Restricted-Use Data Procedures Manual

1 Restricted-Use data Procedures Manual Department of education Institute of education Sciences national center for education statistics IES data Security Office 550 12th Street, SW Washington, DC 20202 Acrobat PDF Version August 20112 Publication Information Department of education Arne Duncan Secretary Institute of education Sciences John Q. Easton Director national center for education statistics Jack Buckley Commissioner The national center for education statistics (NCES) is the primary federal entity for collecting, analyzing, and reporting data related to education in the United States and other nations. It fulfills a congressional mandate to collect, collate, analyze, and report full and complete statistics on the condition of education in the United States; conduct and publish reports and specialized analyses of the meaning and significance of such statistics ; assist state and local education agencies in improving their statistical systems; and review and report on education activities in foreign countries.

2 NCES activities are designed to address high priority education data needs; provide consistent, reliable, complete, and accurate indicators of education status and trends; and report timely, useful, and high quality data to the Department of education , the Congress, the states, other education policymakers, practitioners, data users, and the general public. We strive to make our products available in a variety of formats and in language that is appropriate to a variety of audiences. You, as our customer, are the best judge of our success in communicating information effectively. If you have any comments or suggestions about this or any other NCES product or report, we would like to hear from you. Please direct your comments to: national center for education statistics Institute of education Sciences Department of education 550 12th Street, SWWashington, 20202 The NCES Home Page is: Printed April 1996 (NCES publication number: 96860rev) Reprinted October 1999 Acrobat PDF Version August 2011 Content Contact: 3 Restricted-Use data Procedures Manual This Manual will be provided to organizations interested in obtaining Restricted-Use data , and to licensed organizations who currently have access to Restricted-Use data .

3 The goal is to maximize the use of statistical information, while protecting individually identifiable information from disclosure. The Restricted-Use data Procedures Manual was created to provide a guide to the Restricted-Use data application process, as well as to explain the laws and regulations governing these data . We hope that this Manual answers any questions or concerns you may have regarding obtaining access to Restricted-Use data . IMPORTANT This Manual serves as a Procedures guide, but it does not replace the provisions of theactual License document and the required security Procedures . The licensee is responsible for all terms and provisions within the License and therequired security Procedures . Under no circumstances may the database be removed or telecommunicated from thelicensee's site. Licensees are subject to unannounced, unscheduled inspections to assess compliance withsecurity requirements. Violations of the education Sciences Reform Act confidentiality provisions incorporatedin the License document are subject to a class E felony and can be imprisoned up to fiveyears, and/or fined up to $250, Table of Contents Page Introduction 7 Restricted-Use data 7 Public-Use data 7 Overview of Laws 7 Licensing Procedures 7 Security Procedures 8 On-Site Inspections 8 Laws 9 Basic Statutes 9 Privacy Act of 1974 9 Privacy Standards 9 Computer Security Guideline 9 E-Government Act of 2002, Title III, Federal Information SecurityManagement Act (FISMA)9 education Sciences Reform Act of 200210 Confidentiality Standards10 Violations10 USA Patriot Act of 200110 E-Government Act of 200211 Licensing Procedures 12 What data Are Licensed 12 Only Restricted-Use data Are Licensed 12 Available Restricted-Use Databases 12 What is a License?

4 12 Memorandum of Understanding 12 License 12 Contracts 13 Content of License Documents 13 Who Needs a License Document 13 Matching Organizations to License Documents 13 Restricted-Use data and IES Staff 14 Pre-test Monitoring 14 Contractors 14 Applying for a License 15 Summary of Procedures 15 Formal Request 15 License Document 17 Affidavits of Nondisclosure 17 Security Plan Form 18 Receiving the Requested Materials 18 5 Page Required Licensee Activity 19 Maintaining the License File 19 Submitting Research Publications 20 Passing On-Site Inspections 20 Outside Requests for data 20 Amending a License 21 Add User Amendment 21 Delete User Amendment 22 Add Database Amendment 22 Modify Security Plan Amendment 23 Extend License Amendment 23 Close-Out License Amendment 24 Applicant/Licensee Record 25 Security Procedures 28 Introduction 28 Basic Statutes 28 IES Statutes 28 Other Statutes 28 Risk Management 29 General Security Requirements 29 Assign Security Responsibilities 29 Complete Security Plan Form 30 Restrict Access to data 30 Use data at Licensed Site Only 30 Respond to Outside Request for Subject data 31 Return Original data to IES 31 Physical Handling, Storage, and Transportation 31 Protect Machine-Readable Media and Printed Material 31 Avoid Disclosure from Printed Material 31 Edit for Disclosures 32 Only One Backup Copy 32 Limit Transporting of data 32 Computer Security Requirements 32 Standalone Computer 33 Limit Room/Area Access 33 Standalone Desktop Computer Security Model 33 Passwords 33 Notification (Warning Screen)

