The recipient will:

(1) Perform an annual self-assessment to determine compliance with the requirements of the data sharing agreement.

(2) Confirm in writing to the department annually that it complies with requirements in the data sharing agreement.

(3) Document instances of noncompliance with the data sharing agreement and include a corrective action plan to correct all deficiencies.

(4) Include a declaration with their statement of compliance that affirms protected personal information is only used as authorized.