations of the use policy to date.

G. Data Breaches or Other Unauthorized Access

• Prompt: Provide information about any data breaches or other unauthorized access to the data collected by the surveillance technology, including information about the scope of the breach and the actions taken in response.

• Response: There have been no data breaches or unauthorized access to the Apricot 360 system.

H. Efficacy

• Prompt: Provide information, including crime statistics, that help the community assess whether the surveillance technology has been effective at achieving its identified purposes.

• Response: Apricot 360 has allowed DVP staff to easily access and share aggregate data regarding DVP-funded services for City Council reports and grant applications.

These data are instrumental in justifying continued financial investments in violence prevention and intervention services in Oakland by providing a clear picture of the services delivered and the demographics of people served. For example, information on DVP services collected through Apricot 360 was used in agenda reports for resolutions that authorized approximately $36 million in funding for violence prevention and intervention services delivered by community-based organizations from October 1, 2023, to September 30, 2025. Data collected in Apricot 360 will also serve as the primary source of data for evaluations of the City of Oakland’s Measure Z Public Safety and Services Violence Prevention Act, as well as evaluations of external grants from the California Board of State Community Corrections, Gilead Foundation, and Office of Juvenile Justice and Delinquency Prevention to demonstrate the impact of services. Apricot 360 has also allowed the DVP to better

understand service usage within the group violence strategy, which will be important for development of the DVP’s 2025-2029 spending plan. Table 4 provides the percent of clients engaged in group violence services from February 1, 2023, to January 31, 2024, who accessed more than one service funded by the DVP.

Table 4. Number of services accessed by participants in the group violence strategy from February 1, 2023, to January 31, 2024.

Number of services accessed Percent of clients served
1 76%
2 18%
3 4%
4 or more 2%

I. Public Records Requests

• Prompt: Provide statistics and information about public records act requests regarding the relevant subject surveillance technology, including response rates.

• Response: There have been no public records requests pertaining to Apricot 360.

J. Total Annual Costs

• Prompt: Provide the total annual costs for the surveillance technology, including personnel and other ongoing costs, and what source of funding will fund the technology in the coming year.

• Response: The total annual cost for Apricot 360 is approximately $124,919. In the coming year, $70,000 will be funded by Measure Z and $54,919 will be funded by external state and private grants.

K. Requested Use Policy Amendments

• Prompt: Please describe any requested modifications to the Surveillance Use Policy and provide a detailed basis for the request.

• Response:

i. The approved use policy allows DVP staff who coordinate services related to shooting and homicide response to view PII for activities within the group violence strategy. We would like to modify the use policy to state that DVP staff who coordinate services related to the group violence strategy, which includes shooting and homicide response and Ceasefire referrals to adult life coaching, are able to view PII for activities within the group violence strategy.

With the City of Oakland’s renewed prioritization of the Ceasefire gun violence reduction strategy, it is important that DVP direct service staff who refer Ceasefire clients to community organizations for life coaching have

visibility into whether clients enroll and the extent of their participation in services.

ii. The approved use policy includes three tables (Tables 1-3) that present the Apricot 360 forms relevant to each activity within the DVP’s strategies. As the DVP continues to refine its internal service delivery and respond to feedback from grantees about system modifications for ease of use, the names of forms and their application to specific activities may change. We would like to remove these tables since they do not provide important information related to the safeguarding of personal information and they have a high likelihood of being outdated following approval of the use policy.

iii. The approved use policy includes a table (Table 4) that listed fields of data collected through Apricot forms. As referenced above, this information may change in response to changes in service delivery or feedback from system users. We would like to rename this table “Types of data collected through Apricot 360 forms” to account for potential changes in data fields or form names. Additionally, we would like to remove several firms that are no longer used.

iv. The approved use policy includes three tables (Tables 5-7) that identify whether individual-level data and PII are entered in Apricot by funded activity. These tables also identify whether individual records and PII entered by CBOs are visible to DVP staff. We would like to amend these tables to remove the column regarding whether PII entered by CBOs are visible to DVP staff because all PII entered in Apricot are visible to the select DVP staff identified in the use policy; PII is not entered for activities that do not permit visibility to DVP staff. Additionally, we would like to add a column to these tables that identifies whether group-level data are entered. Lastly, school violence intervention and prevention (VIP) teams are now a standalone strategy within the DVP rather than being an activity within the group violence strategy. For that reason, we have created a new table with this information for the school VIP teams strategy. In the revised use policy, these tables are now Tables 2-5.

v. DVP staff have made non-substantive grammatical edits to the use policy for improved clarity and ease of reading.

L. Attachment 1: Data Sharing Consent Rates for Apricot 360 Data Management System

Attachment 1: Data Sharing Consent Rates for Apricot 360 Data Management System from February 1, 2023, to January 31, 2024.

Table 1. Overall consent rates
Response Consent rate
Yes 29%
No 25%
Not complete yet 39%
Never presented 6%

Table 2. Consent rates for the DVP’s group and gun violence strategy.

Activity Consent rate
Adult employment & education 89%
Adult life coaching 65%
Emergency relocation 19%
Family support 7%
Hospital-based intervention 25%
Violence interruption N/A
Youth career exploration & education 58%
Youth diversion 36%
Youth life coaching 84%

Table 3. Consent rates for the DVP’s gender-based violence strategy.

Activity Consent rate
24-hour hotlines N/A
Bedside advocacy and accompaniment N/A
Emergency shelter 36%
Employment 15%
Legal advocacy 4%
Life coaching 95%
Safe space alternatives 65%
Therapeutic support 8%
Transitional housing 26%

Table 4. Consent rates for the DVP’s community healing strategy.

Activity Consent rate
Healing/restorative activities 30%
Neighborhood and community teams N/A
Therapeutic supports 52%
Town Nights N/A

Table 5. Consent rates for the DVP’s school VIP strategy.

Activity Consent rate
Community healing 32%
Gender-based violence 13%
Violence interruption N/A
Youth life coaching 68%