Attachment B-3 ~9.pdf

IDES ATTACHMENTS

B-3 (3/1/13)

ATTACHMENT B-3

PROTECTION OF SOCIAL SECURITY NUMBERS

CONTRACTOR/SUBCONTRACTOR POLICY STATEMENT

The Identity Protection Act, 5 ILCS 179/1 et seq. (“IPA”), requires the Illinois Department of Employment Security (“IDES”) to implement certain policies and procedures to protect Social Security numbers (“SSN” or “SSNs”) used in the administration of IDES programs and services, including SSNs disclosed to other entities when disclosure is necessary to the performance of IDES duties and responsibilities. Under the IPA, before SSNs may be disclosed to contractors or subcontractors IDES must obtain in writing the policies the contractors or subcontractors will follow to protect the disclosed SSNs in accord with the requirements of the IPA.

This policy statement will serve as written acknowledgement by the undersigned contractor or subcontractor (“Recipient”) that any and all SSNs disclosed by IDES will be protected in accord with the policies set forth herein:

1. The Recipient acknowledges that any SSNs disclosed by IDES will be utilized solely for the specific purpose(s) and use(s) identified in the pertaining contract, subcontract, grant, subgrant, or other agreement between IDES and the Recipient (“Agreement”). The Recipient affirms that it will not utilize any disclosed SSNs other than for said purpose(s) and use(s) without the prior written consent of IDES, and that it will not archive or retain any disclosed SSNs in any manner, form, or format after the termination of the Agreement.

2. The Recipient affirms that only the officers and employees of the Recipient who have a need to access disclosed SSNs for the purpose(s) and use(s) identified in the Agreement will have access to disclosed SSNs. The Recipient also affirms that it is responsible for enforcing this restriction of access to disclosed SSNs, and that all of the officers and employees of the Recipient who will have access to disclosed SSNs have been trained to protect the confidentiality of SSNs in accord with this policy statement. Training shall include instructions on proper handling of disclosed SSNs from receipt through disposal (see Paragraph 7).

3. The Recipient acknowledges that all SSNs disclosed by IDES are confidential and will be protected from unauthorized use and/or disclosure. Protection from unauthorized use and/or disclosure includes:

a) Restricting access to disclosed SSNs to authorized personnel in accord with Paragraph 2;

b) Storing materials, documents, or media containing disclosed SSNs in a place and/or manner physically secure from access by unauthorized persons;

c) Maintaining disclosed SSNs reduced to electronic or digital media or formats such as magnetic tapes, hard drives, flash drives, CDs or server-based applications in such a way that unauthorized persons cannot access or obtain disclosed SSNs by any means; and

d) Applying security measures to computer systems ensuring that only authorized personnel will have access to disclosed SSNs accessible through said computer systems.

4. The Recipient affirms that it complies with all applicable laws, regulations, and State and federal legal authorities relating to the protection of disclosed SSNs, including, without limitation:

a) Federal regulations codified at 20 CFR 603 pertaining to recipients of unemployment compensation information;

b) The Illinois Data Processing Confidentiality Act, 30 ILCS 585/0.01 et seq.;

c) Section 1900 of the Illinois Unemployment Insurance Act, 820 ILCS 405/1900; and

d) Section 10(c)(1) of the IPA, 5 ILCS 179/10(c)(1).

5. The Recipient affirms that it will not subcontract, subgrant, or otherwise transfer or assign any of the Recipient’s duties or obligations involving disclosed SSNs under the Agreement without the prior written consent of IDES, and/or the approval and/or execution of an appropriate subcontract, subgrant, or other third-party agreement by IDES.

6. The Recipient affirms that it will retain records of access to and use of disclosed SSNs for a period of three years following receipt of the

SSNs, and will allow on-site inspections by IDES to verify SSN security and usage as well as audit access during the three year period after the receipt of the SSNs. The Recipient also affirms that it will correct any security and/or usage deficiency(ies) identified by IDES promptly upon receipt of written notice of said deficiency(ies).

7. The Recipient acknowledges that the materials, documents, or media of any type or form that contain SSNs disclosed by IDES are the property of and shall be returned to IDES upon request. The Recipient also acknowledges that it is responsible for the disposal of said materials, documents, or media upon termination of the Agreement. “Disposal”” means the return or delivery of said materials, documents, or media to IDES, or the destruction of same, as directed by IDES.

Recipient

Name:

(Print)

By:

(Signature)

Title:

Date: