S06 VA Privacy and Information Security Awareness 2018.pdf

<Course Title>

FY18 Text-Only Course Transcript 1

U.S. Department of Veterans Affairs, Office of Information and Technology, IT Workforce Development

FY18 Text-Only Course Transcript i

Table of Contents Purpose of This Document ......................................................................................................................................... iv

Using Hyperlinks Within This Document .................................................................................................................... iv

Topic 1: Course Introduction

1.1 Welcome

1.2 Why Are You Taking This Course?

1.3 Who Must Take This Course?

1.4 General Rules That Apply to Both User Groups

1.5 General Rules for Organizational Users

1.6 General Rules for Non-Organizational Users

1.7 VA Sensitive Information

1.8 Mandatory Training for Users of VA-Furnished Mobile Devices

1.9 Private and Secure Records Management

1.10 Let’s Get Started

Topic 2: At Your Desk

2.1 Introduction

2.2 Secure Use of Software

2.3 Managing Passwords

2.4 System Access

2.5 Systems You’re Authorized to Use

2.6 Disposing of Old Flash Drives

2.7 Auto-populating Internet Sites

2.8 Overriding Security Controls

2.9 Summary

Topic 3: Using Email

3.1 Introduction

3.2 Use VA Email and Do Not Auto-Forward

3.3 Limited Personal Use of VA Equipment

3.4 Encrypting Emails

3.5 Casual Disclosure of Sensitive Information

3.6 Summary

Topic 4: In VA Public Spaces

4.1 Introduction

FY18 Text-Only Course Transcript ii

4.2 Providing Access Based on Need to Know

4.3 Wireless Access

4.4 Connecting Non-GFE to a Facility Network

4.5 Using Other Federal Agencies’ Information Systems

4.6 Summary

Topic 5: Handling Paper

5.1 Introduction

5.2 Using Minimum Necessary Information

5.3 Securing Documents When Not in Use

5.4 Secure Faxing

5.5 Summary

Topic 6: Working Away From VA

6.1 Introduction

6.2 Encryption of Devices and Equipment

6.3 Encryption

6.4 Working Remotely

6.5 Permission for Remote Access

6.6 Telework

6.7 International Travel

6.8 Summary

Topic 7: Exercise Caution to Prevent Incidents

7.1 Introduction

7.2 Who to Ask

7.3 Most Common or High-Impact Incidents

7.4 IG Report

7.5 No Use of Personal Email for VA Business

7.6 Secure Management of Records

7.7 Recertification for Users of VA-Provided Mobile Phones (iPhones)

7.8 More Reminders for Mobile Device Users

7.9 Summary

Topic 8: Summary and Rules of Behavior

8.1 Conclusion

8.2 Acknowledge, Accept, and Comply With the ROB

8.3 Congratulations

Appendix A: Department of Veteran Affairs Information Security Rules of Behavior for Organizational Users ....... A-1

FY18 Text-Only Course Transcript iii

Appendix B: Department of Veteran Affairs Information Security Rules of Behavior for Non-Organizational Users B-1

Appendix C: Glossary ............................................................................................................................................. C-1

Appendix D: Privacy and Information Security Resources ...................................................................................... D-1

FY18 Text-Only Course Transcript iv

Purpose of This Document This text-only course transcript was designed to accommodate users in any of these circumstances:

• You are using a screen reader, such as JAWS, to complete course material and have difficulty with the interactions in the online version.

• You are experiencing difficulties accessing the online version due to computer network or bandwidth issues.

• You have completed the online version and want to print a copy of course material for reference.

This version of the VA Privacy and Information Security Awareness and Rules of Behavior Text-Only Course Transcript is valid for fiscal year (FY) 2018 (i.e., October 2017 through September 2018).

You should take the online version of this course if possible. However, if you complete the course using this text-only transcript, you must do the following:

1. Print, initial, and sign the Information Security Rules of Behavior (ROB) for your particular user type.

NOTE: There are two versions of the ROB, one for Organizational Users and one for Non-organizational Users. You must initial each page, and then, sign the Acknowledge and Accept section for the user group that applies to you. Review the definitions of Organizational and Non-organizational Users on the next page to determine your user group.

2. Contact your supervisor or Contracting Officer Representative (COR) to submit the signed ROB and to coordinate with your local Talent Management System (TMS) Administrator to ensure you receive credit for completion.

Using Hyperlinks Within This Document Throughout this document, you are able to access glossary terms, located in Appendix C, by selecting the available hyperlinks. To return to your place in the main document after selecting a hyperlink to an item in the appendix, select Alt +<left arrow> on your keyboard.

FY18 Text-Only Course Transcript 1

Topic 1: Course Introduction

1.1 Welcome

Welcome to VA Privacy and Information Security Awareness and Rules of Behavior: A Course of Action.

1.2 Why Are You Taking This Course?

Everyone who comes in contact with VA sensitive information and information systems at VA has a duty to protect privacy and ensure information security. VA must comply with federal laws about privacy and information security.

Technology makes it possible for you to use VA information and information systems nearly anytime and anywhere.

This course will help you be more aware of how to protect VA sensitive information and determine what course of action to take whenever privacy or security might be at risk. You must complete this training to use or gain access to VA information or information systems. To maintain your access, you must complete this training each year. In fact, completing this training is one of the Rules of Behavior (ROB) you are required to follow.

Those who must take this training include Organizational and Non-organizational users.

1.3 Who Must Take This Course?

There are two types of users that must take this course, Organizational users and Non-organizational users.

IMPORTANT! User definitions have changed. Please review the definitions to confirm your user type.

Organizational users: VA employees, contractors, researcher, students, volunteers, and representatives of Federal, state, local, or tribal agencies not representing a Veteran or claimant.

Non-organizational users: All information system users other than VA users explicitly categorized as organizational users. These include individuals with a Veteran/claimant power of attorney. Change Management Agents at the local facility are responsible for onboarding power of attorney/private attorneys.

Exceptions

Health professions trainees (i.e., student, intern, resident, or fellow) are not required to complete this course. First-time trainees complete VHA Mandatory Training for Trainees (VA TMS ID: 3185966). Each subsequent year, trainees must complete VHA Mandatory Training for Trainees-Refresher (VA TMS ID: 3192008).

VHA employees and contractors who have access to Protected Health Information (PHI) are also required to complete the Privacy and HIPAA Focused Training (VA TMS ID: 10203).

FY18 Text-Only Course Transcript 2

1.4 General Rules That Apply to Both User Groups

Each year when you complete this mandatory training, you review requirements and rules and finish by accepting the ROB. Here are two general rules that apply to both types of users in every situation.

Organizational and Non-Organizational Users

• I will comply with all federal VA information security, privacy, and records management policies.

• I will understand that authorized VA personnel may review my conduct or actions concerning VA information and information systems, and take appropriate action.

1.5 General Rules for Organizational Users

Here are a few more general rules for Organizational users. Keep these in mind at all times, so you can choose the best course of action. Be sure to read and follow the rules presented throughout the course that apply to your user type.

Organizational Users

• I will have NO expectation of privacy in any records that I create or in my activities while accessing or using VA information systems.

• I will report suspected or identified information security incidents including anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages (security and privacy) to my VA supervisor or designee immediately upon suspicion.

• I will secure mobile devices and portable storage devices (e.g., laptops, Universal Serial Bus (USB) flash drives, smartphones, tablets, personal digital assistants (PDA)).

• I will keep government furnished equipment (GFE) and VA information safe, secure, and separated from my personal property and information, regardless of work location. I will protect GFE from theft, loss, destruction, misuse, and emerging threats.

1.6 General Rules for Non-Organizational Users

Here are a few more general rules for Non-organizational users. Keep these in mind as all times, so you can choose the best course of action. Be sure to read and follow the rules presented throughout the course that apply to your user type.

Non-Organizational Users:

• I will report suspected or identified information security incidents including anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages (security and privacy) on VA information systems to a VA ISO, local CIO, and Information System Owner immediately upon suspicion.

• I will have NO expectation of privacy in my activities while accessing or using VA information systems, as I understand that all activity is logged for security purposes.

• I will protect Government Furnished Equipment (GFE) from theft, loss, destruction, misuse, and threats.

FY18 Text-Only Course Transcript 3

• I will complete mandatory security and privacy awareness training within designated time frames.

1.7 VA Sensitive Information

These are types of VA sensitive information that must be protected:

• Sensitive Personal Information (SPI) is information pertaining to an individual that is maintained by VA. This includes education, financial transactions, medical history, and criminal or employment history. Used synonymously with Personally Identifiable Information (PII), it a way to distinguish or trace one’s identity.

• Personally Identifiable Information (PII) is information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. Some examples include name, home address and phone number, Social Security number, and date of birth.

• Protected Health Information (PHI) includes health records or payment information linked to a specific person. A few examples include patient medical records, patient diagnoses or test results, and patient payment history.

• Regulatory or program-specific information is information that may not be released or may only be released in certain situations. It is information that would not normally be released to the public. Some examples include pricing information submitted to VA by vendors during bid processes, facility or computer room diagrams, documentation of IT systems, and operational business reports.

1.8 Mandatory Training for Users of VA-Furnished Mobile Devices Users of VA-issued mobile devices must complete mandatory security training before receiving the device and must refresh their training each year.

Completing this Annual Privacy and Information Security Awareness training meets the annual recertification requirement for users of VA-issued mobile devices.

The mobile icon (shown below) appears throughout the course to identify content that supports the mobile device recertification requirement. You are also encouraged to review Mobile Training: Security of Apps on iOS Devices, TMS #3926744.

FY18 Text-Only Course Transcript 4

1.9 Private and Secure Records Management

Like privacy and information security, records management has rules and actions that are required for users of VA information in any media.

This course includes a few key definitions and concepts for managing records securely.

Watch for the records icon (shown below) throughout the course to identify content about records management.

You can find a summary of records requirements at the end of the course, and you can review records training available on the TMS.

