651 CMR 16.00 — Home care worker registry

651 CMR: DEPARTMENT OF ELDER AFFAIRS 651 CMR 16.00:HOME CARE WORKER REGISTRY Section 16.01: Scope and Purpose 16.02: Definitions 16.03: Functions and Responsibilities of EOEA 16.04: Functions and Responsibilities of HCW Agencies 16.05: Functions and Responsibilities of ASAPs 16.06: Home Care Worker Data 16.07: Implementation, Maintenance, and Data Submission 16.08: Registry Access 16.09: Records 16.10: Compliance

651 CMR 16.00 Home care worker registry

16.01 Scope and Purpose

16.01: Scope and Purpose 651 CMR 16.00 sets forth the requirements for the creation, implementation, and administration of the Home Care Worker Registry in accordance with the provisions of St. 2017, c. 139.

16.02 Definitions

16.02: Definitions As used in 651 CMR 16.00, these terms shall have the following meanings: Aging Services Access Points (ASAPs). Locally based private, nonprofit entities which contract with EOEA to provide community based services to eligible elders under M.G.L. c. 19A, § 4B. Commonwealth Security Information. All data pertaining to the security of the Commonwealth’s information technology systems; specifically, information related to the manner in which the Commonwealth protects its information technology systems against unauthorized access to or modification of information contained therein, whether in storage, processing or transit, including the denial of service to unauthorized users, or the provision of service to authorized users, as well as measures undertaken to monitor, detect, document and counter such threats. Domestic Violence. As provided in M.G.L. c. 209A, § 1. Employee Organization. A labor union or other organization, agency or employee representation committee, association, group, or plan in which employees participate and which exists in whole or in part to deal with employers concerning matters incidental to employment relationships. EOEA. The Executive Office of Elder Affairs, an administrative agency established under the authority of M.G.L. c. 19A. General Protection Order. An injunction or other order issued by a Massachusetts court, a court of another state, territory or possession of the United States, the Commonwealth of Puerto Rico, or the District of Columbia, or a tribal court, issued for the purpose of preventing violent or threatening acts. Harassment Prevention Order. An injunction or other order issued by a Massachusetts Court pursuant to M.G.L. c. 258E. Holder. An entity or individual which collects, uses, maintains, disseminates, or receives HCW Data pursuant to these regulations. Home Care Program. A program of home care services for Elders operated by the Commonwealth under M.G.L. c. 19A, § 4 and pursuant to the requirements of 651 CMR 3.00: Home Care Program. Home Care Program Services. The services provided by the Home Care Program through funds administered by EOEA including, but not limited to, personal care, homemaker, companion, and chore services provided. (Mass. Register #1394 6/28/19)

651 CMR: DEPARTMENT OF ELDER AFFAIRS

16.02 continued

16.02: continued Home Care Worker (HCW). A person employed by an HCW Agency to provide Home Care Program Services through the Home Care Program established under M.G.L. c. 19A, § 4. Home Care Worker Agency (HCW Agency). An entity employing Home Care Workers to provide services through the Home Care Program established under M.G.L. c. 19A, § 4 pursuant to a contract with an ASAP. Home Care Worker Data (HCW Data). Information and/or any Personal Data relating to an HCW collected in accordance with 651 CMR 16.00 for the purposes of establishing and maintaining the Registry. Home Care Worker Registry (Registry). The Home Care Worker Registry as established under St. 2017, c. 139. Personal Data. Any information concerning an individual, including identifying number, mark or description which can be readily associated with a particular individual. Protective Order. An injunction or other order issued by a Massachusetts Court pursuant to M.G.L. c. 209A. Public Records. As provided in M.G.L. c. 4, § 7(26). Rape. As provided in M.G.L. c. 265, §§ 22, 22A and 23 and M.G.L. c. 272, §§ 2, 4 and 17. Sexual Assault. As provided in M.G.L. c. 265, §§ 13B, 13F, 13H, 24 and 24B and M.G.L. c. 272, §§ 4A, 17, 29A, 29B and 35A. Stalking. As provided in M.G.L. c. 264, § 43.

