Draft for attorney review. Not yet in effect.

Confidentiality and Acceptable Use Agreement

Effective date: [Effective date]

Every team member and independent coordinator must accept this agreement before seeing client records in IntakeAlly. It is an agreement between you, the organization you work with in IntakeAlly (the "Organization"), and [Company legal name] ("we"). If you work with more than one Organization, it applies to each of them.

Client records are about real people, many of them children and adults with developmental disabilities and their families. Please read this carefully.

1. What this agreement covers

"Client information" means any information about a person the Organization serves or proposes to serve, or about their family, guardians, or representatives, that you see, hear, or handle through IntakeAlly or your assigned work. It includes names, dates of birth, addresses, case numbers, diagnoses, medical and developmental history, assessment notes, interview recordings or notes, and documents. It does not matter whether the information is on a screen, on paper, or spoken aloud.

2. The laws that protect client information

Client information is protected by law, and breaking these rules can lead to civil and criminal penalties for you and the Organization. The main laws are:

• HIPAA, the federal Health Insurance Portability and Accountability Act, which protects health information;
• the California Confidentiality of Medical Information Act (CMIA), Civil Code §56 et seq., which protects medical information and allows people to sue for unauthorized disclosure; and
• Welfare and Institutions Code §4514, which makes the records of people with developmental disabilities who receive regional center services confidential and limits who may see them.

You do not need to be a legal expert, but you must follow the rules below and ask the Organization if you are unsure.

3. Your commitments

By accepting this agreement, you agree to the following.

Use client information only for your assigned work.

1. Access and use client information only to do the work the Organization has assigned to you in IntakeAlly.
2. Do not look up clients, family members, neighbors, friends, public figures, or yourself out of curiosity. Every case you open is recorded in an activity log that the Organization's administrators can see.
3. Use and share only the minimum information needed for the task.
4. Do not discuss client information with anyone who does not need it for the work, including your own family and friends, and never on social media.

Keep client information inside IntakeAlly.

1. Never copy client information outside IntakeAlly. That means no downloading to personal devices, no screenshots or photos, no printing unless the Organization specifically allows it, and no saving to personal cloud storage.
2. Never send client information as an email attachment or in the body of an email, text message, or chat message. Use IntakeAlly to share work with the Organization.
3. Never paste or upload client information into ChatGPT or any other AI tool, translation tool, or online service outside IntakeAlly. IntakeAlly's AI features run inside the platform under legal protections; outside tools do not.
4. If you take handwritten notes during an interview because the Organization's process requires it, keep them secure, enter them into IntakeAlly promptly, and destroy the paper as the Organization directs.

Protect your sign-in.

1. Keep your password and sign-in codes private. Never share your account or let anyone else use it, even a coworker.
2. Use a strong password of at least 12 characters that you do not use anywhere else.
3. Set up and use two-step sign-in with an authenticator app when the Organization requires it. We recommend it for everyone.
4. Change your password right away if you think someone else knows it.

Protect your devices and surroundings.

1. Lock your screen or sign out whenever you step away from your device, even briefly. IntakeAlly signs you out automatically after 30 minutes without activity, but do not rely on that.
2. Keep your device's operating system and browser up to date, and use a device password or PIN.
3. Do not use shared or public computers to access IntakeAlly.
4. Conduct interviews and phone or video calls about clients in a private location where others cannot see your screen or overhear the conversation. Use headphones when others are nearby.

Report problems right away.

1. If you suspect that client information has been seen, sent, lost, or used by someone who should not have it, or that your account has been compromised, report it to the Organization and to support@example.com as soon as possible and no later than 24 hours after you find out.
2. Examples include sending something to the wrong person, losing a device that was signed in, a suspicious email asking for your sign-in, or noticing that a case you should not see is visible to you.
3. Report even if you are not sure. Do not try to investigate or fix the problem yourself, and do not delete evidence.
4. Good-faith reports are expected and welcome. Reporting quickly is what limits harm.

When your work ends.

1. When an assignment ends, or when you stop working with the Organization, return to the Organization or permanently delete any client information you have outside IntakeAlly (for example, paper notes), and confirm that you have done so if asked.
2. Do not keep copies of reports, notes, or other client information for your own files or portfolio.

4. Your obligations continue

Your duty to keep client information confidential continues after your assignment ends, after you stop working with the Organization, and after your IntakeAlly account is closed. It does not expire.

5. Sanctions

If you break this agreement, the Organization may apply sanctions under its own policies, up to and including ending your work or employment. We may suspend or close your IntakeAlly account. Violations may also have to be reported to regulators or to affected individuals, and may result in civil or criminal penalties under HIPAA, the CMIA, W&I Code §4514, or other laws.

6. Independent coordinators

If you are an independent coordinator, accepting this agreement does not make you an employee or agent of [Company legal name]. Your working relationship is with the Organization, which decides how it engages you. You must still follow every commitment in this agreement.

7. Questions

If you are unsure whether something is allowed, ask the Organization before you act. You can also contact us at support@example.com.

8. Electronic acceptance

You accept this agreement electronically in IntakeAlly. We record your name, the Organization, and the date and time you accepted, along with the version of this agreement. Your electronic acceptance has the same effect as a handwritten signature. You may be asked to accept this agreement again when it changes or periodically as part of training. You may ask the Organization or us for a copy of the version you accepted.

By accepting, you confirm that you have read and understood this agreement and will follow it.