OMIS Policy #0529 Vendor-Contractor Employee Background Check.pdf

State of West Virginia

Departments of Health, Health Facilities, and Human Services

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

Employee Background Check

Revised: July 06, 2026

1.0 PURPOSE

The Office of Management Information Services (OMIS) is committed to taking meaningful actions to ensure all data, systems, and other assets within the WV Departments of Health (DH), Health Facilities (DHF), Human Services (DoHS), and the Office of Shared Administration

(OSA), are properly supported by qualified vendors and contractors. This policy outlines OMIS’ guidelines to ensure fingerprint-based state and federal background checks for all contracted employees are conducted according to established standards.

2.0 SCOPE

This policy applies to all DH, DHF, DHS and OSA vendor, contractor, and sub-contractor employees providing services to the State who access, or may potentially access, sensitive and confidential data {i.e., protected health information (PHI), personally identifiable information

(PII), social security administration (SSA) data, federal tax information (FTI), and/or payment card information (PCI)}.

3.0 POLICY

3.1 All background checks will be applied and administered uniformly, fairly, and without prejudice.

3.2 In accordance with W. Va. Code § 15-2D-3(e), the Director of the WV Division of

Protective Services (DPS) requires any newly hired vendors, contractors, and sub-contractors whose employees work on the grounds or in the buildings of the

State Capitol complex (including all Agency facilities), or who have access to sensitive or critical information, to complete a fingerprint-based state and federal background check before being granted any physical or logical access to State facilities, systems, networks, or data. No access of any kind may be authorized until the background check has been fully completed and favorably adjudicated.

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

3.3 The Agency will work closely with the contracting company and DPS to ensure that each existing vendor, contractor, and sub-contractor with access to sensitive and confidential data receives a complete fingerprint-based state and federal background check. This process is outlined in OMIS Procedure OP-35, OMIS

Vendor and Contractor Employee Background Check Process.

3.4 In accordance with WV State Code, contracting companies will be informed during the contract award process that acceptance of any employee(s) permitted to access

PHI, PII, FTI, SSA data, and/or PCI data is fully contingent upon proof of a completed and favorably adjudicated fingerprint-based state and federal background check. No physical or logical access to State facilities, systems, networks, or sensitive data may be granted until adjudication is complete.

3.5 Prior to conducting a background check, signed, written consent will be obtained from each applicant. Refusal to authorize the background check; failure to disclose a criminal conviction; or failure to provide truthful, accurate, and complete information will render the applicant ineligible for employment with the

Departments.

3.6 Under certain conditions, a contractor or vendor may work on a provisional basis for not more than sixty (60) days pending notification from DPS regarding the results of the criminal background check. During this provisional period, individuals are strictly prohibited from accessing PHI, PII, FTI, SSA data, PCI, or any other sensitive or confidential information, and may not be granted system credentials or facility access associated with sensitive operations. Additional information is outlined in OMIS Procedure OP-35.

3.7 If the contract holder has conducted state and federal fingerprint-based background checks on its employees within three (3) years of the contract’s effective date, a list of authorized staff assigned to the project, as well as results of the checks, must be submitted to the applicable bureau or office for review.

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

3.8 Agency contract managers will be responsible for initiating reinvestigations for all contractors, vendors, and subcontractor personnel with access to sensitive or confidential data every three (3) years from the date of their previous background investigation. The Departments reserve the right to rescreen individuals at any time, consistent with the criticality or sensitivity risk designation of the position, changes in job duties, or updated federal or State requirements.

3.9 All background check documentation—including fingerprint submissions, adjudication results, provisional access records, and reinvestigation outcomes— must be maintained by the applicable bureau or office for a minimum of five (5) years and made available upon request for federal, state, or internal audit review.

Records must be stored securely and retained in accordance with applicable data protection, privacy, and records-management requirements.

3.10 OMIS may require additional or enhanced background screening based on the risk designation, sensitivity of the position, access level, or changes in federal or state security requirements. This may include expanded criminal history checks, identity verification measures, or other screening activities deemed necessary to ensure the protection of State systems, facilities, and sensitive data.

3.11 This policy is designed to support compliance with applicable federal and state security and privacy requirements, including NIST SP 800-53 Rev. 5 personnel security controls, CMS ARC-AMPE safeguards for PHI/PII/FTI, and IRS

Publication 1075 requirements for protecting Federal Tax Information. All background screening, adjudication, documentation, and reinvestigation activities must be carried out in accordance with these standards to ensure the protection of

State systems, facilities, and sensitive data.

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

4.0 ENFORCEMENT

Violation of this policy by external entities, including vendors, contractors, and/or consultants, may result in termination of the relationship and/or associated privileges. Violation may also result in civil and criminal penalties as determined by federal and state laws and regulations.

5.0 DEFINITIONS

5.1 Confidential Data – Information that is legally protected (ex: Protected Health

Information) or otherwise deemed by a qualified expert to be unsuitable for open access.

5.2 Contractor – Contractors include, but are not limited to, information providers, information processors, and other organizations that provide information system development, information technology services, consumer assistance, AE business functions, and other outsourced applications, roles, and functions.

5.3 Employee – Individuals retained and authorized on a temporary or permanent basis by the State of West Virginia to perform a service. For the purposes of this procedure, the term “employee” will include the following: contractors, subcontractors, contractors’ employees, volunteers, county health department staff, business associates, and any other persons who are determined to be subject to this procedure. This definition does not create any additional rights or duties.

