PS_5002_-_Safeguarding_Personally_Identifiable_Information_(PII).pdf

District of Columbia Pretrial Services Agency

POLICY

STATEMENT

Policy Statement 5002 Policy Area: Agency-wide Effective Date: August 1, 2007 Revised: July 1, 2015

Approved:

Susan W. Shaffer, Director

Safeguarding Personally Identifiable Information

I. COVERAGE

This Policy Statement covers all staff and contractors1 of the Pretrial Services Agency (hereinafter referred to as “PSA” or “Agency”) who have access to Personally Identifying Information maintained by PSA.

II. BACKGROUND

Personally Identifiable Information (PII) is any written, oral, or electronic information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc.

Agency staff members are privy to PII concerning current and former PSA employees as well as the individuals who are or have been investigated and/or supervised by the Agency. This Policy Statement establishes specific procedures intended to ensure that Agency personnel safeguard PII in accordance with applicable laws, regulations and memoranda issued by the Office of Management and Budget.

III. POLICY

It is the Agency’s policy to ensure that PII is not disclosed to anyone without: 1) a valid Release of Information (ROI) by the subject; or 2) as permitted by a routine use under the

1 All subsequent references to “staff” and or “personnel” should be read to include Agency contractors and interns to the extent that they have access to Personally Identifying Information.

Policy Statement 5002

August 1, 2007

Privacy Act;2 or 3) other applicable statutory exception. By signing the “Safeguarding Personally Identifiable Information Policy Agreement,” (see Appendix B), Agency personnel acknowledge that they understand the following:

• The procedures for safeguarding PII;

• Circumstances under which employees may release PII;

• The penalties for improperly disclosing PII; and

• After separating from the Agency, personnel are obligated not to disclose any

PII obtained while employed by the Agency without the express written authorization of the Deputy Director of PSA or designee.

Any employee who violates this Policy Statement is subject to disciplinary action up to and including removal, and may also be subject to any civil and/or criminal penalties that apply.

IV. PROCEDURES

1. General Rules and Guidelines for Safeguarding Personally Identifiable

Information

a. When not in use or otherwise under the control of the employee, PII must be properly secured at all times, e.g., locked office, locked desk drawer, locked file cabinet, safe, etc. Immediately shred hard copies of PII that are not in use or designated to be filed, e.g., duplicate copies.

b. Do not store PII on your individual workstation, laptop, or Universal Serial Bus

(USB) drive.

c. Memorize your passwords and do not write them down. Do not share your password with anyone. Your password must be at least eight (8) characters long and include at least a number or a special character. Your network password must be changed at least every forty-five (45) days. Application specific passwords must be changed every forty-five (45) to ninety (90) days based on system’s rules.

d. Keep all Agency keys used to access PII under personal protection. If your key is lost or stolen, report it immediately to your supervisor.

2 Routine use of PSA employee information contained in personnel files is covered by OPM’s special government-wide system or records for general personnel records (OPM/GOVT-1). For specific guidance on routine use of PSA defendant records, see Management Instruction 2401, “Disclosure of Sensitive Information and Use of Release of Information Forms” and its attachment 2401.13, “Disclosure of Sensitive Information Grid.”

e. Do not allow anyone else access to your computer when you are logged in.3 When you step away from your workstation, make sure that you either log out, or lock the screen so that nobody else can access your computer. To lock your computer when you leave your desk press Ctrl + Alt + Del and choose "Lock Computer" option.

f. Never allow an individual who does not have proper identification access to a

PSA office/room that contains PII. Ensure that visitors who are granted access have signed the appropriate visitor log and are escorted at all times. Stop and question any individual who does not have proper identification, and immediately contact the Security Office in the building for assistance to remove an intruder.

g. Employees with access to WALES and NCIC must position their workstation monitors away from public view.

h. Do not leave telephone messages containing PII on non-agency or outside answering machines and voicemail.

i. Do not fax sensitive information to an unattended fax machine. Always check the destination fax number before starting your transmission and ensure that the recipient of the information is present at the time the information is sent. When faxing, always use a cover sheet with the following legal disclaimer (see Appendix C):

The information in this fax is sensitive and may be legally privileged. Access to this transmission by anyone other than the intended addressee is unauthorized. If you are not the intended recipient of this message, any review, disclosure, copying, distribution, retention, or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful.