1.10 Let’s Get Started

Most of the course comprises short scenarios with a choice about what to do to protect VA sensitive information and systems. Correct and incorrect feedback provides details related to what you should and should not do in each situation. Additionally, the corresponding ROB are provided as reinforcement of the concepts.

FY18 Text-Only Course Transcript 5

Topic 2: At Your Desk

2.1 Introduction

This section presents situations that usually occur at your desk or workstation.

When you’ve completed this topic, you can recall how to take the best course of action to protect privacy and ensure information security.

Read each scenario and consider the best response. Then, read the ROB that support the correct choice.

2.2 Secure Use of Software

Scenario While surfing the Internet, you discover a free trial available for a new software product. It sounds like it would help you fend off spyware attacks. You'd like to try it before you request permission to purchase.

Is it okay to go ahead and download the free trial to your VA computer?

Consider the best response:

• Yes – It’s okay since it’s free, and it’s only temporary, and you know how to download software because you often do it at home.

• No – Downloading this trial anti-spyware software would violate at least three privacy and security Rules of Behavior.

The correct answer is No. You must not download software from the Internet. Downloading software yourself violates at least three ROB and could even create a security risk.

Only authorized Office of Information and Technology (OI&T) personnel should install software on your government-furnished equipment. They can make sure you are not bringing viruses or other threats into VA systems and help prevent unexpected security problems.

Only OI&T personnel can perform maintenance on IT equipment, including installation or removal of hardware or software.

Rules of Behavior Organizational Users:

• I WILL NOT download software from the Internet, or other public available sources, offered as free trials, shareware, or other unlicensed software to a VA-owned system.

FY18 Text-Only Course Transcript 6

• I will only use virus protection software, anti-spyware, and firewall/intrusion detection software authorized by VA.

• I will permit only those authorized by OI&T to perform maintenance on IT equipment including installation or removal of hardware or software.

Non-Organizational Users:

• I WILL NOT download or install prohibited software from the Internet, or other publicly available sources, offered as free trials, shareware, or other unlicensed software to a VA-owned system.

• I will if authorized to directly connect to a VA system, only use virus protection software, anti-spyware, and firewall/intrusion detection software authorized by VA.

• I will permit only those authorized by OI&T to perform maintenance on GFE or VA IT components, including installation or removal of hardware or software.

2.3 Managing Passwords

Scenario You have trouble remembering your many VA passwords, so you’ve decided to try storing them in the notes application (app) on your VA-issued mobile device. There are a lot of requirements for creating VA passwords, so you list those in the notes app, too. You aren't including specific labels with the passwords, so only you will be able to figure it out. You believe it is a safe and convenient method to keep your VA passwords handy.

Is this an acceptable practice?

Consider the best response: this an acceptable practice

• Yes – Using the notes app on your VA-issued mobile device poses no privacy or security risks.

• No – Using the notes app on your VA-issued mobile device is risky and violates the ROB.

The correct answer is No. Storing VA passwords using the notes app on your VA-issued mobile device would violate at least three ROB. Password requirements include minimum requirements to ensure security when creating or storing passwords. Be sure to review the password requirements when you create new passwords to be sure you meet minimum standards.

You should only store passwords and verify codes in an encrypted file. Putting passwords in the notes app is not secure. You also should not store your password on a piece of paper under your keyboard.

And you must be the only person who can decrypt the file. VA Organizational users must only use VA-approved apps for any storage of sensitive data, including passwords. VA-approved apps are vetted to ensure they protect VA data at rest or in-flight.

FY18 Text-Only Course Transcript 7

Rules of Behavior Organizational and Non-Organizational Users:

• I will use passwords that meet the VA minimum requirements.

• I will protect my passwords, verify codes, tokens, and credentials from unauthorized use and disclosure.

• I WILL NOT store my passwords or verify codes in any file on any IT system, unless that file has been encrypted using FIPS 140-2 (or its successor) validated encryption, and I am the only person who can decrypt the file. I will not hardcode credentials into scripts or programs.

Non-Organizational Users:

• I WILL NOT divulge a personal username, password, access code, verify code, or other access credential to anyone.

2.4 System Access

Scenario You recently changed jobs within VA. Your new supervisor has coordinated getting access to the new software and systems you need. You liked having access to hospital admissions databases in your old job because you could be “in the know” about people. Today, you noticed that you can still get into one of the old databases, even though you don’t need to use it in your new job.

Is it okay for you to continue to view the old database?

Consider the best response: this

• Yes – If your password still works, it must be okay.

• No – You would be violating at least two ROB if you continue to access the old systems.

The correct answer is No. You must notify your supervisor or designee any time you have access to a system you no longer need. When you change jobs within VA, your new supervisor determines the systems you need for your new job and coordinates with IT to get you access. If you no longer have a job-related reason to keep access to the systems you used before, you cannot use them. The ROB state that you can only have access to VA computer systems that you are authorized to use for your assigned duties.

