Skip to main content
California Department of Education Logo

Management Bulletin 11-20


Early Education and Support Division

Subject: Centralized Eligibility List Data: Security and Confidentiality Requirements

Number: 11-20

Date: June 2011

Expires: Until Rescinded

Authority: California Education Code, Section 8227; California Code of Regulations, Title 5, Section 18117; and California Civil Code, Section 1798.80–1798.84

Attention: All County Centralized Eligibility List Administrators and All Executive Officers and Program Directors of All Child Care and Development Programs


Purpose

The purpose of Management Bulletin (MB) 11-20 is to provide Centralized Eligibility List (CEL) Administrators and child care and development contractors with requirements for data security and confidentiality.

Background

In May 2011, the California Department of Education (CDE), Early Education and Support Division (EESD) posted direction to CEL administrators on the actions that had to be taken due to the elimination of state funding for the CEL. This required CEL Administrators to:

  • Contact the assigned Field Services Consultant to request prior written approval for disposition of equipment and complete an equipment inventory form to document each piece of equipment costing $500 or more that was purchased, in whole or in part, with CEL contract funds
  • Retain all program operating records for a minimum of five years in accordance with Education Code (EC), Section 33421, and California Code of Regulations, Title 5 (5 CCR), Section 18067

The EESD posted direction on the actions that must be taken by direct service contractors currently participating in the CEL.

Policy

5 CCR, Section 18117 requires contractors to ensure that the use or disclosure of all information pertaining to the child and his/her family is restricted to purposes directly connected with the administration of the subsidized child care program.

California Civil Code, Section 1798.80–1798.84 requires that personally identifiable student level data no longer needed, or relevant, is destroyed. All reasonable steps must be taken to dispose, or arrange for the disposal, of records containing personal information when the records are no longer to be retained by:

  • Shredding,
  • Erasing, or
  • Modifying the personal information in those records to make it unreadable or undecipherable through any means

Further information on security laws can be found on the California Office of Information Security Web page at http://www.cio.ca.gov/OIS/.

Directive

A. Directives for CEL Administrators Regarding Disposition of Equipment Containing Confidential, Sensitive or Personally Identifiable Data

Before transferring or disposing of equipment, CEL administrators must remove all confidential, sensitive or personal information from all equipment/media including computers, storage components, and removable storage equipment. This would include using a disk wipe utility or physical device (such as degausser) to fully erase confidential data prior to the disposal, or transfer of any equipment containing a hard drive, removable media, or any media with data storage capabilities.

B. Directives for CEL Administrators Regarding Storage of Program Data During Retention Period

CEL Administrators must ensure that all program operating records, including hard copies of CEL applications, that must be retained for a minimum of five years in accordance with EC, Section 33421 and 5 CCR, Section 18067 are stored in safe secure manner.

During the five year retention period, all program operating records with confidential information in paper form should be kept in a locked location, and all program operating records with confidential information in electronic form should only be accessible by authorized users. Preferably, any confidential information in electronic form should also be encrypted.  

C. Directives for CEL Administrators Regarding Destruction of Program Data Following Retention Period

CEL Administrators must destroy all program operating records, including hard copies of CEL applications after the five year retention period if no litigation, claim, or audit was started before the expiration of the five-year period.

If there was any litigation, claim or audit started before the expiration of the five-year period, the records shall be retained until all litigation, claims or audit findings involving the records have been resolved and final action taken in accordance with EC, Section 33421 and 5 CCR, Section 18067. After that the records should be confidentially destroyed.

D. Directives for Child Care and Development Direct Services Contractors

Any EESD direct services contractor with hard copies of CEL applications must retain these records as stated in directive B above. After the required retention period, these records must be destroyed pursuant to directive C above.

For questions regarding:

  • Information security, please contact Mark Lourenco, Information Security Officer, Information Security and Privacy Office, Technology Services Division, by phone at 916-322-8334 or by e-mail at mlourenco@cde.ca.gov
  • Audits, please contact Derald Reisinger, Associate Management Auditor, External Audits Office, Audits and Investigations Division, by phone at 916-322-5053 or by e-mail at dreising@cde.ca.gov

This Management Bulletin is mandatory only to the extent that it cites a specific statutory and/or regulatory requirement. Any portion of this Management Bulletin that is not supported by a specific statutory and/or regulatory requirement is not prescriptive pursuant to California Education Code Section 33308.5.

Questions:   Early Education and Support Division | 916-322-6233
Last Reviewed: Monday, October 17, 2016
Recently Posted in Child Development
  • Management Bulletin 17-03 (added 14-Feb-2017)
    Management Bulletin 17-03 informs child care contractors and providers that a digital signature is considered a type of electronic signature.
  • Management Bulletin 17-04 (added 14-Feb-2017)
    Management Bulletin 17-04 informs child care contractors they are authorized to use digital signatures.
  • Plumas County LPC Priorities (XLS) (added 09-Feb-2017)
    Plumas County Local Planning Council Priorities Submission Form.
  • Electronic Submission of LPC Priorities (added 09-Feb-2017)
    Local Planning Councils (LPCs) are required to identify local priority areas for child care services by submitting priorities electronically.
  • Certification of LPC Priority E-Submission (PDF) (added 09-Feb-2017)
    Local Planning Councils (LPCs) are required to certify the accuracy of electronically submitted priorities for child care services with this document.

  • January 2017 Meeting Materials (added 01-Feb-2017)
    This page contains supplemental materials that were presented at the January 2017 State Advisory Council Meeting.
  • State Plan FFY 2016-18 CAP Approval Letter (PDF) (added 19-Jan-2017)
    A letter received on December 18, 2016 from the Administration of Children and Families that approves the California Department of Education's plan for corrective action.
  • CCDF State Plan FFY 2016-18 Corrective Action Plan (PDF) (added 19-Jan-2017)
    California's Corrective Action Plan for the Child Care and Development Fund Fiscal Year 2016-18 State Plan submitted by the California Department of Education on September 8, 2016.
  • CA-QRIS Certification Grant Webinar (added 18-Jan-2017)
    December 13, 2016, Guidance Webinar on the CA-QRIS 2016-17 Certification Grant.
  • CCDBG Stakeholder Input Session (added 12-Jan-2017)
    Webinar presented on November 1, 2016, of a topical input session to receive public and stakeholder input regarding development of the Child Care and Development Block Grant (CCDBG) 2017–18 Quality Improvement Expenditure Plan.