If you are not the intended recipient, please contact the sender and destroy the fax message, any attachments, and any copies thereof.

j. Internet e-mail to parties outside the Agency network can be intercepted by unauthorized individuals. Sending e-mails with PII to an external e-mail address that is not secure such as AOL, Netscape, Hotmail, Yahoo, Verizon, Cox, Comcast, other Web Mail, etc. is prohibited.

3 This prohibition does not include PSA personnel who have authorized access to another employee’s electronic mail, e.g., executive assistant, or work colleagues who provide assistance to you at your request, e.g., reviewing a draft document on your computer. However, such individuals should not have access to another employee’s password(s).

k. Without specific authorization, do not read, copy, alter, or delete any other person’s computer files or e-mail, even if the operating system of the computer allows you to do so.

l. PII stored on removable media for telecommuting purposes should be entirely erased, or the disks destroyed within ninety (90) days after use. In order to initiate the destruction or erasure of removable media, PSA staff must contact the PSA IT Help Desk. PSA IT staff will assist with the deletion using a wipe out utility or other means as appropriate. Staff must secure all Agency equipment that contains PII when not in use, e.g., keeping Agency laptop in a locked room or cabinet.

m. When disposing of or transferring a computer system, IT personnel must erase all files from the hard drive by using a wipe out utility, or by physically destroying the disk if necessary.

n. Do not write or put into production any “back door” means of accessing a system or applications.

o. Report all suspicious or unusual problems with your computer to the PSA IT Help Desk immediately.

2. Reporting Incidents Involving Personally Identifiable Information

As stated in an Office of Management and Budget (OMB) memorandum4 issued in 2006 to Heads of Departments and Agencies: “[Incidents involving PII] can implicate a broad range of harms to individuals, including the potential for identity theft. The crime of identity theft occurs when an individual’s identifying information is used by another without authorization in an attempt to commit fraud or other crimes. Identity theft undermines consumer confidence, harms our economy, and wastes consumer time, money, and effort to correct the damage caused by identity theft.”

Agency staff must immediately report an incident involving PII to his or her supervisor who will immediately notify the PSA Deputy Director or designee of the incident. Upon notification, the PSA Deputy Director or designee will immediately notify the CSOSA Senior Agency Officer for Privacy (Privacy Officer) who is responsible for reporting the incident to a Federal Incident Response Center. In addition to notifying the Privacy Officer, the PSA Deputy Director may initiate an investigation of the incident. If the incident involves information technology, the Deputy Director will seek the assistance of the PSA IT Security Officer as well as any other individual(s) deemed appropriate.

4 See OMB memorandum, dated September 20, 2006, entitled, “Recommendations for Identity Theft Related Data Breach Notification.” More information may be obtained at http://www.omb.gov.

http://www.omb.gov/

The Federal Information Security Management Act of 2002 requires all agencies to report security incidents to a Federal Incident Response Center. The center (US-CERT)5 is located within the Department of Homeland Security. As further clarified in an OMB memorandum6 issued in 2006, all suspected or confirmed incidents involving PII in electronic or physical form must be reported by Departments and Agencies to US-CERT within one hour of discovering the incident. Examples of incidents include, but are not limited to: loss of a defendant or employee document or file, or computer software and hardware. US-CERT will forward all agency reports to the appropriate Identity Theft Task Force point-of-contact also within one hour of notification by an agency.

3. Criminal and Civil Penalties for Unauthorized Disclosure of Personally Identifiable Information

Federal law (42 C.F.R. § 2.4) provides a criminal penalty ($500 for a first offense and up to $5,000 for each subsequent offense) for the unlawful disclosure of substance abuse treatment records. Violation of the Privacy Act may result in a misdemeanor conviction and a fine of up to $5,000 (5 U.S.C. § 552a (I)). District of Columbia law provides for a misdemeanor conviction with a fine up to $5,000 and up to 90 days imprisonment, or both, for willful disclosure of HIV/AIDS records (D.C. Code § 7-304). The D.C. Mental Health Information Act provides a misdemeanor penalty or a fine of up to $1,000, in addition to damages, court costs and attorney’s fees, for unlawful disclosure of mental health records (D.C. Code §§ 7-1207.01 to 1208.01). District of Columbia law also provides for a fine up to $250 or imprisonment for not more than 90 days, or both for unlawful disclosure of juvenile records (D.C. Code § 16-2336). Agency personnel may be subject to criminal contempt for any unauthorized disclosure of sealed case information. In addition to the above-noted penalties, Agency employees may face personal civil liability and administrative sanctions up to and including removal as a result of any unauthorized disclosure of sensitive subject information.