Rules of Behavior Organizational Users:

• I will follow established procedures for requesting access to any VA computer system and for notifying my VA supervisor or designee when the access is no longer needed.

FY18 Text-Only Course Transcript 8

• I will only use my access to VA computer systems and/or records for officially authorized and assigned duties.

Non-Organizational Users:

• I will follow established procedures for requesting access to any VA information system and for notifying VA when the access is no longer needed.

• I will only use my access to VA computer systems and/or records for officially authorized purposes.

2.5 Systems You’re Authorized to Use

Scenario My favorite neighbor is hospitalized at the local VA medical center. My coworker has access to patient information;

today, she left her desk but her computer screen was still showing the patient database. So I used her computer to look up my neighbor's condition.

Did I violate any ROB?

Consider the best response: this

• Yes – You did not have a work-related need to know, and your action was a breach of your neighbor’s privacy.

• No – Everybody is naturally curious and if you don’t tell anyone else, there’s no harm done.

The correct answer is Yes. Your curiosity about people is no excuse for a breach of privacy, and it’s not worth risking disciplinary action! You did not have a work-related need to know, and your action was a breach of your neighbor’s privacy. Our concern for others is part of why we work at VA. However, in this case, concern went a little too far.

This example is a violation of several ROB. First, if you aren’t authorized to use a system, you can’t use it, especially if it isn’t on your computer. You should only access devices, systems, and records that you are officially authorized to use in your job, and your coworker should have locked her computer or logged off if it was the end of her workday. Everyone should know that computers must be locked when leaving the area and logged off at the end of the workday.

Viewing your neighbor’s sensitive personal information is a privacy incident with potentially severe consequences for you, including disciplinary actions. Don’t do it!

FY18 Text-Only Course Transcript 9

Rules of Behavior Organizational Users:

• I will only use VA approved devices, systems, software, services, and data which I am authorized to use, including complying with any software licensing or copyright restrictions.

• I will log out of all information systems at the end of each workday.

• I will logoff or lock any VA computer or console before walking away.

Non-Organizational Users:

• I will follow VA policies and procedures for handling Federal Government IT equipment and sign for items provided to me for my exclusive use and return them when no longer required for VA activities.

2.6 Disposing of Old Flash Drives

Scenario You received a voicemail from an individual who said he is a system administrator with OI&T. He asked you to leave your USB flash drive on your desk when you leave today because OI&T is providing new, more secure drives; they will swap the devices overnight so you don’t have to worry about being at your desk.

Should you leave the drive out overnight?

Consider the best response:

• Yes – Everyone should comply with OI&T requests.

• No – Drives should be secured when not in use and should only be given to authorized personnel.

The correct answer is No. It might not be easy to tell if the caller is really from OI&T. This could be a scam. Flash drives and other storage devices should never be surrendered to anyone other than authorized OI&T personnel.

Even though all VA-issued storage devices are protected by encryption, do not leave the drive on your desk where anyone walking by could pick it up. Leaving the device on your desk may not seem so risky.

However, it would violate at least two ROB. As a precaution, ask your supervisor and other teammates if they received a similar call, and then report the voicemail to your Information Security Officer (ISO). Always report suspicious voicemails like this one to your Information Security Officer (ISO).

FY18 Text-Only Course Transcript 10

Rules of Behavior Organizational Users:

• I WILL NOT surrender VA hard drives or other storage devices to anyone other than an authorized OI&T employee.

• I will secure mobile devices and portable storage devices (e.g., laptops, Universal Serial Bus (USB) flash drives, smartphones, tablets, personal digital assistants (PDA)).

Non-Organizational Users:

• I WILL NOT swap or surrender VA hard drives or other storage devices to anyone other than an authorized OI&T employee.

2.7 Auto-populating Internet Sites

Scenario When using her personal smartphone, Sue allows her usernames and passwords to save and automatically populate on her favorite social media sites. This allows her to log in without typing her password.

Can she use this same type of automatic log-in for her VA-issued mobile device and VA systems?

Consider the best response:

• Yes – This approach will be convenient and efficient.

• No – This approach creates unacceptable risks for VA devices and systems.

The correct answer is No. Never risk exposing VA’s sensitive information. Using automatic log-in to social media sites on your VA mobile device risks enabling others to access VA systems. It may be easier to automatically log in to social media sites on a personal smartphone, but if you hardcode credentials like this to auto-populate your log-in for VA networks, you risk exposing VA’s sensitive information. You also violate the ROB.

VA has two-factor authentication Personal Identity Verification (PIV) card/credential to reduce risk by controlling access to information systems. VA system users use the to gain access to VA facilities and information systems. Be careful to protect your PIV credential from being lost or stolen.

Rules of Behavior Organizational and Non-Organizational Users:

• I WILL NOT hardcode credentials into scripts or programs.

FY18 Text-Only Course Transcript 11

2.8 Overriding Security Controls

Scenario Duane was in the middle of a busy workday when he received a warning that VA’s security software would be upgrading his equipment. His coworker offered to run a program that will override the update and disable the security configuration controls so Duane could continue to work without the interruption of an upgrade. Duane refused the offer.

