Integrated Data for Child Welfare
A county human services agency, a hospital system, and a school district operate an integrated data warehouse covering 210,000 children. The warehouse holds 47 elements, including mental-health diagnoses, attendance, child-welfare referrals, and Medicaid eligibility. Consent is collected at intake on a paper form that mentions 'service coordination.' The data-sharing agreement expires in 30 days. A match-rate audit finds 12% of records cannot be reliably linked. A reporter requests the 'predictive risk scores' used to prioritize caseworker visits. The warehouse vendor stores backups in an offshore cloud region; three caseworkers were recently found to have looked up records of neighbors. The county has no data governance charter, but the board wants a dashboard within 60 days. The privacy officer is part-time.
1. Identify the highest-risk governance gaps and recommend a sequence of controls.
Read the worked answer
Highest-risk gaps. Consent is not informed-'service coordination' does not cover mental-health diagnoses or school attendance. A 12% match failure means the warehouse may attribute records to the wrong child. Offshore backups create cross-border transfer and breach-notification issues. Snooping shows access controls and audit review are weak. No governance charter means no decision rights.
Sequence. Freeze new data feeds except critical ones. Commission a matching audit with manual review for unresolved links. Rewrite consent and notice in plain language. Implement role-based access, unique IDs, and monthly audit logs with sanctions. Amend the vendor contract for data location, encryption, breach notice, and return or destruction. Stand up a governance council with privacy, legal, program, and community representation. Do not launch the dashboard until matching and consent are fixed, because a public dashboard amplifies any error. This order protects children first, then satisfies the board's 60-day request with defensible data.
2. How should the county respond to the reporter's request for predictive risk scores while preserving transparency?
Read the worked answer
The risk scores are records, but releasing them may disclose personal information and proprietary methodology. First, determine whether the scores are used as the sole basis for caseworker visits; if so, due-process and fairness concerns require explainability. Release the methodology, validation results, input variables, and aggregate performance-not child-level scores. If the reporter seeks individual scores, apply exemptions for personal privacy and, if applicable, deliberative or proprietary material, but do not blanket-deny. Provide a public explainer: what the score predicts, error rates, and how families can correct data. That satisfies transparency while limiting re-identification. The board should also be told that a dashboard built on 12% mismatched data will misstate performance.
3. What terms should the new data-sharing agreement include, and what access rules should apply to caseworkers?
Read the worked answer
Agreement terms. Purpose limitation (eligibility, service coordination, case review), data minimization (reduce 47 elements to those necessary), retention schedule, security standards, breach notification within 24-72 hours, audit rights, no offshore storage without approval, return or destruction at termination, and a dispute-resolution clause. Require a data protection impact assessment before adding new feeds. Include community and school-district representatives in governance.
Access rules. Least privilege, unique credentials, mandatory training, just-in-time access for sensitive fields, and quarterly access recertification. Log every lookup and review anomalies monthly. Because the agreement expires in 30 days, extend under current terms only with a security addendum while the new agreement is negotiated; do not let expiration force a lapse in necessary services.