R277-487-12. Sharing Data With the Utah Registry of Autism and Developmental Disabilities

  (1) The Superintendent shall share personally identifiable student data with the Utah Registry of Autism and Developmental Disabilities as required by Subsection 53E-9-308(6)(b) through a written agreement designating the Utah Registry of Autism and Developmental Disabilities as the authorized representative of the Board for the purpose of auditing and evaluating federal and state supported education programs that serve students with autism and other developmental disabilities.

  (2) The agreement required by Subsection (1) shall include a provision that:

  (a) the Utah Registry of Autism and Developmental Disabilities may not use personally identifiable student data for any purpose not specified in the agreement;

  (b) the Utah Registry of Autism and Developmental Disabilities shall flag all student personally identifiable data received from the Board to:

  (i) ensure that the data is not used for purposes not covered by the agreement; and

  (ii) allow the Superintendent access to the data for auditing purposes;

  (c) the Utah Registry of Autism and Developmental Disabilities may redisclose de-identified data if:

  (i) the de-identification is in accordance with HIPPA's safe harbor standard;

  (ii) the de-identification is in accordance with Board rule; and

  (iii) the Utah Registry of Autism and Development Disabilities annually provides the Superintendent with a description and the results of all projects and research undertaken using de-identified student data; and

  (d) the Utah Registry of Autism and Developmental Disabilities shall allow an on-site audit conducted by the Superintendent to monitor for compliance with this rule no less than once per year.

  (3) The Superintendent shall maintain a record of all personally identifiable student data shared with the Utah Registry of Autism and Developmental Disabilities in accordance with 34 C.F.R. 99.32.

  (4)(a) A parent of a child whose personally identifiable student data was shared with the Utah Registry of Autism and Developmental Disabilities has the right to access the exact records disclosed.

  (b) A parent identified in Subsection (4)(a) has the right to contest and seek to amend, expunge, or destroy any data that is inaccurate, misleading, or otherwise in violation of the privacy rights of the student.