5.4 Federal Tax Information (FTI) – According to the IRS Publication 1075, FTI is defined as any return or return information received from the IRS or secondary source, such as SSA, Federal Office of Child Support Enforcement or Bureau of

Fiscal Service. FTI includes any information created by the recipient that is derived from return or return information.

5.5 Office of Management Information Services (OMIS) – This office reports directly to the DoH, DHF, DHS and OSA Secretaries and provides the leadership, Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor innovation, and services needed to achieve efficient and effective technology solutions to meet the goals of the Agencies.

5.6 Payment Card Industry Data Security Standard (PCI DSS) – A proprietary information security standard for organizations that handle branded credit cards from the major card schemes.

5.7 Personally Identifiable Information (PII) - All information that identifies, or can be used to identify, locate, or contact (or impersonate) a particular individual.

Personally identifiable information is contained in both public and non-public records. Examples may include but are not limited to a specific individual’s: first name (or initial) and last name (current or former); geographical address, electronic address (including an e-mail address); telephone number or fax number dedicated to contacting the individual at their physical place of residence; social security number; credit and debit card numbers; financial records, including loan accounts and payment history; consumer report information; mother’s maiden name;

biometric identifiers, including but not limited to, fingerprints; facial recognition and iris scans; driver identification number; full face image; birth date; birth or adoption certificate number; physical description; genetic information; medical, disability or employment records, including salary information; computer information, including information collected through an Internet cookie; criminal history, etc. When connected with one or more of the items of information specified above, PII includes any other information concerning an individual, that if disclosed, identifies or can be used to identify a specific individual physically or electronically.

5.8 Protected Health Information (PHI) - Individually identifiable health information that is received, created, maintained or transmitted by the organization, including demographic information, that identifies an individual, or provides a reasonable basis to believe the information can be used to identify an individual, and relates to:

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

· Past, present or future physical or mental health or condition of an individual;

· The provision of health care to an individual; and

· The past, present, or future payment for the provision of health care to an individual.

Privacy and Security Rules do not protect the individually identifiable health information of persons who have been deceased for more than 50 years.

5.9 Sensitive Data – This includes safeguarded information or anything the organization, its employees, customers, or contractors would expect to be private and protected. Direct access is limited to authenticated and authorized individuals who require access to that information in the course of performing their job duties.

Examples include: most data in employee records, employment and training program data, historical records repository data, client-specific data, etc.

6.0 REFERENCES/RELATED MATERIAL

6.1 Internal Revenue Service (IRS) Publication 1075 – Tax Information Security

Guidelines for Federal, State, and Local Agencies; Safeguards for Protecting

Federal Tax Returns and Return Information

6.2 Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE)

CMS modernized cybersecurity and privacy framework

6.3 Payment Card Industry Data Security Standards (PCI DSS)

6.4 National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5

6.5 WV State Code § 15-2D-3 (e) - Duties and Powers of the Director and Officers

6.6 West Virginia Human Rights Act (WV Code Sec. 5-11-1 et seq.)

https://www.irs.gov/pub/irs-pdf/p1075.pdf chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https:/nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://codes.findlaw.com/wv/chapter-15-public-safety/wv-code-sect-15-2d-3.html http://www.wvlegislature.gov/wvcode/code.cfm?chap=05&art=11 http://www.wvlegislature.gov/wvcode/code.cfm?chap=05&art=11

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

6.7 WVOT-PO1001 – Information Security Policy

6.8 WVOT-PO1006 – Data Classification

6.9 OMIS Policy 0512 - Information Security Policy

6.10 OMIS Procedure #OP-35 – OMIS Vendor/Contractor Employee Background

Check Procedure

6.11 Appendix “A” – OMIS Contractor Background Check and Fingerprinting

Procedures

6.12 WV DH, DHF, DoHS and OSA New Contractor/Vendor Employee Checklist

7.0 REVISION HISTORY

Version Number Date Revisions

Version 1.0 04/26/2021 Original Version

Version 1.1 02/01/2022 Converted document from Word to Google

Docs; Updated formatting; annual review of content

Version 1.2 02/07/2023 Annual Review; updated links https://drive.google.com/file/d/1wkFvstqVtM3mvBfX2By-m_bdhv0GRJ60/view https://drive.google.com/file/d/1NNqhRmfaK-SEa0PBuurIrIQGGvMYvvJc/view https://docs.google.com/document/u/0/d/10Pib2BVrMXpyH6TYg3hFTm0DuGx0jmit3JDouvJnInU/edit https://www.wvdhhr.org/mis/policies/Vendor_Contractor_Background_Check_Procedure.pdf https://www.wvdhhr.org/mis/policies/Appendix_A_Background_Check_Fingerprinting_Procedures.pdf https://www.wvdhhr.org/mis/policies/Appendix_A_Background_Check_Fingerprinting_Procedures.pdf

Office of Shared Administration

Office of Management Information Services (OMIS)

Policy #0529: OMIS Vendor/Contractor

Version 1.3 02/14/2024 Annual Update - changed “DHHR” to

“Departments of Health, Health

Facilities, Human Services, and Office of Shared Administration”, updated links, overall review of content, revised language throughout

Version 2.0 02/10/2025 Annual Review; updated links; overall review of content

Version 2.1 01/26/2026 Annual review; updated links, overall review of content and format

Version 2.1.1 07/06/2026 Revision of sections 3.5-3.8; added sections 3.9, 3.10, 3.11