Data sharing agreements in Massachusetts

Find out more about the Massachusetts data sharing framework

A framework for better data sharing

The Commonwealth's data sharing framework is designed to ensure data is shared securely and deliberately between state agencies to drive better-informed decision-making. The data sharing framework aims to: 

1. Streamline the process of sharing protected data between state entities.  
   1. Protected data is data that includes personal data, personally identifiable information, or other protected information that is restricted in use or disclosure under federal or state law or regulation. The Framework only applies to protected data. 
2. Use collected data as an asset to improve operations, services, and policy across the state. 
3. Open up opportunities to collaborate across Secretariats on service-enhancing and cost-saving initiatives. 

Overview of the data sharing framework

The data sharing framework is built on three pillars: 

The Memorandum of Understanding (MOU) 

• The Data Sharing Memorandum of Understanding (MOU) is a statewide agreement signed by 69 executive branch offices, agencies, and quasi-independent agencies.  
• It broadly defines the expectations, rules, and processes around data sharing.
• All participating agencies are bound by the MOU and required to use the DULA template and electronic signature process. 
  • Any data sharing agreements in effect now must be moved into this framework when it comes time to renew them.

The Data Use License Agreement (DULA) 

• State agencies use the DULA to agree on the terms and details of data-sharing for a particular purpose or project, and to ensure that all relevant laws and regulations are followed in the process.  
• The agreement is between a data owner and a data recipient(s), specifying the details of how data will be shared for the intended purpose/project. 
• The DULA is required any time data containing personally identifiable information (PII), or other protected information is shared between state agencies.   
  • PII is defined by the National Institute for Standards and Technology (NIST) as any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. 
• DULAs must be processed through the Massachusetts Data Office by the participating agency’s Data Sharing Coordinator. 

The Data Leadership Council 

• The Council implements and manages the MOU and facilitates data sharing among those who sign on to it.  
• The members of the Data Leadership Council include representatives from each Secretariat, plus the Governor's Office. Members are appointed by their office's Secretary, or for the Governor's Office, the Governor. 
• The chair of the Council is the Commonwealth’s Chief Data Officer, who sits in the Executive Office of Technology Services and Security. 
• The Council is presently re-evaluating and updating the MOU to further streamline and modernize the data sharing process.

Read the MOU 

How to complete the data sharing process

Details of the data sharing process

Understand data owners vs. data recipients. 

An agency that will receive data from another agency for a particular use is called the data recipient (or Receiving Party in the MOU). The agency that provides the data is called the data owner. Suppose Agency A has a question or project that requires data from another agency. (Or, Agency A and B, working together, would both like this data for a shared project.)

Agency C has the data they need. (Or, maybe Agency C and D both have data required for the project.) 

• Agency A and B are the data recipients. 
• Agency C and D are the data owners. 

It’s possible agencies could be both at the same time. For example, Agency A sends a list of program applicants to Agency B, which returns a piece of data about each of the participants to Agency A to determine program eligibility.

The data recipient initiates the process.  

• They have the question or project.
• They know what data they want. 
• They identify the data owners.  
• Their data sharing coordinator reaches out to the owner’s data sharing coordinator. 
  • Find data sharing coordinators’ contact information. 

Data sharing coordinators determine viability. 

• The data sharing coordinators determine whether the data in question can be shared, reaching out to legal or other personnel in their agency as needed. 
• They initiate the DULA process. 

The DULA process begins. 

• The data sharing coordinator gathers the relevant parties to draft and review the DULA: 
  • Legal staff 
  • Technical staff 
  • Staff who know the data well 
  • Stakeholders interested in the outcome of the project 
• A staff member from each agency (data receiving and data owning) co-creates the DULA draft and circulates it for review. 
• Each data recipient and data owner appoints a DULA manager, who will ensure compliance with the agreement after it’s executed, and a signatory for the agreement. (The signatory must have official signing power for the agency.) 
• Once the DULA draft is final, the data sharing coordinator from either agency (owning or receiving) submits a ServiceNow request to the Data Office to get the DULA set up and signed digitally. 
  • Only one ServiceNow request is necessary. 
  • Once the agreement is executed, the signatories, DULA managers, drafters, and data sharing coordinators will receive copies for their records. 
  • A copy will be kept in the central Data Sharing repository.     

Reach out to the Data Office for help at any point in the data sharing process, before or after the agreement is signed, by submitting a request to ServiceNow.