Did he do the right thing?

Consider the best response:

• Yes – The coworker’s offer is a violation of ROB.

• No – The upgrade will take up too much of his time and cause him to miss work deadlines.

The correct answer is Yes. You should never try to avoid a security upgrade. Duane correctly protected VA systems by refusing the offer. There may be a slight disruption to his day, but, in the end, running the upgrade is the right thing to do. However, his coworker’s offer clearly violates the ROB and could result in disciplinary action or other penalties and fines.

VA security software and controls are in place to protect VA sensitive information. An override like this violates several ROB. VA’s security software and controls are in place to protect VA sensitive information. And you must never attempt to probe your computer system to exploit system controls. If you override these protections or try to probe computer systems, you risk exposing VA information.

Rules of Behavior Organizational and Non-Organizational Users:

• I WILL NOT attempt to override, circumvent, alter or disable operational, technical, or management security configuration controls unless expressly directed to do so by authorized VA staff.

• I WILL NOT disable or degrade software programs used by VA that install security software updates to VA computer equipment, to computer equipment used to connect to VA information systems, or used to create, store or use VA information.

• I WILL NOT attempt to probe computer systems to exploit system controls or to obtain unauthorized access to VA sensitive data.

FY18 Text-Only Course Transcript 12

2.9 Summary

When you are using VA systems, you are required to follow the ROB to protect VA information and information systems. Keep this list in mind:

• Always log out of your computer at the end of the workday and lock or log off any time you need to walk away from your desk.

• Always protect your passwords. This means that you must follow the required minimum standards and, as needed, store your passwords where no one else can access them.

• Only use devices and systems you are authorized to use for your assigned duties. Let your supervisor know when you no longer need access.

• Only OI&T personnel can perform maintenance, including the installation of software. Only surrender equipment to OI&T.

FY18 Text-Only Course Transcript 13

Topic 3: Using Email

3.1 Introduction

This section presents situations that usually occur when using email.

When you’ve completed this topic, you can recall how to take the best course of action to protect privacy and ensure information security.

Read each scenario and consider the best course of action. Then, read the ROB that support the correct choice.

3.2 Use VA Email and Do Not Auto-Forward

Scenario Edward is a member of a project team delivering services to VA under a contract. He finds it inconvenient to log in to the VA email system and prefers to use his company’s email system. He is planning to set up an auto-forward option so his VA email will be sent to his company account.

Is this a violation of the ROB?

Consider the best response:

• Yes – Auto-forwarding creates risk of exposing unencrypted VA sensitive information.

• No – Since Microsoft Outlook has this feature, it is safe to use.

The correct response is Yes. This violates at least two ROB. Many contract employees have both a VA email address and another business address. Since Edward has a VA email address, he must use it. When you use VA email, backup copies are kept so that VA can track business actions and manage federal records.

If you auto-forward messages, some responses may not be tracked by VA, which risks violating records management requirements. VA systems have safeguards in place to help protect information; outside email systems do not have the same VA safeguards.

Rules of Behavior Organizational Users:

• I will use VA e-mail in the performance of my duties when issued a VA e-mail account.

• I WILL NOT auto-forward e-mail messages to addresses outside the VA network.

FY18 Text-Only Course Transcript 14

3.3 Limited Personal Use of VA Equipment

Scenario You recently started a side business selling household items online and decide to use your VA email to receive customer messages throughout the day. You also want to check your website regularly, so you set it up as a favorite on your VA

GFE.

Is this acceptable as “limited personal use” of VA equipment?

Consider the best response:

• Yes – You won’t get many messages; you just want to stay on top of it.

• No – This is an inappropriate personal use of VA equipment.

The correct answer is No. This example describes activities that are not allowed. VA policy permits employees to have limited personal use of VA-furnished office equipment under certain conditions; however, the use must involve minimal additional cost to VA, must be performed on non-work time, must not interfere with the VA mission or operations, and must not violate standards of ethical conduct. You may not use VA equipment to operate a business either during or outside of your normal business hours. By the way, if your VA work involves using systems of another federal agency, personal use of those systems is never allowed. See VA Directive 6001 for a list of uses that are not allowed.

Rules of Behavior Organizational Users:

• I WILL NOT engage in any activity that is prohibited by VA Directive 6001, Limited Personal Use of Government Office Equipment Including Information Technology.

FY18 Text-Only Course Transcript 15

3.4 Encrypting Emails

Scenario Camille has been reminded several times to encrypt her emails. She has trouble remembering when she should and shouldn’t encrypt. She decides to set up Outlook to automatically encrypt every email.

Is this the right way to use encryption for emails?

Consider the best response:

• Yes – She doesn’t have time to decide about every email.

• No – She is overusing encryption.

The correct answer is No. It is important to encrypt emails that contain VA sensitive information, but there’s no need to encrypt every message. In fact, that goes against the ROB. It is up to you to determine which emails should be encrypted.

