Requirement to Maintain a Secondary Dissemination Log

(1) CORI shall not be disseminated except as otherwise provided in 803 CMR 2.16 and 2.17, or as otherwise authorized by the law, regulation, or accreditation requirement that allows for CORI access. (2) In the limited circumstances under which CORI may be lawfully disseminated outside of the requestor’s organization, the requestor shall either enter into an approved memorandum of understanding with the recipient or else record each such dissemination in a secondary dissemination log. (a) An approved memorandum of understanding shall: 1. be approved by DCJIS prior to execution; 2. be entered into between any and all parties that will disseminate, receive, or have any access to CORI pursuant to the agreement; 3. be signed by individuals with signatory authority on behalf of any and all such parties; 4. conform with all statutes, regulations, and policies applicable to CORI access; and 5. describe in detail all circumstances in which CORI will be shared, including the means and media to be used, any and all security controls, all persons with access to any CORI under the agreement, the purpose of such information sharing, and the legal authority for said agreement. (b) The secondary dissemination log shall record the following information for each dissemination: 1. the subject’s name; 2. the subject’s date of birth; 3. the date and time of dissemination; 4. the name of the individual to whom the CORI was disseminated along with the name of the organization for which the individual works, if applicable; and 5. the specific reason for dissemination. (3) The secondary dissemination log may be maintained electronically or on paper. An electronic dissemination log shall be protected in the same manner as described in 803 CMR 2.14 and 2.15. (5) Each secondary dissemination log entry shall be maintained for at least seven years. (6) A secondary dissemination log shall be subject to audit by DCJIS. (7) Upon request, a requestor may provide a subject a copy of the secondary dissemination log pertaining only to dissemination of the subject’s CORI.