5 34 Read-only Access 34 No Connections to Another Computer 34 Lock Computer and/or Room 35 Automatic Shutdown of Inactive Computer 35 Do Not Backup Restricted-Use data 35 6 Staff Changes 35 Overwrite Hard Disk data 35 License User Training 36 On-site Inspections 37 On-Site Inspection Procedures 37 License Procedures 37 Security Procedures and Security Plan Form 37 On-Site Inspection Guideline 38 Violations, Penalties, and Prosecution 38 Violations 38 List of Most Common Violations 39 Prosecution and Penalties 39 Page Appendices Appendix A Definition of Terms 40 Appendix B Public-Use data 43 Appendix C Privacy Act of 1974 44 Appendix D IES-Specific Laws 45 Appendix E Memorandum of Understanding 48 Appendix F License Document 49 Appendix G Affidavit of Nondisclosure 50 Appendix H Restricted-Use Databases 51 Appendix I Availability of Restricted-Use data 52 Appendix J Security Plan Form 53 Appendix K On-Site Inspection Guideline 54 Appendix L E-Government Act of 2002, Title V, Subtitle A, Confidential 55 Information Protection Appendix M Close-out Certification Form 56 7 Introduction Restricted-Use data The Institute of education Sciences (IES) collects survey and research data containing individually identifiable information, which is confidential and protected by federal law.

6 IES uses the term " Restricted-Use data " for such information. The terms Restricted-Use data and "subject data " are synonymous. (See Appendix A, Definition of Terms.) Public-Use data IES uses the term "public-use data " for survey data when the individually identifiable information has been coded or deleted to protect the confidentiality of survey respondents. Access to public-use data does not require a license, for these data are available to the general public. For more information on public-use data , see NCES online catalog at . Overview of Laws The relevant laws about survey data that contain individually identifiable information are found in the following statutes. More information on these laws is in Chapter 1: The Privacy Act of 1974 and the Computer Security Act of 1987 provide for the securityand privacy of personal data maintained by the federal government. These laws pertain toall Restricted-Use data . Unlawful disclosure is a misdemeanor and is subject to a fine up to$5,000.

7 The E-Government Act of 2002, Title V, subtitle A, Confidential Information Protectionmandates the protection of individually identifiable information that is collected by anyfederal agency for statistical purposes. Unauthorized disclosure of these data is a class Efelony, punishable by up to five years in prison, and/or a fine up to $250,000. The USA Patriot Act of 2001 amended NESA 1994 by permitting the Attorney Generalto petition a judge for an ex parte order requiring the Secretary of the Department ofEducation to provide NCES data that are identified as relevant to an authorizedinvestigation or prosecution of an offense concerning national or international terrorismto the Attorney General. The education Sciences Reform Act of 2002 requires IES to collect, analyze, anddisseminate education data and to protect the confidentiality of individually identifiableinformation. An unauthorized disclosure is a class E felony, punishable by up to fiveyears in prison, and/or a fine up to $250, Procedures IES will lend Restricted-Use data only to qualified organizations in the United States, using a strict licensing process described in Chapter 2.

8 Individual researchers must apply through an organization ( , a university or a research institution). To qualify, an organization must submit: An online Formal Request through the NCES electronic application system, see: , a signed License document (see Appendix F),8 executed Affidavits of Nondisclosure (see Appendix G), and a signed Security Plan Form (see Appendix J).Security Procedures Restricted-Use data must be kept secure at all times. Secure means that the data are protected from unauthorized access or disclosure in accordance with the terms of the License and the specified security Procedures outlined in the Security Plan Form. The security Procedures described in Chapter 3 include the computer security requirements for the standalone, desktop computer configuration. On-Site Inspections Under the terms of the License, IES has the right to conduct unannounced, unscheduled inspections of the data user's site to assess compliance with the terms of the License and the required security Procedures .

9 The inspection Procedures are described in Chapter 4. 9 Chapter 1: Laws Basic Statutes The protection of survey databases that contain individually identifiable information is founded on the following statutes: Privacy Act of 1974, E-Government Act of 2002, Title III, Federal Information Security Management Act (FISMA), education Sciences Reform Act of 2002, USA Patriot Act of 2001, and E-Government Act of Privacy Act of 1974 The Privacy Act of 1974 states that federal agencies are required "to collect, maintain, use, or disseminate any record of identifiable personal information in a manner that adequate safeguards are provided to prevent misuse of such information." To do this, the law protects the privacy of personal data maintained by the federal government. It imposes numerous requirements upon federal agencies to safeguard the confidentiality and integrity of personal data , and puts limits on the use of the data .

10 (For the full text of the law, see Appendix C.) Privacy Standards Under the direction of the Office of Management and Budget, federal agencies issue policies, standards, and guidelines for protecting personal data under this law. Computer Security Guideline A key standard for this law is the Federal Information Processing Standard Publication (FIPSPUB) 41, Computer Security Guidelines for Implementing the Privacy Act of 1974. FIPSPUB 41 provides guidance to ensure that government-provided individually identifiable information is protected in accordance with federal statutes and regulations. E-Government Act of 2002, Title III, Federal Information Security Management Act (FISMA) The law is enacted to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets." FISMA requires each agency to develop, document, and implement an agencywide information security program providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of (i) information collected or maintained by or on behalf of the agency; and (ii) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.