16.03 Functions and Responsibilities of EOEA

16.03: Functions and Responsibilities of EOEA (1) Home Care Worker Registry. EOEA shall: (a) Establish and maintain a Registry of HCW Data submitted by HCW Agencies in accordance with 651 CMR 16.00. (b) Collect information from ASAPs necessary to identify all HCW Agencies subject to 651 CMR 16.00, notify said HCW Agencies, and coordinate the submission of HCW Data for inclusion in the Registry. (c) Aggregate HCW Data, conduct routine HCW Data matches in an effort to reduce duplicate records, and assign a unique numerical identifier to each HCW. (d) Determine and communicate HCW Data submission schedules to relevant parties, and collect and update HCW Data on a quarterly basis. (e) Provide access to the Registry in accordance with the provisions of 651 CMR 16.00. (2) Notices and Forms. EOEA shall: (a) Create and make available written notices detailing the nature of the Registry and the exemption process. (b) Conduct outreach with relevant community and industry organizations to help inform HCWs about the Registry and their rights and obligations.

16.04 Functions and Responsibilities of HCW Agencies

16.04: Functions and Responsibilities of HCW Agencies HCW Agencies shall: (1) Designate an employee to work with EOEA for the purpose of complying with the requirements of 651 CMR 16.00. (2) Provide EOEA written notices to all employees subject to 651 CMR 16.00 and inform them about the Registry and their rights and obligations.

651 CMR: DEPARTMENT OF ELDER AFFAIRS

16.04 continued

16.04: continued (3) Inform and provide training to HCWs regarding the exemption process set forth in 651 CMR 16.06(3), and ensure HCWs have access to the exemption process as necessary. (4) Attest to EOEA that the HCW Agency has complied with the HCW written notice and exemption requirements established under 651 CMR 16.00. (5) Submit all non-exempt HCW Data to EOEA in a timely manner using the file data structure identified by EOEA, and submit it to EOEA using an EOEA-approved method, such as secure email or SFTP. (6) Attest to EOEA that the HCW Data submitted to EOEA is current and accurate. (7) Ensure HCWs do not face adverse employment consequences as a result of their participation in the Registry or claim of exemption. (8) Ensure HCWs do not bear any cost related to the implementation or maintenance of the Registry. (9) Create, maintain and retain all relevant records necessary to comply with 651 CMR 16.00.

16.05 Functions and Responsibilities of ASAPs

16.05: Functions and Responsibilities of ASAPs ASAPs shall: (1) Submit to EOEA the contact information for all HCW Agencies with whom ASAPs have contracted to provide Home Care Services. (2) Provide written notification to each HCW Agency with whom ASAPs have contracted regarding the implementation and maintenance of the Registry and the requirements of 650 CMR 16.00.

16.06 Home Care Worker Data

16.06: Home Care Worker Data (1) Data Elements. (a) HCW Agencies shall collect the following information from all nonexempt HCWs employed by the HCW Agency on a paid, unpaid, temporary, or permanent basis:

1. full name;
2. gender;
3. home address;
4. mailing address;
5. the full legal name of any Home Care Worker Agency employing the home care worker;
6. the worker’s job title; and
7. a list of any home care trainings or certifications completed by the home care worker. (b) To comply with the requirements of the Registry, an HCW may opt to submit a residential address, mailing address or address assigned to them as a qualified individual by the Address Confidentiality Program administered by the Secretary of the Commonwealth in accordance with M.G.L. c. 9A. (2) Required Safeguards. (a) HCW Agencies, Employee Organizations, or ASAPs collecting or accessing HCW Data shall develop, implement and maintain an information security program to safeguard the confidentiality, integrity and availability of HCW Data. An information security program must, at a minimum, address the following:
8. Safeguards to protect the administrative, physical and technical security of the HCW Data including, but not limited to, encrypting the data in transmission and at rest, providing secure hashed passwords to access systems containing HCW Data, monitoring information systems to ensure no inappropriate access occurs, provisioning access on an as-necessary basis, and limiting access to locations where information is used, processed, or stored;

