Attachment A
Updated 03.26.24
Apricot 360 Use Policy
City of Oakland Department of Violence Prevention
The Department of Violence Prevention (DVP) formed in 2020 with a mandate to reduce levels of group violence, intimate partner violence, commercial sexual exploitation, and trauma associated with these forms of violence in Oakland. Each fiscal year, the DVP distributes millions of dollars in funding to community-based organizations (CBOs) in Oakland that deliver prevention and intervention services in the following four strategy areas: (1) Group violence, (2) Gender-based violence (GBV), (3) Community healing, and (4) School violence intervention and prevention (VIP) teams. The DVP also provides direct services in the areas of intensive life coaching, violence interruption, and GBV crisis response.
A. Purpose
The Apricot 360 data management system (Apricot 360), developed by Bonterra (formerly Social Solutions Global, Inc.), enables the DVP and its funded CBOs to track information related to service delivery and grant management in the DVP’s four strategy areas. Apricot 360 is used by direct service staff from the DVP and funded CBOs to track enrollment, service engagement, milestones, and outcomes for individual services, as well as attendance, duration, and content of group services.
Supervisory staff within the DVP and CBOs use the system to ensure that direct service staff are delivering services appropriately to facilitate behavior change. The DVP’s data and evaluation staff use Apricot 360 to monitor service delivery and outcome data across each strategy, oversee the activities and deliverables of individual CBOs to ensure alignment with their scopes of work, and identify challenges with service delivery that require remediation. Fiscal and grant staff within the DVP and CBOs use the system to store grant documents, track budget spenddown, track progress on scope of work deliverables, and process invoices based on completion of deliverables. Finally, for participants who have provided their consent, service delivery and outcome data collected through Apricot 360 are available to external evaluators contracted by the City of Oakland to conduct an evaluation of DVP programs and services.
B. Authorized Use
Data stored in Apricot 360 is accessed on a need-to-know and right-to-know basis, meaning that DVP and CBO staff members only have to access information that is essential to their job function. Categories of Apricot 360 system usage are described below.
• Service delivery: Direct service and supervision staff employed by the DVP and funded CBOs use Apricot 360 to track information on client enrollment, contacts, progress towards milestones, referrals, and other aspects of service delivery. The system identifies upcoming staff member tasks related to service delivery and presents summarized data on clients served though dashboards that are helpful to staff. Direct service staff include individuals such as case managers and life coaches who work directly with clients to deliver services or programming.
Supervision staff are supervisors of direct service staff.
• Service coordination: Select staff members within the DVP who coordinate services within the Gun Violence Strategy, such as the shooting and homicide response or Ceasefire referrals to life coaching, have access to service data entered by funded CBOs to ensure that individuals receive timely, comprehensive, and coordinated services and follow-up.
Attachment A
Updated 03.26.24
• Program monitoring and accountability: DVP data and evaluation staff use aggregate service delivery data to monitor trends in service delivery within activities and ensure that summarized service delivery data are available to a range of external stakeholders, including councilmembers, committee members, grantors, and the public. DVP data and evaluation staff also review individual-level client data within the group and gun violence strategy to determine how many clients are enrolled in multiple services, ensure that clients are not simultaneously enrolled in the same service through different providers, and ensure that services delivered to individual clients meet DVP expectations in terms of quality, frequency, duration.
• Contract management: Fiscal and contract staff employed by the DVP and funded CBOs use the system to manage grant budgets, monitor grant deliverables, and prepare quarterly invoices.
• External evaluation: External evaluators contracted by the City of Oakland use data from Apricot 360 to evaluate the effectiveness of services delivered by the DVP and funded CBOs.
Evaluators seek and receive institutional review board (IRB) approval prior to commencing research activities. Once IRB approval is obtained, evaluators only have access to personally- identifiable information for individuals who have signed a consent form agreeing to have their identifiable data shared with a third-party evaluator. For clients who do not sign a consent form, evaluators receive deidentified or aggregate data.
C. Data Collection
Service delivery data are entered into Apricot 360 by direct service staff employed by the DVP and contracted CBOs. For each activity funded through the DVP’s three strategies, Table 1 provides an overview of the types of data collected through each form.
Table 1. Types of data collected through Apricot 360 forms.