There are some exceptions. VBA normally defaults the email setting to auto-encrypt to reduce the number of potential incidents related to encryption by VBA users. However, VBA users are still required to unencrypt emails that do not contain sensitive information.

Contact the VA National Service Desk for any questions about encryption.

Rules of Behavior Organizational Users:

• I will encrypt email, including attachments, which contain VA sensitive information. I will not encrypt email that does not include VA sensitive information or any email excluded from the encryption requirement.

FY18 Text-Only Course Transcript 16

3.5 Casual Disclosure of Sensitive Information

Scenario Garrett works as a receptionist at a VA substance abuse treatment center. A friend who works in the public information office of a nearby university wants to do a human-interest article about VA’s substance abuse treatment programs. The friend asks for names of some Veterans to interview. Garrett quickly emails the names and phone numbers of three patients he knows are students.

Did he do the right thing?

Consider the best response:

• Yes – His VA clinic has an opportunity for some good publicity from a trusted reporter, and he is helping make it happen.

• No – There are especially stiff penalties for disclosing any sensitive information about the diagnosis or treatment of drug or alcohol abuse.

The correct answer is No. Garrett has violated several rules about disclosure of VA sensitive information.

Always ask for your supervisor’s advice and approval before responding to a request for information if it is beyond the normal duties of your job, especially if VA sensitive information is involved. In his job, Garrett is not authorized to respond to news media.

He has also violated laws that prohibit disclosing VA sensitive information about certain diagnoses, including treatment for drug or alcohol abuse, HIV, or sickle cell anemia. Be especially careful when anyone asks you for patient information in these treatment categories as there are severe penalties for inappropriate disclosure.

Releasing this type of protected health information could cause serious harm to the Veterans or to VA. For more information, see Title U.S.C. 7332: Confidentiality of Certain Medical Records.

Rules of Behavior Organizational Users:

• I will obtain approval prior to public dissemination of VA information via e-mail as appropriate.

• I WILL NOT make any unauthorized disclosure of any VA sensitive information through any means of communication including, but not limited to, e-mail, instant messaging, online chat, and web bulletin boards or logs.

• I WILL NOT disclose information relating to the diagnosis or treatment of drug abuse, alcoholism or alcohol abuse, HIV, or sickle cell anemia without appropriate legal authority. I understand unauthorized disclosure of this information may have a serious adverse effect on agency operations, agency assets, or individuals.

FY18 Text-Only Course Transcript 17

• I will recognize that access to certain databases has the potential to cause great risk to VA, its customers and employees due to the number and/or sensitivity of the records being accessed. I will act accordingly to ensure the confidentiality and security of these data commensurate with this increased potential risk.

Non-Organizational Users:

• I WILL NOT disclose information relating to the diagnosis or treatment of drug abuse, alcoholism or alcohol abuse, HIV, or sickle cell anemia by VA without appropriate legal authority. Unauthorized disclosure of this information may have a serious adverse effect on agency operations, agency assets, or individuals, and includes criminal penalties.

3.6 Summary

When using email, it is important to follow the ROB to protect VA information. Keep the following in mind:

• Always use your VA email account, if you are issued one. Be sure to keep personal use to a minimum.

• Never auto-forward VA emails to another email account. This will cause confusion and records management challenges.

• Never disclose information you are not authorized to share. Always ask for your supervisor’s advice and approval before responding to a request for information if it is beyond the normal duties of your job, especially if PII or PHI is involved. This includes a list of very specific health conditions.

• Always encrypt emails that contain any type of VA sensitive information.

FY18 Text-Only Course Transcript 18

Topic 4: In VA Public Spaces

4.1 Introduction

This section presents situations that usually occur in VA public spaces.

When you’ve completed this topic, you can recall how to take the best course of action to protect privacy and ensure information security.

Read each scenario and consider the best course of action. Then, read the ROB that support the correct choice.

4.2 Providing Access Based on Need to Know

Scenario You need to post a report to a Microsoft SharePoint site that is restricted to your project team. The report includes a list of individuals and their Social Security numbers.

Is this a violation of the ROB?

Consider the best response:

• Yes – It is a violation because you can’t be sure every role on the project team has the need to know this information.

• No – It is not a violation because members of the project team can all be trusted with the information.

The correct answer is Yes. VA allows the use of certain web-based collaboration tools, including Microsoft SharePoint, to enable people to work together and share business information. While VA SharePoint is a secure tool, you are responsible to ensure that anything you post there is only viewed by those with a need to know.

Access to the site may change without your knowledge, which could accidentally disclose sensitive information to some individuals who do not have a need to know.

First, determine if the group’s need to know is better served by encrypting and emailing documents containing VA sensitive information rather than sharing them on the SharePoint site.

SharePoint administrators (or managers) need to limit access to files and folders that contain sensitive information on SharePoint to those with a need to know. Access lists need to be reviewed periodically to ensure all who are listed are still qualified for access.

Rules of Behavior Organizational Users:

• I will only provide access to sensitive information to those who have a need-to-know for their professional duties, including only posting sensitive information to web based collaboration tools restricted to those who have a need-to-know and when proper safeguards are in place for sensitive information.