651 CMR: DEPARTMENT OF ELDER AFFAIRS

16.06 continued

16.06: continued 2. Ongoing monitoring of safeguards to ensure the security of HCW Data; 3. Staff training with respect to information security, the safeguards and secure data handling of the HCW Data; 4. Ensuring that terminated employees do not have access to the HCW Data; and, 5. Reviewing the safeguards and implementation of such safeguards annually to ensure they operate reasonably to protect the confidentiality, integrity and availability of HCW Data. (b) HCW Agencies, Employee Agencies, or ASAPs collecting or accessing HCW Data shall take reasonable steps to ensure all third-party technical service providers engaged for the purpose of complying with these regulations adhere to the requirements of 651 CMR 16.06(3)(a). (3) Exemptions. (a) An HCW may elect to instruct his or her HCW Agency with whom he or she is employed to withhold his or her personal HCW Data from submission to EOEA for inclusion in the Registry by asserting he or she qualifies for an exemption. (b) Registry exemptions shall be extended to any HCW who:

1. is a victim of Domestic Violence, Rape, Sexual Assault, and/or Stalking;
2. is protected by a Protective Order, a Harassment Prevention Order or a General Protection Order; or
3. asserts that extraordinary personal circumstances require an exemption be granted to protect the health, safety or welfare of an HCW. (c) An HCW may claim an exemption by completing an exemption form and submitting it to each HCW Agency with whom he or she is employed. In completing the exemption form, the HCW shall assert his or her eligibility for an exemption. (d) An HCW claiming an exemption is not required to submit proof that he or she qualifies for an exemption. (e) EOEA shall design and approve Registry exemption forms in accordance with 651 CMR 16.00 and make them available to the public in an electronic format. HCW Agencies shall make such forms available to HCWs and EOEA shall provide exemption forms on request to HCWs. (f) HCW Agencies shall ensure all HCWs in their employ are aware of the exemption process. (g) The HCW Agency shall review and approve all exemption requests consistent with the requirements of 651 CMR 16.06(3), and ensure all exempted HCW Data is not included in the data file to be submitted to EOEA. (h) An HCW may file an exemption form with an HCW Agency at any time. In the event an exemption is asserted by an HCW after their HCW Data has been published in the Registry, the HCW Agency shall immediately inform EOEA of the exemption request and EOEA shall attempt to remove the exempt data from the Registry as soon as is reasonably possible. (4) Format. The HCW Agency shall compile the collected HCW Data in a commercially available electronic format specified by EOEA. The HCW Agency shall also send the compiled HCW Data to EOEA via a process determined by EOEA. EOEA may, as necessary to ensure the effective and efficient operation of the Registry, modify the format requirements with written notice to the HCW Agencies.

16.07 Implementation, Maintenance, and Data Submission

16.07: Implementation, Maintenance, and Data Submission (1) Registry Implementation. (a) HCW Agencies shall provide written notice to all HCWs regarding HCW’s obligation to submit the data elements listed in 651 CMR 16.06(1) to the Registry, and the exemption process pursuant to 651 CMR 16.06(3), within 30 days after June 28, 2019. (b) HCW Agencies shall process exemption requests and compile the HCW Data for submission to EOEA within 60 days after June 28, 2019. (c) HCW Agencies shall submit their completed HCW Data to EOEA within 90 days after June 28, 2019.

651 CMR: DEPARTMENT OF ELDER AFFAIRS

16.07 continued

16.07: continued (d) EOEA shall aggregate all HCW Data submitted by the HCW Agencies in accordance with 651 CMR 16.03 and use it to create the Registry and provide Registry access within 90 days after the deadline for HCW Agencies to submit the required HCW Data. (2) Registry Maintenance. (a) HCW Agencies shall provide written notice to HCWs regarding an HCW’s obligation to submit the data elements listed in 651 CMR 16.06 for inclusion in the Registry, and the exemption process pursuant to 651 CMR 16.04, upon hire and at least annually thereafter. (b) HCW Agencies shall regularly update their HCW Data and maintain current HCW Data by collecting HCW Data for new hires, deleting HCW Data for former HCWs, and expediting exemption requests as received. (c) HCW Agencies shall submit complete and updated HCW Data to EOEA on a quarterly basis. A schedule of specific dates for quarterly submissions shall be issued by EOEA. (d) HCW Agencies shall immediately notify EOEA if HCW Agencies determine previously submitted HCW Data was inaccurate or included HCW Data that was exempt. HCW Agencies shall immediately notify EOEA of exemption requests when received. EOEA shall attempt to correct or remove the HCW Data as soon as is reasonably possible. (e) EOEA shall update the Registry and provide access to it within 30 days after receipt of HCW Data. (f) New HCW Agencies.

