Can I collect third-party data from participants in Massachusetts? What are the requirements?

To collect third-party data from participants in Massachusetts, you must follow the requirements outlined in the relevant regulations. The specific requirements depend on the type of data you are collecting and the purpose of the collection.

If you are collecting Protected Health Information, you must file an application with the Center for Health Information and Analysis (CHIA) ^[2.1]. In the application, you must identify and demonstrate a need for the information, specify the purpose of the request, describe security and privacy measures, and demonstrate compliance with relevant laws and regulations. The Data Privacy Committee will review the application and make a recommendation to the Executive Director, who will make the final decision ^[2.1].

If you are collecting data from the Trial Court, you must enter into a Memorandum of Understanding and data sharing agreement with the Trial Court ^[4.1].

The Data Release Committee advises the Executive Director on best practices regarding data release, data security, and data protection. The Committee reviews applications for data submitted to CHIA ^[2.2].

If you receive personal data as a result of a disclosure authorized by 101 CMR 16.00, you must use and hold the data in a manner consistent with federal and state laws and not disclose it to another party unless legally authorized ^[5.1].

If you are collecting personal data, you must only collect, maintain, or disseminate data that is essential for the performance of functions authorized by law ^[6.1].

Please note that these are general guidelines, and you should consult the relevant regulations for specific requirements.

Source(s):

• [2.1] All Other Requests for Data
• [4.1] Trial Court Data Collection
• [2.2] Data Release Committee
• [5.1] Safeguarding Personal Data
• [6.1] Collection, Maintenance, and Dissemination of Personal Data

Jurisdiction

Massachusetts

• Privacy