FY18 Text-Only Course Transcript 19

4.3 Wireless Access

Scenario Joe often hosts meetings at his VA facility with a group of contractors who have Citrix Access Gateway (CAG) access to the VA network. He sometimes uses a personal wireless access point and connects it to his laptop and an open network jack in the meeting room. The group connects to his personal wireless access point to view a database on the VA network.

Does Joe’s use of wireless technology comply with the

ROB?

Consider the best response:

• Yes – He is in compliance since all participants are users with CAG access.

• No – Joe has violated at least two rules.

The correct answer is No. It appears Joe has violated two of the rules for using wireless technology. The ROB state that you will not set up a wireless access point unless you are explicitly authorized; it sounds like Joe uses his personal access point as needed, without getting permission. The ROB also state that you cannot have a VA network connection and a non-VA network connection physically connected to any device at the same time;

connecting his wireless router to both his laptop and the VA network jack does not comply with this rule.

The solution? Get permission before using any type of Internet server or wireless access point. Alternatively, check whether your facility offers VA-approved guest access to facilitate contractor access.

Rules of Behavior Organizational Users:

• I WILL NOT host, set up, administer, or operate any type of Internet server or wireless access point on any VA network unless explicitly authorized by my Information System Owner, local Chief Information Officer (CIO) or designee, and approved by my Information Security Officer (ISO). SOURCE: AC-18

• I WILL NOT have a VA network connection and a non-VA network connection (including a modem or phone line or wireless network card, etc.) physically connected to any device at the same time unless the dual connection is explicitly authorized.

Non-Organizational Users:

• I WILL NOT use personally-owned equipment on-site at a VA facility to directly connect to the VA network, or connect remotely to the VA network unless approved prior to use (i.e., approval from VA ISO or Change Management Agent).

FY18 Text-Only Course Transcript 20

4.4 Connecting Non-GFE to a Facility Network

Scenario Mark is a contractor visiting his VA Project Manager at a VA facility for a day of meetings. He usually works remotely and does not have a VA-furnished computer. He has his company computer with him, along with a PIV credential reader. He has the Facility Chief Information Officer’s (CIO) permission to use remote access capabilities to connect to the VA Intranet as needed whenever he visits the facility.

Is Mark obeying the ROB?

Consider the best response:

• Yes – Mark received permission from the Facility CIO before using remote access when visiting the facility.

• No – Mark should never use a non-VA computer when he visits a VA facility.

The correct answer is Yes. Although Mark is a contractor, he is still an organizational user. Because his company-owned computer uses VA-approved software to access the VA network and he obtained the CIO's permission in advance, Mark has met the requirements needed to connect his non-GFE equipment to VA's network while visiting a VA facility.

Rules of Behavior Organizational Users:

• I will only use VA-approved solutions for connecting non-VA-owned systems to VA's network.

• I will obtain approval prior to using remote access capabilities to connect non-GFE equipment to VA's network while within the VA facility.

Non-Organizational Users:

• I will only use VA-approved solutions, software, or services for connecting non-VA-owned systems to VA’s network either remotely or directly.

FY18 Text-Only Course Transcript 21

4.5 Using Other Federal Agencies’ Information Systems

Scenario Denise is on an interagency committee that requires her to enter information into a Department of Defense (DoD) system.

Does she have to take the DoD privacy and security training in order to use the DoD systems even if she has already taken VA’s privacy and security training?

Consider the best response:

• Yes – Every agency has its own policies, so she must take any training that is required.

• No – If she has taken VA’s training, it should be about the same for any other agency.

The correct answer is Yes. Each federal agency has its own ROB and required privacy and security training before getting access to its systems. You must complete any required training and sign and abide by the entity’s specific

ROB.

If you follow the other agency’s terms of the system, you can use it for your specific duties. However, personal use is prohibited.

Rules of Behavior Organizational Users:

• I will only use other Federal government information systems as expressly authorized by the terms of those systems; personal use is prohibited.

• I will sign specific or unique ROBs as required for access or use of specific VA systems. I may be required to comply with a non-VA entity's ROB to conduct VA business. While using their system, I must comply with their ROB.

Non-Organizational Users:

• I will complete any additional role-based security training required based on my role and responsibilities.

• I will sign specific or unique ROBs as required for access or use of specific VA systems or non-VA systems.

FY18 Text-Only Course Transcript 22

4.6 Summary

Keep the following in mind when you are sharing information:

• Only provide sensitive information to those who need to know to complete their duties.

• Never host, set up, administer, or operate any type of Internet access without explicit authority.

• Only connect non-VA equipment to VA networks using VA-approved solutions. And only use remote access capabilities to connect GFE to VA’s network while within the VA facility.

FY18 Text-Only Course Transcript 23

Topic 5: Handling Paper

5.1 Introduction

This section presents situations that usually occur when handling paper.

When you’ve completed this topic, you can recall how to take the best course of action to protect privacy and ensure information security.

Read each scenario and consider the best course of action. Then, read the ROB that support the correct choice.

