Attachment D - OMIS Policy 0529 OMIS Vendor Contractor Employee Background Check.pdf

State of West Virginia

Departments of Health, Health Facilities, and Human Services

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

Employee Background Check

Revised: February 10, 2025

1.0 PURPOSE

The WV Departments of Health (DH), Health Facilities (DHF), Human Services (DoHS), and

Office of Shared Administration (OSA), Office of Management Information Services (OMIS) is committed to taking meaningful actions to ensure its data, systems, and other assets are properly supported by qualified vendors and contractors. This policy outlines OMIS’ guidelines to ensure fingerprint-based state and federal background checks for all contracted employees are conducted according to established standards.

2.0 SCOPE

This policy applies to all DH, DHF, DHS and OSA vendor, contractor, and sub-contractor employees providing services to the State who access, or may potentially access, sensitive and confidential data {i.e., protected health information (PHI), personally identifiable information

(PII), social security administration (SSA) data, federal tax information (FTI), and/or payment card information (PCI)}.

3.0 POLICY

3.1 All background checks will be applied and administered uniformly, fairly, and without prejudice.

3.2 In accordance with W. Va. Code § 15-2D-3 (e), the Director of the WV Division of

Protective Services (DPS) requires any newly hired vendors, contractors, and sub-contractors whose employees are regularly employed on the grounds or in the buildings of the State Capitol complex (this includes all Agency facilities), or who have access to sensitive or critical information, to submit to a fingerprint-based state and federal background check prior to receiving access to use State data and/or systems.

Attachment D

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

Employee Background Check

Revised: February 10, 2025

3.3 The Agency will work closely with the contracting company and DPS to ensure that each existing vendor, contractor, and sub-contractor with access to sensitive and confidential data receives a complete fingerprint-based state and federal background check. This process is outlined in OMIS Procedure OP-35, OMIS

Vendor and Contractor Employee Background Check Process.

3.4 In accordance with WV State Code, contracting companies will be informed during the contract award process that acceptance of any employee(s) permitted to access

PHI, PII, FTI, SSA data, and/or PCI data is contingent upon proof of a favorable background check.

3.5 Prior to conducting a background check, a signed, written consent will be obtained from each applicant. Refusal to authorize the background check; failure to disclose a criminal conviction; or failure to provide truthful, accurate, and complete information will render the applicant ineligible for employment with the DH, DHF, DoHS and OSA .

3.6 Under certain conditions, a contractor or vendor may work on a provisional basis for not more than sixty days pending notification from the DPS regarding the results of the criminal background check. Additional information is outlined in OMIS

Procedure OP-35.

3.7 If the contract holder has conducted state and federal fingerprint-based background checks on its employees within three (3) years of the contract’s effective date, a list of authorized staff assigned to the project, as well as results of the checks, must be submitted to the DH, DHF, DoHS and OSA bureau or office for review.

3.8 Agency contract managers will be responsible for initiating re-investigations for contractors and vendors every three (3) years from the date of their previous background investigations. The Departments have the right to re-screen individuals

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor periodically, consistent with the criticality/sensitivity risk designation of the position.

4.0 ENFORCEMENT

Violation of this policy by external entities, including vendors, contractors, and/or consultants, may result in termination of the relationship and/or associated privileges. Violation may also result in civil and criminal penalties as determined by federal and state laws and regulations.

5.0 DEFINITIONS

5.1 Confidential Data – Information that is legally protected (ex: Protected Health

Information) or otherwise deemed by a qualified expert to be unsuitable for open access.

5.2 Contractor – Contractors include, but are not limited to, information providers, information processors, and other organizations that provide information system development, information technology services, consumer assistance, AE business functions, and other outsourced applications, roles, and functions.

5.3 Employee – Individuals retained and authorized on a temporary or permanent basis by the State of West Virginia to perform a service. For the purposes of this procedure, the term “employee” will include the following: contractors, subcontractors, contractors’ employees, volunteers, county health department staff, business associates, and any other persons who are determined to be subject to this procedure. This definition does not create any additional rights or duties.

5.4 Federal Tax Information (FTI) – According to the IRS Publication 1075, FTI is defined as any return or return information received from the IRS or secondary source, such as SSA, Federal Office of Child Support Enforcement or Bureau of

Fiscal Service. FTI includes any information created by the recipient that is derived from return or return information.

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

5.5 Office of Management Information Services (OMIS) – This office reports directly to the DoH, DHF, DHS and OSA Secretaries and provides the leadership, innovation, and services needed to achieve efficient and effective technology solutions to meet the goals of the Agencies.