1. ASAPs shall inform EOEA of any new HCW Agency contracts since the previous reporting period.
2. New HCW Agencies shall be required to comply with the HCW Data submission requirements prior to the deadline of the next full reporting quarter after the execution of their contract with an ASAP. (3) HCW Data Transfer. The HCW Agency shall transfer the HCW Data to EOEA in accordance with instructions issued by EOEA to ensure the security and integrity of the information. (4) HCW Data Receipt. (a) EOEA will accept all properly formatted HCW Data timely submitted by HCW Agencies and prepare the information for Access as provided by 651 CMR 16.07. (b) EOEA shall assign each HCW a unique identification number and review all submitted data in an effort to eliminate duplicative entries. (c) The unique identification number created by EOEA shall be considered HCW Data after it is assigned to each HCW.

16.08 Registry Access

16.08: Registry Access (1) The Registry shall consist only of the HCW Data of nonexempt HCWs submitted to EOEA by the HCW Agencies in accordance with 651 CMR 16.00. (2) EOEA shall provide access to the HCW Data contained in the Registry as follows: (a) The Public. EOEA shall make available to the public an HCW’s full name, unique identification number, name of any HCW Agency employing the HCW, and a list of home care trainings or certifications reported by the HCW. (b) Other Entities.

1. An Employee Organization, HCW Agency, or ASAP may submit a request to EOEA, in accordance with a process developed by EOEA, to secure the release of all reported HCW Data available.
2. HCW Data released to an Employee Organization, HCW Agency, or ASAP shall be maintained and secured in accordance with 651 CMR 16.08 and shall not be released to any third parties. (3) Only HCW Data available for the most recent quarter shall be made available to the public or entities as provided for in 651 CMR 16.08. Previously released HCW Data will not be available.

651 CMR: DEPARTMENT OF ELDER AFFAIRS

16.09 Records

16.09: Records (1) Applicable Law. (a) All Holders are subject to the provisions of M.G.L. c. 66A, 801 CMR 3.00: Home Care Program, 101 CMR 16.00: Personal Data Use and Permitted Disclosures by and among the Executive Office of Health and Human Services and its Agencies, and any other applicable state or federal laws or regulations pertaining to privacy protections, security, use, disclosure or maintenance of HCW Data, Personal Data, or Commonwealth Security Information. (b) Except as otherwise provided in 651 CMR 16.00, all records containing HCW Data, which are created, collected, used, maintained, disseminated or received pursuant to 651 CMR 16.00 shall not be Public Records and shall be governed by the provisions of M.G.L. c. 66A and 801 CMR 3.00: Home Care Program. (2) Access to HCW Data by Third Parties. Except as otherwise provided in 651 CMR 16.00, a Holder shall not release HCW Data to any other entity or individual after receipt, unless such access is authorized by statute, regulations, court order, or is authorized by the HCW Data subject. Aggregated and de-identified HCW Data may be shared with third parties for the purpose of statistical analysis with the prior consent of EOEA. (3) Exemptions. All records, documents, or materials related to the exemption status of an HCW shall be collected and maintained by the HCW Agency in a secure environment and may not be released or shared except as provided in 651 CMR 16.00. (4) Security. Holders must maintain all HCW Data in a secure environment in accordance with the provisions of applicable state and federal law and regulations including, but not limited to, M.G.L. c. 66A, 801 CMR 3.00: Home Care Program, and 101 CMR 16.00: Personal Data Use and Permitted Disclosures by and among the Executive Office of Health and Human Services and its Agencies. (5) Access to Provider Records. HCW Agencies shall provide EOEA, or the ASAP with which the HCW Agency is under contract with, access to all relevant records necessary to ascertain HCW Agencies' compliance with 651 CMR 16.00.

16.10 Compliance

16.10: Compliance In the event an HCW Agency and/or an ASAP fails to comply with the provisions of 651 CMR 16.00, EOEA may, after providing written notice of the alleged violation and an opportunity to cure, seek corrective action, up to and including termination of any relevant contracts. REGULATORY AUTHORITY 651 CMR 16.00: St. 2017, c. 139; M.G.L. c. 19A, § 4D.