OMIS Procedure #OP-35.pdf

State of West Virginia

Departments of Health, Health Facilities, and Human Services

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor

Employee Background Check Procedure

Revised: July 06, 2026

1.0 PURPOSE

In accordance with W. Va. Code § 15-2D-3, the Director of the WV Division of Protective Services

(DPS) requires all newly hired vendors, contractors, and sub-contractors whose employees are regularly employed on the grounds or in the buildings of the State Capitol complex {this includes all WV Departments of Health (DH), Health Facilities (DHF), Human Services (DoHS), and

Office of Shared Administration (OSA) facilities}, or who have access to sensitive and/or confidential data, are required to submit to a fingerprint-based state and federal background check prior to receiving access to State data and/or systems.

This document outlines the procedure all contracted employees within the Departments must follow when receiving fingerprint-based state and federal background checks, to ensure these investigations are conducted according to established federal and state requirements.

2.0 SCOPE

This procedure applies to all vendor, contractor, and sub-contractor employees employed by the

Departments providing services to the State who access, or may potentially access, sensitive and/or confidential data {i.e., protected health information (PHI), personally identifiable information

(PII), social security administration (SSA) data, federal tax information (FTI), and/or payment card information (PCI)}.

3.0 PROCEDURE

3.1 All OMIS vendors, contractors, and sub-contractors must adhere to the process set forth in Appendix “A” of this procedure, titled OMIS Vendor/Contractor

Background Check and Fingerprinting Procedures.

3.2 Agencies will collaborate, as needed, with the contracting company and DPS to ensure the background check process is applied and administered uniformly, fairly, and without prejudice.

https://www.wvdhhr.org/mis/policies/Appendix_A_Background_Check_Fingerprinting_Procedures.pdf https://www.wvdhhr.org/mis/policies/Appendix_A_Background_Check_Fingerprinting_Procedures.pdf

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor

3.3 The contracting company will be responsible for all background investigation costs.

Payment must be made at the time of the fingerprinting process (see Appendix A).

3.4 Background investigations at a minimum, will include the following:

3.4.1 A Federal Bureau of Investigation (FBI) national agency check allows DPS to check the applicant’s criminal history in all U.S. states and territories.

3.4.2 A check through local law enforcement in the location(s) the applicant has lived, worked, and/or attended school within the last five (5) years, and if applicable, the appropriate agency for any identified arrests.

3.4.3 Social Security validation, which ensures an applicant's social security number (SSN) is legitimate and finds all names, including aliases and variations, dates of birth and address history associated with the SSN.

3.4.4 Proof of citizenship/residency (i.e., USCIS Form I-9), to validate the applicant is a U.S. citizen or a foreign citizen with the necessary authorization to work in the U.S. (For more information see the following link: https://www.e-verify.gov.).

3.4.5 OMIS reserves the right to require additional or enhanced background screening activities (such as expanded criminal history checks or deeper identity verification measures) based on the specific risk designation, sensitivity of the position, access level, or updated federal and state security requirements.

3.5 All fingerprint-based background checks must be favorably adjudicated prior to allowing the vendor or contractor to access sensitive and/or confidential data.

3.6 If the background check does not reveal any type of conviction or disqualifying offense, the DPS will notify the OMIS Quality and Compliance unit and/or the agency point of contact, as well as the contracting company, that the applicant has https://www.e-verify.gov/ https://www.e-verify.gov/

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor passed the background check. In this case, the hiring process or employment status will not be impacted.

3.7 Results of unfavorable background checks will be returned to the DPS and treated as confidential. According to federal law, the DPS may only share unfavorable results with the applicant whose background check results in a rejection of employment (i.e., adverse action). Applicants have the right to challenge the accuracy contained in the federal identification record in accordance with state and federal laws and guidelines (see Attachment “A”).

3.8 Variance/Appeal Process

3.8.1 If the pre-screening process reveals a negative finding, or if the DPS issues a notice of ineligibility, the applicant, or the employer on the applicant's behalf, may file a written request for a variance with the Departments no later than 30-days after the date of the notice. Agencies may grant a variance under the following conditions:

(1) Mitigating circumstances surrounding the negative finding or disqualifying offense is provided.

(2) The Departments find that the individual will not pose a danger or threat to residents, members, and their property.

3.8.2 Agencies will mail to the applicant and the contractor a written decision within 90-days of receipt of the request indicating whether a variance has been granted or denied.