Form Types of data fields
Group activity 1. Date, location, and duration of activity
2. Number and type (e.g. students, residents, teachers) of people in attendance
3. Type of activity (e.g. training, support group)
4. Attendance
Housing
placement
1. Dates housed
2. Housing type (e.g. permanent, transitional, shelter) Job placement:
Employer profile
1. Name of employer
2. Contact information for employer
3. Type of employment field
Job placement:
Work
experience
1. Dates employed
2. Wages at beginning and end of employment
3. Weekly hours worked at beginning and end of employment
4. Type of employment (subsidized vs. permanent)
Mobile &
bedside
advocacy
1. Date and time of contact
2. Basic demographic information (age, gender, race)
3. Yes/No: Was safety plan developed?
Hospital
response
1. Date and time of initial notification
2. Date and time of visits for service
3. Name and date of birth of individual visited
4. Type of support provided (e.g. VOC applications, relocation funding) Attachment A
Updated 03.26.24
Form Types of data fields
Intake and
needs
assessment
1. Date of intake and needs assessment
2. Other questions specific to strategy or service provider Life map goals
and activities
1. Case plan goals
2. Planned and accomplished actions associated with goals
3. Start dates, completion dates, and current progress
4. Date and amount of financial incentives provided for completion of life map goals Outreach 1. Date, method, and outcome of outreach attempts Participant
record
1. Name and date of birth
2. Contact information
3. Demographic information (race, gender, education, language spoken at home)
4. Employment status
5. Housing status
6. School information, if applicable
7. Names and contact information of important people, if client chooses to provide (e.g. probation officer)
Program
enrollment
1. Date and source of referral
2. Dates of enrollment and exit
3. Type of program
4. Reason for exit
Referral to
services
1. Date of referral
2. Type of service referral
3. Name of organization referred to
4. Status of referral (e.g. sent, received, accepted, denied) Relocation 1. Names of individuals being relocated
2. Number of individuals in the family
3. Yes/No: Was safety assessment conducted?
4. Date and types of relocation support provided
5. Date and result of request for relocation support/funding Service notes 1. Date, duration, method, and outcome of communication with client by service provider
2. Date and amount of financial incentives provided to client
3. Assigned staff member's name
4. Types and amount of support provided (e.g. stipends, relocation, funeral/vigil planning)
5. Attendance at funerals/vigils (when applicable)
Shooting and
homicide
response
1. Date and time of notification
2. Date and time of scene or hospital response
3. Assessment: Victim initials and demographics, category of incident, homicide (yes/no), level of retaliation
4. Notes on follow-up and referral
Violence
mediation
1. Date and time of mediation conversations
2. Number of individuals involved in conversations
3. Type of mediation: proactive vs. retaliation
4. Other people notified of conflict (e.g. family members, school administrators)
For each strategy and activity, Tables 2-5 identify whether CBOs are expected to enter individual-level and group-level service delivery data. For CBOs that are expected to enter individual-level data, Tables 2-5 also identify whether personally-identifiable information (PII) is entered. PII is any information that can be used to distinguish one person from another and can be used to deanonymize previously anonymous data is considered PII. In situations where individual client records are required but PII is not, and for minor clients whose parent/guardian do not consent to share information with the DVP, Attachment A
Updated 03.26.24
CBOs will have the option of using unique identifiers in lieu of PII. Unique identifiers are numeric codes that link to a key with client names and dates of birth by CBOs outside the Apricot 360 database.
Evaluation of CBOs in the DVP network will not be contingent on the rate of consent. If a CBO has a consent rate that is less than 80%, the DVP will work with the CBO to explore options for increasing rates. As is current policy, CBOs are required to submit ancillary data during an onsite program monitoring visit to ensure that the service delivery and outcomes, for which DVP has contracted, are accurately reflected and are being achieved.
Table 2. Categories of data entered in Apricot 360 for the DVP’s group violence strategy.
Activity Is individual-
level data
entered?
Is PII entered? Is group-level
data entered?
Adult employment & education services Yes Yes Yes
Adult life coaching Yes Yes Yes
Emergency relocation Yes Yes No
Hospital-based intervention Yes Yes No
Violence interruption Yes No No
Youth diversion Yes Yes No
Youth job exploration & education services Yes Yes Yes
Youth life coaching Yes Yes Yes
Table 3. Categories of data entered in Apricot 360 for the DVP’s gender-based violence strategy.
Activity Is individual-
level data
entered?
Is PII entered? Is group-level
data entered?
