Agenda Packet_2022-03-15 - Laserfiche WebLink

Home Browse Search

ATTACHMENT C SOCIAL SERVICES AGENCY POLICY AND PROCEDURE F 21: PRIVACY AND SECURITY INCIDENTS OF PERSONALLY IDENTIFIABLE INFORMATION (PII) AND CONFIDENTIAL INFORMATION I. PURPOSE To establish a process and guidelines for Social Services Agency (SSA) to report, document and investigate privacy and security incidents of Personally Identifiable Information (PII) and confidential information. II. POLICY Orange County Social Services Agency (OCSSA) workforce, volunteers and contractors/vendors shall comply with all applicable Federal and State laws, regulations, policies and procedure regarding the safeguarding of PII and confidential information and incident reporting protocols. This policy applies to all data sources and systems with any PII and other forms of confidential information that staff access in the performance of their duties via any medium including electronic, paper, and verbal. III. DEFINTIONS Action Officer: Person responsible for ensuring the program rectifies any issues identified with a breach. In most cases, it will be the program or regional manager. Authorized Persons: are employees of the Agency who meet the following criteria: Need to access PII and other forms of confidential information in order to perform their job duties; Have completed all required security and confidentiality training; and Have completed all required security certifications relevant to the data which are on file and available for review by an outside agency. Breach: Refers to actual loss, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for other than authorized purposes have access or potential access to PII, whether electronic, paper, verbal or recorded. WQM0522 Page 1 of h March 1, 2022 City Council 20 — 75 3/15/2022