5 More information concerning US CERT may be obtained at http://www.us-cert.gov.

6 See OMB memorandum M-06-09, dated July 12, 2006, “Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments.” More information may be obtained at http://www.omb.gov.

http://www.us-cert.gov/ http://www.omb.gov/

V. AUTHORITIES, SUPERSEDURES, REFERENCES AND ATTACHMENTS

A. Authorities

5 U.S.C. § 552a (Privacy Act) 42 C.F.R. Part 2 (drug/alcohol treatment records regulations) 28 C.F.R. Part 20, subpart C (Federal Systems and Exchange of Criminal History Record Information) D.C. Code §§ 7-1201.01 et seq. (D.C. Mental Health Information Act) D.C. Code §§ 7-302, 7-1601, 1605 (HIV/AIDS confidentiality) D.C. Code §§ 23-1301 to 1333 (D.C. Pretrial Services Agency statute) D.C. Code §§ 16-2318, 16-2331, 16-2332 (order of adjudication non-criminal; juvenile case record and social record confidentiality) Federal Information Security Management Act of 2002 Office of Management and Budget (OMB) Memorandum M-06-15, “Safeguarding Personally Identifiable Information” issued May 22, 2006 OMB Memorandum M-06-16, “Protection of Sensitive Agency Information” issued June 23, 2006 OMB Memorandum M-06-19, “Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments” issued July 12, 2006

B. Supersedures

Section V(D) of CSOSA M&A Directive 500.2, Safeguarding Sensitive Unclassified Information (5/5/00)

C. Procedural References

CSOSA M&A Directive 500.2, Safeguarding Sensitive Unclassified Information (5/5/00) CSOSA/PSA Subpoenas, Warrants, Garnishments and Other Legal Process CSOSA/PSA Freedom of Information/Privacy Act CSOSA/PSA IT Account Management Policy- Policy Statement 2003 CSOSA/PSA Release of Defendant/Offender Drug Test Information-Policy Statement 4007 CSOSA/PSA Research and Evaluation- Policy Statement 1201 Disclosure of Sensitive Information and Use of Release of Information Forms- Management Instruction 2401 Disclosure of Sensitive Information Grid- Management Instruction Document 2401.13 Office of Personnel Management System of Records for General Personnel Records

D. Attachments

Appendix A. Definitions Appendix B. Safeguarding Personally Identifiable Information Policy Agreement Appendix C. Agency Fax Cover Sheet

APPENDIX A

DEFINITIONS

Disclosure- written, oral, or electronic communication of information.

Incident- the loss or suspected loss of Personally Indentifiable Information (PII).

Personally Identifiable Information (PII)- written, oral, or electronic information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc.

Release of Information (ROI)- CSOSA or PSA forms that are designed to satisfy individual statutes covering certain types of sensitive information, which are signed by an individual to authorize the release of sensitive information concerning that individual to an identified party for an identified purpose within an identified timeframe.

Routine Use- disclosure not requiring the individual’s consent of a Privacy Act-protected record for a purpose that is compatible with the purpose for which it was collected.

Sensitive Information- written, oral, or electronic information concerning an individual that is not publicly available and may only be provided to a requester with either the written consent of the subject, a court order, or other exception under applicable law.

USB Drive- Acronym for Universal Serial Bus, an external bus standard that supports data transfer rates of 12 Mbps. A single USB port can be used to connect up to 127 peripheral devices, such as mice, modems, and keyboards. USB also supports Plug-and-Play installation and hot plugging.

APPENDIX B

Safeguarding Personally Identifiable Information Policy Agreement

I understand PSA's Safeguarding Personally Identifiable Information (PII) Policy and my responsibilities as an employee in safeguarding, disclosing and reporting incidents involving PII. I also understand the respective penalties for violating this Policy pursuant to law enforcement regulations, and District of Columbia and Federal law.

Employee’s Name:

(Please Print) Employee’s Signature:

Date:

APPENDIX C

D.C. Pretrial Services Agency Washington, D.C. 20004

Fax

TO: FROM:

FAX: FAX:

Phone: Phone:

Subject: Date:

Comments:

Special Notice:

The information in this fax is sensitive and may be legally privileged. Access to this transmission by anyone other than the intended addressee is unauthorized. If you are not the intended recipient of this message, any review, disclosure, copying, distribution, retention, or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. If you are not the intended recipient, please contact the sender and destroy the fax message, any attachments, and any copies thereof.