Bedside advocacy and accompaniment No No No
24-hour hotlines No No No
Emergency shelter Yes No No
Transitional housing Yes No No
Employment support Yes No Yes
Legal advocacy Yes No No
Life coaching Yes No No
Safe space alternatives Yes No Yes
Therapeutic support Yes No Yes
Table 4. Categories of data entered in Apricot 360 for the DVP’s community healing strategy.
Activity Is individual-
level data
entered?
Is PII entered? Is group-level
data entered?
Restorative services No No Yes
Neighborhood and community teams No No Yes
Therapeutic supports Yes Yes Yes
Family support following a homicide Yes Yes Yes
Town Nights No No Yes
Attachment A
Updated 03.26.24
Table 5. Categories of data entered in Apricot 360 for the DVP’s school VIP teams strategy.
Activity Is individual-
level data
entered?
Is PII entered? Is group-level
data entered?
Community healing No No Yes
Gender-based violence Yes No Yes
Violence interruption No No Yes
Youth life coaching Yes Yes No
For activities that collect PII, regardless of visibility to DVP staff, CBOs are encouraged to notify clients that their name and date of birth are documented in Apricot 360 for purposes of effective service delivery and coordination. Clients are also asked to sign a consent form regarding potential access to their PII by a third-party evaluator. Completion of this consent form is strongly encouraged but is not a requirement of service delivery for any strategy, and clients are able to decline having their PII accessed by a third-party evaluator if they wish. Additionally, CBOs in the DVP network are not evaluated based on their rates of client consent to sharing data with an external evaluator.
D. Data Access
The DVP takes special care to ensure that data within Apricot 360 are accessed on a need-to-know and right-to-know basis, meaning that staff are only be able to access information that is essential to their job function. Apricot 360 allows administrators to restrict access to individual forms, records, and fields for staff members based on their pre-determined access requirements. An overview of data access levels for categories of staff employed by the DVP and contracted CBOs is provided below:
Funded CBOs
▪ Direct service staff and supervisors have access to individual- and group-level service delivery data entered by members of their agency only. Direct service staff and supervisors do NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.
▪ Fiscal and grant staff have access to contract and fiscal documents such as budgets, scopes of work, and invoices for their agency only. These staff members also have access to aggregate service delivery data pertaining to contract deliverables, which are automatically calculated based on data entered by direct service staff. Fiscal and grant staff do not have access to individual client records or PII.
DVP
▪ Direct service staff and supervisors have access to individual- and group-level service delivery data entered by DVP staff. Direct service staff and supervisors within the DVP do NOT have access to service-delivery data for clients being served by other agencies, even if they are the same clients.
• Service coordination: Select staff members within the DVP who coordinate services, such as the shooting and homicide response or Ceasefire referrals to life coaching, have access to service Attachment A
Updated 03.26.24
data entered by funded CBOs to ensure that individuals receive timely, comprehensive, and coordinated services and follow-up.
▪ Fiscal and grant staff have access to contract and fiscal documents such as budgets, scopes of work, invoices, and payments for all grantees. These staff members also have access to aggregate service delivery data pertaining to contract deliverables, which are automatically calculated based on data entered by direct service staff. Fiscal and contract staff do not have access to individual client records or PII.
▪ Data and evaluation staff within the DVP have access to individual-level data and PII for DVP clients across all activities. For clients served by contracted CBOs, DVP data and evaluation staff also have access to client-level data and PII for the purpose of identifying and remediating issues related to service delivery within or across CBOs.
▪ External data and evaluation staff employed by evaluation firms contracted by the City of Oakland have access to PII for clients who have previously consented to having their PII shared with an external evaluator. For clients who have not consented to having their PII shared, external evaluation firms only receive access to deidentified or aggregate service delivery data.
All data shared with external evaluators are shared via a secure file transfer method.
Unauthorized use of the system by any staff person with any level of access will lead to disciplinary action, which could include the termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.
E. Data Protection
Apricot 360 has comprehensive measures in place to maintain data privacy and security. The system sits behind a firewall that extensively controls, tracks, and reports access to the system’s internal infrastructure. Apricot 360 meets current U.S. Department of Housing and Urban Development (HUD) domestic violence standards, Homeless Management Information System (HMIS) standards, and Social Security Administration data management and security protocols, as well as minimum required Family Educational Rights and Privacy Act (FERPA) and HIPAA standards. Data entered into Apricot 360 are automatically encrypted while in transit between a user’s computer and the system’s servers, as well as while at rest. Additionally, users accessing Apricot 360 servers do so via a secure HTTPS connection.
