Skip to content
Printer-friendly version

Management Bulletin 11-20


Early Education and Support Division

Subject: Centralized Eligibility List Data: Security and Confidentiality Requirements Number: 11-20
Authority: California Education Code, Section 8227; California Code of Regulations, Title 5, Section 18117; and California Civil Code, Section 1798.80–1798.84

Date: June 2011

Expires: Until Rescinded

Attention: All County Centralized Eligibility List Administrators and All Executive Officers and Program Directors of All Child Care and Development Programs

Purpose

The purpose of Management Bulletin (MB) 11-20 is to provide Centralized Eligibility List (CEL) Administrators and child care and development contractors with requirements for data security and confidentiality.

Background

In May 2011, the California Department of Education (CDE), Early Education and Support Division (EESD) posted MB 11-15, which provided direction to CEL administrators on the actions that had to be taken due to the elimination of state funding for the CEL. This MB required CEL Administrators to:

The EESD posted MB 11-16, which provided direction on the actions that must be taken by direct service contractors currently participating in the CEL.

Policy

5 CCR, Section 18117 requires contractors to ensure that the use or disclosure of all information pertaining to the child and his/her family is restricted to purposes directly connected with the administration of the subsidized child care program.

California Civil Code, Section 1798.80–1798.84 requires that personally identifiable student level data no longer needed, or relevant, is destroyed. All reasonable steps must be taken to dispose, or arrange for the disposal, of records containing personal information when the records are no longer to be retained by:

Further information on security laws can be found on the California Office of Information Security Web Page External link opens in new window or tab. .

Directive
A. Directives for CEL Administrators Regarding Disposition of Equipment Containing Confidential, Sensitive or Personally Identifiable Data

Before transferring or disposing of equipment, CEL administrators must remove all confidential, sensitive or personal information from all equipment/media including computers, storage components, and removable storage equipment. This would include using a disk wipe utility or physical device (such as degausser) to fully erase confidential data prior to the disposal, or transfer of any equipment containing a hard drive, removable media, or any media with data storage capabilities.

B. Directives for CEL Administrators Regarding Storage of Program Data During Retention Period

CEL Administrators must ensure that all program operating records, including hard copies of CEL applications, that must be retained for a minimum of five years in accordance with EC, Section 33421 and 5 CCR, Section 18067 are stored in safe secure manner.

During the five year retention period, all program operating records with confidential information in paper form should be kept in a locked location, and all program operating records with confidential information in electronic form should only be accessible by authorized users. Preferably, any confidential information in electronic form should also be encrypted.  

C. Directives for CEL Administrators Regarding Destruction of Program Data Following Retention Period

CEL Administrators must destroy all program operating records, including hard copies of CEL applications after the five year retention period if no litigation, claim, or audit was started before the expiration of the five-year period.

If there was any litigation, claim or audit started before the expiration of the five-year period, the records shall be retained until all litigation, claims or audit findings involving the records have been resolved and final action taken in accordance with EC, Section 33421 and 5 CCR, Section 18067. After that the records should be confidentially destroyed.

D. Directives for Child Care and Development Direct Services Contractors

Any EESD direct services contractor with hard copies of CEL applications must retain these records as stated in directive B above. After the required retention period, these records must be destroyed pursuant to directive C above.

For questions regarding:

This Management Bulletin is mandatory only to the extent that it cites a specific statutory and/or regulatory requirement. Any portion of this Management Bulletin that is not supported by a specific statutory and/or regulatory requirement is not prescriptive pursuant to California Education Code Section 33308.5.

Questions:   Early Education and Support Division | 916-322-6233
Download Free Readers