A data sharing agreement checklist for agencies exchanging records

Reference article · 8 min read

Use this checklist when your agency is preparing to send records to another agency, receive records from one, or renew an exchange that is running on an old memorandum. Work through it with the three groups that each hold part of the answer: program staff, counsel, and IT.

A usable result is an agreement that a new employee could pick up two years from now and understand: which records move, under what authority, for what purpose, to whom, how they are protected, how long they are kept, and how the exchange ends. Mark each item yes, no, or not applicable. If an item does not apply, write one line saying why.

Authority and purpose

• The agreement cites the disclosing agency's authority to disclose and the receiving agency's authority to receive. Both citations appear in the document, not only in email. If neither side can produce a citation, stop drafting and send the question to counsel with a description of the records and the intended use.
• The stated purpose is specific enough to test a later request against. "Evaluation of outcomes for the shared caseload" can be applied to a new request; "improving services" cannot. If the purpose reads like a mission statement, rewrite it as the decision or analysis the data supports, and list the uses that are out of scope.
• Every confidentiality rule that follows these particular records is listed. Education records, health information, substance use disorder treatment records, criminal justice information, driver and motor vehicle records, and tax information are each governed by their own federal or state rules, and a single extract can carry more than one. If the list names fewer regimes than the source systems the extract is pulled from, go back to the system owners and ask what governs each field.
• The instrument matches what the governing rules expect, and the signers can bind their agencies. Some frameworks call for a specific document, such as a business associate agreement under health privacy rules, a data use agreement for a limited data set, or a management control agreement where a non-criminal-justice agency administers criminal justice information. If you are not sure which applies, ask counsel before drafting goes further, and confirm whether a board, council, or state-level approval is required so it can be put on a calendar.
• The agreement says how each party handles a public records request for the shared data. Whether an exemption follows a record into the receiving agency's files depends on state law. If the agreement is silent, add a clause requiring each party to notify the other before releasing shared records to a requester, and ask counsel how your state treats the exemption.

What data moves

• The data elements are listed field by field in an appendix. A named field list can be reviewed later; a category such as "case data" cannot. If no list exists, ask the system owner for the extract layout or file specification and attach it to the agreement.
• The identifiers included are limited to what the purpose requires. Ask whether de-identified records, aggregate counts, or a match result returned without identifiers would answer the question. If full identifiers are included because that is how the extract has always run, remove the ones the purpose does not need and document the decision.
• The record population is defined, including known gaps. Which cases, which date range, which jurisdictions, which statuses, and what the extract leaves out. If nobody can describe the population, ask the system owner to document the query criteria before the first transfer, because otherwise the population is whatever the first query happened to return.
• Direction, frequency, and transfer method are stated. A one-time extract, a recurring scheduled transfer, and a live interface carry different obligations. If the agreement only says that data will be shared, add the direction of each flow, the schedule, and the mechanism.
• Derived products are addressed. Matched files, analytic data sets, dashboards, and published reports. If the agreement is silent on derived products, add a clause stating which of them the terms cover, whether the disclosing agency reviews anything before publication, and how long derived copies may be kept.
• A retention period and a disposition method are stated. Check the records retention schedules of both agencies, since the receiving agency may have one that applies to its copy. If no period is stated, propose the shortest period that supports the purpose and have the records officer on each side confirm it in writing.

Security, access, and redisclosure

• The transfer method and the storage protections are both named. For example, a managed file transfer service or an authenticated interface rather than email attachments, encryption in transit and at rest, and the specific system where the data will live. If copies may reach laptops or analyst workspaces, write down how those copies are protected, or prohibit them.
• Access is limited to named roles, reviewed on a stated schedule, and conditioned on any required screening and training. Some frameworks require particular background screening or training before access is granted. If access is written as an entire department or a shared account, replace it with a role list and name the person on each side who maintains it.
• Subcontractors and hosted services are disclosed, and the same obligations flow down to them. A vendor platform or cloud service holding the data is part of the arrangement. If the receiving agency will not name its subcontractors, ask for notice before a new one is added and add a flow-down clause that applies the same terms to them.
• Access logging and audit rights are written in. The receiving agency logs access to the shared data, and the disclosing agency can request an accounting or a review. If neither appears in the draft, add a logging obligation and an audit right that states the notice period and who bears the cost.
• Redisclosure is prohibited except for the disclosures the agreement lists. Name the permitted onward disclosures, and require prompt notice when disclosure is compelled by subpoena or court order so the disclosing agency can respond. If redisclosure is unaddressed, add the clause; if the other party wants an exception, have it describe the recipient and the purpose in writing before you agree.
• Incident notification names who is notified, by what channel, within what period, and who tells affected individuals. Deadlines vary by state breach notification law and by sector-specific rules. If the draft says only that notice will be prompt, ask counsel which timeframes apply to these records, write them in, and name a contact on each side.

Running it and ending it

• Each side lists a business contact and a technical contact, by role and by name, with a duty to keep the list current. If the agreement has no contact list, add one as an appendix that can be updated without amending the whole agreement, and set a date for the first review.
• Cost responsibility is written down. Extract development, interface build, ongoing support, and any cost recovery permitted by law or policy. If costs are unstated, get an estimate from the system owner and settle who pays before signature, since unfunded work sits in a queue.
• The agreement says how requests from individuals are handled. Access and correction rights under applicable law, which agency answers the request, and how a correction made in the source system reaches the copy. If the copy cannot be corrected in place, require a scheduled refresh or a documented process for replacing it.
• Term, renewal, termination, and amendment are defined. Include an end date, the notice required for termination, a right to suspend the exchange on evidence of misuse, and a requirement that changes in scope be made in writing. If the draft carries the other party's risk and indemnification language, send those clauses to your risk manager before signature rather than accepting the form as written.
• Return or destruction at the end is specified, with a deadline and written certification. Cover backups, derived files, and copies held by subcontractors. If the draft has no return or destruction clause, add one and name the official who signs the certification.

What to do with the results

Sort every no into one of three piles. Legal questions go to counsel with the item, the records involved, and the purpose. Technical questions go to the system owners on both sides with a date for an answer. Missing text goes back to the drafter as proposed language rather than as a comment. Anything still unresolved at signature belongs in the agreement as an open item with a named owner and a due date.

Keep the completed checklist in the agreement file. Run it again at renewal, and again whenever someone asks to add a field, change the frequency, or extend access to a new group.

Frequently asked questions