3.8.3 If an applicant believes his or her State criminal history record information is incorrect or incomplete, he or she may challenge the accuracy of the record by contacting DPS for a personal review. If the discrepancies are at the charge or final disposition level, the applicant must address this with the court or arresting agency that submitted the record.

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor

3.8.4 If an applicant believes his or her federal criminal history record information is incorrect or incomplete, he or she may appeal for the accuracy of such information by contacting the Federal Bureau of

Investigation (FBI) for instructions.

3.8.5 If any changes, corrections, or updates are made in the criminal history record information, the DPS will notify the Agency that the applicant has appealed the accuracy of the criminal history records and provide the updated results of the criminal history record information check.

3.8.6 If the DPS finds the applicant has intentionally falsified information or misrepresented him/herself in any way (e.g., applicant does not disclose a criminal conviction; fails to provide truthful, accurate, and complete information regarding a criminal conviction(s), etc.) the applicant may be disqualified from hire and/or prohibited from future employment with the

State.

3.9 Provisional Employment

3.9.1 A contractor may work on a provisional basis for up to sixty (60) days pending DPS notification of the criminal background check results, in accordance with state and federal requirements. During this period, the individual is strictly prohibited from accessing sensitive data, receiving system credentials, or obtaining facility access associated with sensitive operations, and only if the following conditions are met:

(1) The applicant is subject to direct on-site supervision, as specified in rule by the Departments’ Cabinet Secretaries, during the provisional period; and

(2) In a signed statement the applicant must:

(A) Affirm that he or she has not committed a disqualifying offense;

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor

(B) Acknowledge that a disqualifying offense reported in the required criminal history record information check shall constitute good cause for termination; and

(C) Acknowledge that the contractor may terminate the individual if a disqualifying offense is reported in the background investigation.

(3) Provisional contractor employees who have requested a variance will not be required to sign such a statement. A covered contractor may continue to employ an individual if he or she applies for a variance of his or her fitness determination until the variance is resolved.

3.10 If the contracting company has conducted state and federal fingerprint-based background checks on its employees within three (3) years of the contract’s effective date, a list of authorized staff assigned to the project, as well as results of the checks, must be submitted must be submitted to the applicable bureau, office, or the OMIS Director of Quality and Compliance for review and approval.

3.11 Agency contract managers will be responsible for initiating re-investigations for contractors and vendors every three (3) years from the date of their previous background investigations. Agencies have the right to re-screen individuals periodically, consistent with the criticality/sensitivity risk designation of the position.

3.12 All background check documentation—including fingerprint submissions, adjudication results, provisional access records, and reinvestigation outcomes— must be securely stored and maintained by the applicable bureau or office for a minimum of five (5) years. These records must be made available upon request for federal, state, or internal audit reviews.

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor

4.0 ENFORCEMENT

Violation of this procedure by external entities, including vendors, contractors, and/or consultants, may result in termination of the relationship and/or associated privileges. Violation may also result in civil and criminal penalties as determined by federal and state laws and regulations.

5.0 DEFINITIONS

5.1 Adverse Action - An action companies take based on the information in a background check report that negatively affects an applicant's employment. An adverse action letter is a written notice required by federal law, delivered in hard copy or electronic form, that informs a job candidate he or she will not be hired for a particular position because of the findings in a background check.

5.2 Division of Protective Services (DPS) – Office within the West Virginia

Department of Military Affairs and Public Safety created to provide for the safety and security of individuals who visit, conduct business or work at the Capitol

Complex and other state facilities.

5.3 Employee – Individuals retained and authorized on a temporary or permanent basis by the State of West Virginia to perform a service. For the purposes of this policy, the term “employee” will include the following: contractors, subcontractors, volunteers, county health department staff, business associates, and any other persons who are determined to be subject to this procedure. This definition does not create any additional rights or duties.

5.4 Federal Tax Information (FTI) – According to the IRS Publication 1075, FTI is defined as any return or return information received from the IRS or secondary source, such as SSA, Federal Office of Child Support Enforcement or Bureau of

Fiscal Service. FTI includes any information created by the recipient that is derived from return or return information.

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor

5.5 Negative Finding – a finding in the prescreening that excludes an applicant from direct access personnel positions.

5.6 Office of Management Information Services (OMIS) – This office reports directly to the DoH, DHF, DHS and OSA Cabinet Secretaries and provides the leadership, innovation, and services needed to achieve efficient and effective technology solutions to meet the goals of the Departments.

