Interagency data sharing agreements: what to put in writing

Reference article · 5 min read

Requests to share data usually arrive informally. A county health department wants case records from social services. A school district wants address data to confirm residency. The technical work is often the easy part, and that is the risk: a file transfer can be stood up in an afternoon, well before anyone writes down what the receiving party may do with the data.

A data sharing agreement is what makes the disclosure defensible later, when a records request, an audit, or an incident brings it back up. It may be called a memorandum of understanding, a data use agreement, or a business associate agreement. The label matters less than whether the terms below appear in the text, and whether the signatures belong to people who can bind their organizations.

Name the legal authority for the disclosure

The agreement should state, in its recitals, the statute, regulation, or rule that permits the disclosure. A shared belief that sharing serves the public interest is not authority. Depending on the data, authority may come from the program's enabling statute, an exception in a state confidentiality law, a permitted disclosure under HIPAA, or FERPA provisions covering audit and evaluation or studies.

Some categories carry federal frameworks that travel with the data: criminal justice information under the FBI CJIS Security Policy, federal tax information under IRS Publication 1075, substance use disorder treatment records under 42 CFR Part 2, motor vehicle records under the Driver's Privacy Protection Act. These requirements are revised over time, and state law often adds conditions on top. Counsel in your own state confirms the authority before signature, and can phrase it for the document.

Purpose limitation and the exact fields

Two clauses do most of the work: what the recipient may do with the data, and what the recipient actually receives.

• Purpose. State the permitted use narrowly, and require a written amendment for any other use. Language such as "program administration and related purposes" gives away control that is hard to recover.
• Data elements. Attach a field level appendix listing every element by name with a short description. If direct identifiers are not needed for the purpose, leave them out. A smaller dataset is easier to defend and cheaper to protect.
• Derived data. Whether the recipient may keep matched or derived datasets, whether findings may be published, and what small cell suppression rules apply.

Transfer method, frequency, and format

• Method. The named channel, such as managed file transfer, SFTP with key based authentication, or an authenticated API. Say plainly that email attachments and consumer file sharing links are not permitted.
• Encryption. Required in transit and at rest, referencing a recognized standard rather than a product name.
• Frequency. One time extract, nightly batch, or on demand, with the expected window and who is notified when a run fails.
• Format and schema. File layout, code sets, null handling, and a notice period before either side changes the schema.

Security, access, and breach notification

• Security baseline. Point to a recognized framework, or to the federal policy that already applies to the data type, instead of drafting controls from scratch.
• Access limits. Least privilege, named roles, and a list of authorized users the recipient maintains and produces on request, plus any background check or training the data type requires.
• Subcontractors and hosting. Whether subcontractors or cloud hosting are allowed, whether the same obligations flow down, and what notice is required.
• Breach notification. Define what counts as an incident, set a clock in hours rather than "promptly," specify what the notice must contain, and state who notifies affected individuals. State breach notification laws differ on timing and content, so counsel should reconcile the clause with the laws applying to both parties.

Retention, destruction, and redisclosure

• Retention. Tie the period to the stated purpose. Once data sits with the receiving agency, that agency's own records retention schedule may attach to it.
• Destruction. The method, and a certification delivered after termination or after the purpose is met.
• Redisclosure. Prohibited by default without written consent, with a narrow carve out for legally compelled disclosure and notice to the originating agency where notice is permitted.
• Public records requests. What each party does when a request covers the shared data: notify the originating agency, let it identify applicable exemptions, and coordinate the response.

Audit rights, term, and termination

• Audit. The right to request documentation, review access logs, or conduct a review on reasonable notice, and who bears the cost.
• Term. A fixed end date rather than an evergreen agreement, renewed by written amendment. Fixed terms force a periodic look at whether the sharing is still needed.
• Termination. For convenience on notice, and immediately for misuse or material breach, with confidentiality, destruction, and audit obligations surviving.
• Liability. Handle as counsel directs, since indemnification between public agencies is limited by state law and is often rewritten.

How to get one moving

1. Write the business question first. If the requester cannot say what decision the data supports, the field list will be too broad.
2. Have the program owner and counsel settle authority before technical design starts.
3. Build the field appendix with the data steward, and send the transfer method and receiving environment to security for review.
4. If a vendor builds or hosts either side of the transfer, put matching obligations in that contract: breach notice timing, subcontractor limits, and destruction of data at the end of the term.
5. Keep an inventory of active agreements with expiration dates, contacts, and field appendices, so renewals and terminations do not slip.

HQT works with state and local agencies on the systems behind these agreements: secure transfer, logging, and the access controls a signed agreement assumes are in place.

Frequently asked questions