Narrative: III. b. 6. D.

All core partners will agree to follow all applicable federal, state, and local laws pertaining to confidential information. Each partner will ensure that the collection and use of any information that contains personally identifiable information will be limited to purposes that support their programs and activities.

WIOA title I and III programs will follow the required privacy safeguards and protection of Personally Identifying Information (PII). Whenever possible, Florida uses unique identifiers for participant tracking. Florida adheres to the guidelines outlined in TEGL 39-11 regarding the protection of PII. Florida currently takes steps to ensure:

• that PII is not transmitted to unauthorized users and that all PII and sensitive data transmitted via email or through other storage means will be encrypted;
• the privacy of PII obtained from participants and other individuals and to protect that information from unauthorized disclosure;
• PII will be stored in an area physically safe from access by unauthorized persons; and
• authorized employees and personnel who have access to sensitive and confidential data are advised of the confidential nature of the data, the safeguards required to protect the information, and informed of the civil and criminal penalties associated with misuse of or noncompliance with privacy safeguards.

Adult education programs currently ensure compliance with the federal Family Educational Rights and Privacy Act, 20 U.S.C. sec 1232g, and all other relevant federal and state privacy laws including laws related to the UI system.

FDBS implements the following information technology and confidentiality policies:

• Client Confidentiality and Release of Client Information Policy 2.03:

All employees and volunteers of DBS must know the procedures concerning the release of confidential information. Evidence of this understanding is required by signing DBS-019 Form - Compliance with Confidentiality Procedures.

Florida Statutes state that applicant and client records are confidential (FS 413.012). All oral and written records, information, letters, and reports pertaining to rehabilitation programs under DBS are confidential and must not be made available for public disclosure. Anyone who releases or discloses such records, information, or communications without proper authorization may be found guilty of a misdemeanor in the second degree.

Applicants, clients, service providers, and cooperating agencies must be informed of the confidentiality of personal information and the conditions under which it may be released. Division staff should not release any information to a third party except in case of litigation, which is discussed in detail within this procedure. Applicant and client information is routinely sent to contracting facilities and to the Rehabilitation Center because it is needed in the applicants or client’s rehabilitation process. Clients and applicants will be told how this information will be used and sign a release indicating their agreement. When sensitive information is part of the record, such as documentation of a sexually transmitted disease, DBS Staff will ensure that the client knows that this is part of the case record. She/he may not want that part of the record forwarded to the third party and has the right to have this information withheld.

• DBS Policy IT 70-008: (Classification of data between confidential and public and requirements for handling confidential data)

Authority: Florida Statutes Section 282.318, Florida Statutes Section 413.012, Florida Administrative Code 71A-1, Florida Statutes 119.071

Establishes classifications for information stored and processed by FDBS, and prescribes the requirements to protect confidential data. Information stored or processed by FDBS shall be classified and provided the level of protection based on its classification. Data may be stored in databases and files, and transmitted internally to other agencies or externally to third parties. The controls for protecting the data are generally defined at the system or database level.

1. Confidential data is restricted by law or regulation and requires safeguards to protect it from unauthorized access or disclosure; confidential data may require reporting to governing authorities or individuals if lost or exposed in an unauthorized manner.

2. Public data is not restricted by law or regulation, and is therefore available for public access.

3. FDBS follows the policy and procedures for confidential information in the document entitled DOE Data Classification and Handling, and under contractual agreement for Community Rehabilitation Programs (CRPs).

This policy is applicable to all employees and contractors that access DBS information resources, and violation of the policy may result in disciplinary action up to and including termination. Violation of this policy by any vendors or third parties may result in action up to and including contract cancellation.

FDBS information resources shall be strictly controlled to prevent unauthorized access. Logical access controls shall be selected in accordance with the classification of the information asset being protected.

Requirements:

1. Agency computer users, with access to confidential data, should have unique user accounts.

2. The agency should implement controls and documented procedures to ensure access to information technology resources is restricted to authorized users and uses. Information technology workers, such as those in the MIS section, should be granted access to information resources based on the principles of ‘least privilege” and the “need to know”.

3. Access rights should be reviewed periodically based on risk, access account change activity, and error rate, but not less than biennially.

4. Access authorization shall be removed when the user’s employment is terminated or access is no longer needed.

5. Applications which access confidential data, when feasible, should be set to timeout after 15 minutes of inactivity.

6. Workstations and mobile computing devices should have a password protected screensaver set to engage after 15 minutes or less of inactivity.

7. Standards and procedures for granting remote access, defined as VPN or dialup access to participate in the DBS network as if attached locally, should be established.

8. Remote access should be granted only for legitimate agency business.

9. Remote access accounts should not be shared or used by others than to whom they are assigned.

10. Service accounts should be maintained to protect information resources and when feasible not used for interactive sessions.

11. Service accounts may be exempted from password expiration.

12. Administrative rights for information resources should be restricted to information technology workers who are authorized based on job responsibilities.

13. Administrative accounts should be created, maintained, monitored and terminated in a manner that protects information resources.

14. Administrative account activities, when feasible, should be traceable to an individual.

Procedures:

1. AWARE Account Procedures

2. Network Access Control Procedures

3. QPIS Report Access Request Procedures

4. RSVP Account Procedures

5. SSRA Account Procedures

The Director may modify the policy as needed to reflect the current needs of DBS. Federal laws, state laws, or other regulatory requirements may preempt this policy.

This policy is applicable to all employees and contractors that access DBS information resources, and violation of the policy may result in disciplinary action up to and including termination. Violation of this policy by any vendors or third parties may result in action up to and including contract cancellation.