5.6 Payment Card Industry Data Security Standard (PCI DSS) – A proprietary information security standard for organizations that handle branded credit cards from the major card schemes.

5.7 Personally Identifiable Information (PII) - All information that identifies, or can be used to identify, locate, or contact (or impersonate) a particular individual.

Personally identifiable information is contained in both public and non-public records. Examples may include but are not limited to a specific individual’s: first name (or initial) and last name (current or former); geographical address, electronic address (including an e-mail address); telephone number or fax number dedicated to contacting the individual at their physical place of residence; social security number; credit and debit card numbers; financial records, including loan accounts and payment history; consumer report information; mother’s maiden name;

biometric identifiers, including but not limited to, fingerprints; facial recognition and iris scans; driver identification number; full face image; birth date; birth or adoption certificate number; physical description; genetic information; medical, disability or employment records, including salary information; computer information, including information collected through an Internet cookie; criminal history, etc. When connected with one or more of the items of information specified above, PII includes any other information concerning an individual, that if disclosed, identifies or can be used to identify a specific individual physically or electronically.

5.8 Protected Health Information (PHI) - Individually identifiable health information that is received, created, maintained or transmitted by the organization, including demographic information, that identifies an individual, or provides a

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor reasonable basis to believe the information can be used to identify an individual, and relates to:

· Past, present or future physical or mental health or condition of an individual;

· The provision of health care to an individual; and

· The past, present, or future payment for the provision of health care to an individual.

Privacy and Security Rules do not protect the individually identifiable health information of persons who have been deceased for more than 50 years.

5.9 Sensitive Data – This includes safeguarded information or anything the organization, its employees, customers, or contractors would expect to be private and protected. Direct access is limited to authenticated and authorized individuals who require access to that information in the course of performing their job duties.

Examples include: most data in employee records, employment and training program data, historical records repository data, client-specific data, etc.

6.0 REFERENCES/RELATED MATERIAL

6.1 Internal Revenue Service (IRS) Publication 1075 – Tax Information Security

Guidelines for Federal, State, and Local Agencies; Safeguards for Protecting

Federal Tax Returns and Return Information

6.2 WV State Code § 15-2D-3 (e) - Duties and Powers of the Director and Officers

6.3 West Virginia Human Rights Act (WV Code Sec. 5-11-1 et seq.)

6.4 WVOT-PO1001 – Information Security Policy

6.5 WVOT-PO1006 – Data Classification

https://www.irs.gov/pub/irs-pdf/p1075.pdf https://codes.findlaw.com/wv/chapter-15-public-safety/wv-code-sect-15-2d-3.html http://www.wvlegislature.gov/wvcode/code.cfm?chap=05&art=11 http://www.wvlegislature.gov/wvcode/code.cfm?chap=05&art=11 https://drive.google.com/file/d/1wkFvstqVtM3mvBfX2By-m_bdhv0GRJ60/view https://drive.google.com/file/d/1NNqhRmfaK-SEa0PBuurIrIQGGvMYvvJc/view

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

6.6 OMIS Policy 0512 - Information Security Policy

6.7 OMIS Procedure #OP-35 – OMIS Vendor/Contractor Employee Background

Check Procedure

6.8 Appendix “A” – OMIS Contractor Background Check and Fingerprinting

Procedures

6.9 WV DH, DHF, DoHS and OSA New Contractor/Vendor Employee Checklist

7.0 REVISION HISTORY

Version Number Date Revisions

Version 1.0 04/26/2021 Original Version

Version 1.1 02/01/2022 Converted document from Word to Google

Docs; Updated formatting; annual review of content

Version 1.2 02/07/2023 Annual Review; updated links

Version 1.3 02/14/2024 Annual Update - changed “DHHR” to

“Departments of Health, Health https://docs.google.com/document/u/0/d/10Pib2BVrMXpyH6TYg3hFTm0DuGx0jmit3JDouvJnInU/edit https://intranet.wvdhhr.org/policies/IT/pdfs/Vendor_Contractor%20Employee%20Background%20Check%20Procedure_02012022.pdf https://intranet.wvdhhr.org/policies/IT/pdfs/Appendix%20A_2022%20OMIS_BackgroundCheck_Procedures_02012022.pdf https://intranet.wvdhhr.org/policies/IT/pdfs/Appendix%20A_2022%20OMIS_BackgroundCheck_Procedures_02012022.pdf

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

Facilities, Human Services, and Office of Shared Administration”, updated links, overall review of content, revised language throughout

Version 2.0 02/10/2025 Annual Review; updated links; overall review of content