5.7 Payment Card Industry Data Security Standard (PCI DSS) – A proprietary information security standard for organizations that handle branded credit cards from the major card schemes.

5.8 Personally Identifiable Information (PII) - All information that identifies, or can be used to identify, locate, or contact (or impersonate) a particular individual.

Personally identifiable information is contained in both public and non-public records. Examples may include but are not limited to a specific individual’s: first name (or initial) and last name (current or former); geographical address, electronic address (including an e-mail address); telephone number or fax number dedicated to contacting the individual at their physical place of residence; social security number; credit and debit card numbers; financial records, including loan accounts and payment history; consumer report information; mother’s maiden name;

biometric identifiers, including but not limited to, fingerprints; facial recognition and iris scans; driver identification number; full face image; birth date; birth or adoption certificate number; physical description; genetic information; medical, disability or employment records, including salary information; computer information, including information collected through an Internet cookie; criminal history, etc. When connected with one or more of the items of information specified above, PII includes any other information concerning an individual, that if disclosed, identifies or can be used to identify a specific individual physically or electronically.

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor

5.9 Protected Health Information (PHI) - Individually identifiable health information that is received, created, maintained or transmitted by the organization, including demographic information, that identifies an individual, or provides a reasonable basis to believe the information can be used to identify an individual, and relates to:

· Past, present or future physical or mental health or condition of an individual;

· The provision of health care to an individual; and

· The past, present, or future payment for the provision of health care to an individual.

Privacy and Security Rules do not protect the individually identifiable health information of persons who have been deceased for more than 50 years.

5.10 Vendor/Contractor – See 5.3, definition of Employee

6.0 REFERENCES/RELATED MATERIAL

This procedure applies to all relevant federal and state statutes pertaining to the following:

6.1 Internal Revenue Service (IRS) Publication 1075 – Tax Information Security

Guidelines for Federal, State, and Local Agencies; Safeguards for Protecting

Federal Tax Returns and Return Information

6.2 CMS Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-

AMPE) controls

6.3 National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5

(specifically Personnel Security [PS] controls)

6.4 West Virginia Human Rights Act (WV Code Sec. 5-11-1 et seq.)

https://www.irs.gov/pub/irs-pdf/p1075.pdf https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home http://www.wvlegislature.gov/wvcode/code.cfm?chap=05&art=11 http://www.wvlegislature.gov/wvcode/code.cfm?chap=05&art=11

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor

6.5 WVOT PO1001 – Information Security Policy

6.6 WVOT-PO1006 - Data Classification

6.4 OMIS Policy #0512 - Information Security Policy

6.5 OMIS Policy #0529 - OMIS Vendor/Contractor Employee Background Checks

6.6 Appendix “A” – OMIS Contractor Background Check and Fingerprinting

Procedures

6.7 WV DH, DHF, DoHS and OSA New Contractor/Vendor Employee Checklist

7.0 REVISION HISTORY

Version Number Date Revisions

Version 1.0 04/26/2021 Original version

Version 1.1 02/01/2022 Converted document from Word to Google

Docs; Updated formatting; annual review of content

Version 1.2 02/07/2023 Annual Review; updated policy links

Version 1.3 02/14/2024 Annual Update - changed “DHHR” to

“Departments of Health, Health https://drive.google.com/file/d/1wkFvstqVtM3mvBfX2By-m_bdhv0GRJ60/view https://drive.google.com/file/d/1sb4BG3CW9IRnOxxYKgSICGDURJYgYjrU/view https://www.wvdhhr.org/mis/policies/Information_Security_Policy.pdf https://www.wvdhhr.org/mis/policies/Vendor_Contractor_Background_Check_Policy.pdf

Office of Shared Administration

Office of Management Information Services (OMIS)

Procedure # OP-35: OMIS Vendor/Contractor

Facilities, Human Services, and Office of Shared Administration”, updated links, overall review of content, revised language throughout

Version 2.0 02/10/2025 Annual Review/Update - review of links, overall review of content and format

Version 2.1 01/26/2026 Annual review and update; revised links; overall review of content and format

Version 2.1.1 07/06/2026 Revised sections 3.9 and 3.10 and added sections 3.12 to align with Policy #0529

(v2.1.1) updates and ensure compliance with NIST SP 800-53 Rev. 5, CMS

ARC-AMPE, and IRS Pub 1075 standards.