More information on privacy and security for the Apricot 360 system is included in Attachment A.
F. Data Retention
Agencies that collect PII for clients based on their funded activities are required to retain the PII for three years following service completion to ensure that data are available for evaluations conducted by external evaluators, which can last for up to three years following service delivery. At the end of three years, agencies will delete PII unless exempted based on legal requirements. Anonymous service delivery data is retained for an additional four years to allow the DVP to monitor trends in service delivery over time. At the conclusion of seven years, individual-level data will be permanently deleted from Apricot 360 unless exempted due to legal requirements.
Attachment A
Updated 03.26.24
G. Public Access
There is absolutely no public access to individual-level client data in Apricot 360. As with any government record, a member of the public may submit a Public Records Act request, but only aggregate data (no PII) would be released subject to applicable federal, state, and local privacy or confidentiality laws. If the DVP receives a request of this nature, staff will work with the City Attorney’s Office to respond to the request without sharing PII. The DVP will also notify any contracted CBOs impacted by the data request as soon as reasonably possible. To date, the City of Oakland has only received requests through the Public Records Act for aggregate-level data pertaining to its violence prevention and intervention services (e.g. how many participants were served in a year).
Aggregate data from Apricot 360 is available in evaluation reports published by third-party evaluation firms and may be shared through public tables, charts, or dashboards created by the DVP.
H. Third Party Data Sharing
Outside of the DVP, DVP-funded CBOs, and evaluation firms contracted by the City of Oakland, no other agency has access to data collected in Apricot 360. External evaluators contracted by the City of Oakland use data in Apricot 360 to evaluate the effectiveness of funded programs. External evaluators only have access to PII for individuals who sign a consent form allowing their PII to be shared with a third-party evaluator. For clients who do not sign a consent form allowing access to their PII, external evaluators receive deidentified or aggregate data.
I. Training
The DVP’s data and evaluation staff have attended Apricot 360 training sessions, such as the Certified Apricot Administrator Training, which review Apricot 360’s configuration and tips and tricks for training end users. In addition, DVP staff has access to numerous Apricot trainings through the training library.
Using these tools, the DVP’s data and evaluation staff train direct service staff, supervisors, and contract and fiscal staff within the DVP and contracted CBOs on how to use Apricot 360. This includes general trainings, trainings specific to activities, and ongoing options for one-on-one training, support, and technical assistance. All trainings specify appropriate usage of the system pertaining to data privacy and security as outlined in this use policy, and all trained staff members sign a copy of the use policy indicating that they have read and understand it. Trainings also discuss consequences of inappropriate system usage, which could include termination of a CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.
Additionally, all staff within the DVP who have access to client-level data and PII entered into Apricot 360 by contracted CBOs maintain current certifications in HIPAA and Collaborative Institutional Training Initiative (CITI) research, ethics, and compliance training.
J. Auditing and Oversight
The DVP’s data and evaluation staff monitor compliance with this use policy of staff within the DVP and contracted CBOs. All actions in the system (add, edit, delete, view, etc.) are accessible through audit log reports built into the system for administrator monitoring that DVP’s data and evaluation staff review regularly. Any indication of inappropriate system usage is thoroughly investigated by the DVP in consultation with the City Attorney’s Office. Inappropriate system usage could result in termination of a Attachment A
Updated 03.26.24
CBO’s grant agreement and cessation of funding or, with respect to City of Oakland employees, discipline up to and including termination.
K. Maintenance
Bonterra’s security mechanisms and procedures are built on the Soc2 Type II Framework with HIPAA amendment and audited by third-party security experts annually to ensure compliance with best-in- class technical safeguards, processes, policies, and procedures. Bonterra has an extensive cloud security team led by their Chief Information Security Officer that uses a broad set of tools for monitoring security, vulnerability, integrity, and uptime across over 19,000 customers. A complete copy of Bonterra’s Soc2 Type II has been shared with City of Oakland staff who have signed a non-disclosure agreement, including data and evaluation staff from the DVP and staff from the Information Technology Department.
L. Evaluation
Within one (1) year of the adoption of this Use Policy, DVP shall return to the Privacy Advisory Commission and, subsequently to the City Council, which may include the Public Safety Committee, for an evaluation. Such evaluation shall include, but not be limited to, what data was collected, how it was used, consent rates of contracted CBOs, and any recommended changes such as to data collection for minor clients and future scoring, funding levels, or other actions related to consent rates of contracted CBOs.