5.2 Using Minimum Necessary Information

Scenario Ruth is a clinic administrator. She creates a weekly report about how much time it takes to see patients at the clinic.

The data report includes a line number for each patient, the diagnostic codes for the visit, and sign-in/sign-out times. No patient identifiers are included for each line.

Does this approach protect VA sensitive information?

Consider the best response:

• Yes – Only the minimum necessary information is listed.

• No – Personal information is disclosed.

The correct answer is Yes. The report protects VA sensitive information because it contains the minimum necessary information for the business purpose and contains no information that risks disclosing any personal information.

Rules of Behavior Organizational Users:

• I will protect Sensitive Personal Information (SPI) aggregated in lists, databases, or logbooks, and will include only the minimum necessary SPI to perform a legitimate business function.

FY18 Text-Only Course Transcript 24

5.3 Securing Documents When Not in Use

Scenario Francis has been working with patient information all day.

He’s been reviewing electronic and printed reports that include sensitive information. He logs off his computer and leaves for the day, with his paper files neatly stacked on his desk and his office door unlocked.

Is this a violation of the ROB?

Consider the best response:

• Yes – He left sensitive information on his desk and did not lock the door.

• No – He logged off his computer.

The correct answer is Yes. This is a violation of the ROB.

While Francis did secure his computer, he did not secure the printed materials on his desk and he did not lock the door.

He should have secured the reports in a locked desk drawer. Maintain a clean desk policy to ensure you do not leave VA sensitive information on your desk during the day or when you leave for the day.

Administrations may have differing guidance. VBA does not authorize materials containing sensitive information to be locked away. This is to prevent claims folders from being locked in someone’s cabinet or desk drawer.

Always check with your supervisor or Records Management Officer for the procedure at your facility.

Rules of Behavior Organizational Users:

• I will ensure that all printed material containing VA sensitive information is physically secured when not in use (e.g., locked cabinet, locked door).

FY18 Text-Only Course Transcript 25

5.4 Secure Faxing

Scenario A patient would like you to fax her files to a non-VA clinic. The receiving clinic’s fax machine is in a room that is secured with badge entry.

Is it okay to fax the file?

Consider the best response:

• Yes – The area is secure with badge entry.

• No – The information may still be at risk.

The correct answer is Yes. In this case, the recipient’s fax machine is in a secured area requiring badge entry, so the fax may be sent safely. Be sure to follow the appropriate procedures if sending a fax is the only solution. The ROB provide additional guidance.

Rules of Behavior Organizational Users:

• I will ensure fax transmissions are sent to the appropriate destination. This includes double checking the fax number, confirming delivery, and using a fax cover sheet with the required notification message included.

• I will transmit individually identifiable information via fax only when no other reasonable means exist, and when someone is at the machine to receive the transmission or the receiving machine is in a secure location.

5.5 Summary

When you work with paper documents, keep the following in mind:

• List only the minimum necessary VA sensitive information to perform a legitimate business function.

• Secure printed materials that contain sensitive information by using the clean desk policy. If it contains sensitive information, lock it away.

• If you must fax, follow standard procedures when faxing. This includes using a cover sheet, double-checking the fax number, and confirming delivery.

FY18 Text-Only Course Transcript 26

Topic 6: Working Away From VA

6.1 Introduction

This section presents situations that usually occur when working away from VA.

When you’ve completed this topic, you can recall how to take the best course of action to protect privacy and ensure information security.

Read each scenario and consider the best course of action. Then, read the ROB that support the correct choice.

6.2 Encryption of Devices and Equipment

Scenario Jeff is a contract employee working remotely, and he does not use VA-furnished devices or equipment. He does have access to a few databases containing VA sensitive information.

Is he required to have his equipment and devices encrypted?

Consider the best response:

• Yes – All devices and equipment that may be used to access VA sensitive information must be encrypted.

• No – Encryption requirements do not apply to contractors who do not use GFE.

The correct answer is Yes. Contract employees are able to use non-VA equipment. Encryption is not required because those non-VA government-furnished systems are prevented from storing VA sensitive information locally to the machine by the VA Citrix Access Gateway StoreFront remote access solution.

Rules of Behavior Organizational Users:

• I will safeguard VA mobile devices and portable storage devices containing VA information, at work and remotely, using FIPS 140-2 validated encryption (or its successor) unless it is not technically possible. This includes laptops, flash drives, and other removable storage devices and storage media (e.g., Compact Discs (CD), Digital Video Discs (DVD)).

FY18 Text-Only Course Transcript 27

6.3 Encryption

Scenario Kathy is a VA employee who works remotely three days each week. She does not work with VA sensitive information in her job. She uses a VA laptop and a VA flash drive.

Is she required to have her equipment and devices encrypted with Federal Information Processing Standard (FIPS) 140-2 validated encryption?

Consider the best response:

• Yes – All VA-furnished devices must be encrypted.

• No – Devices only need encryption if they will contain sensitive information.

The correct answer is Yes. In Kathy’s situation, since she is…