500 likes | 927 Views
Data Classification & Privacy Inventory Workshop. Implementing Security to Protect Privacy November 2005. Welcome & Introductions. Debra Reiger, State Information Security Officer Joanne McNabb, California Office of Privacy Protection Lester Chan,, California Office of HIPAA Implementation.
E N D
Data Classification & Privacy Inventory Workshop Implementing Security to Protect Privacy November 2005
Welcome & Introductions • Debra Reiger,State Information Security Officer • Joanne McNabb,California Office of Privacy Protection • Lester Chan,,California Office of HIPAA Implementation
Workshop Agenda • Welcome & Introductions - Debra Reiger • Information Privacy & Security - Joanne McNabb • Introduction to State Policy on Data Classification - Debra Reiger • Break • Protected Health Information - Lester Chan • Conducting a Privacy Inventory - Joanne McNabb • Workshop Exercise - Lester Chan
Information Privacy & Security • Privacy: Individual’s interest in controlling the handling of his/her personal information • Security: Organization’s interest in protecting information assets from unauthorized acquisition, damage, disclosure, manipulation, modification, loss, or use • Information security is essential to privacy protection.
“Personal information is like toxic waste – Managing it requires a high level of skill and training.” -Phil Agre, Technology and Privacy in a New Landscape
Why Protect Personal Information • Law and Policy • Information Practices Act, HIPAA • Data Classification, Encryption (soon) • Risk Reduction • SAM • Security breach notification law (Civil Code § 1798.29) – Cost of notification $1-$25 per notice • Identity Theft • > 9 Million victims and $52.6 Billion in 2004
Protecting Personal Information • Classifydata and identify records systems containing personal identifying information. • Locate records needing special protection: • Notice-Triggering Personal Information • Health Information (Protected or Electronic) • Protect with appropriate security measures • Administrative, Technical, Physical
State Policy on Classifying Data Classification of Information
Introduction • State policy requires that we identify and classify our data and protect it appropriately. • See SAM Sections 4840-4845 • Automated files and databases are essential public resources. • We are the protectors of the public’s information. • We must first classify and locate data before we can properly protect it.
Information Protection • Give appropriate protection from unauthorized: • Use • Access • Disclosure • Modification • Loss • Deletion
Information Classifications • Public Information • Confidential Information
Public Information • Information not exempt from disclosure under the provisions of the California Public Records Act or other applicable state or federal laws
Confidential Information • Information exempt from disclosure under the provisions of the California Public Records Act or other applicable state or federal laws
Sensitive & Personal Info • Sensitive and personal information may occur in public and/or confidential records. • Files and databases containing sensitive and/or personal information require special precautions to prevent inappropriate disclosure.
Sensitive Information • Requires special precautions to protect from: • Unauthorized use • Access • Disclosure • Modification • Loss • Deletion
Sensitive Information • May be either • Public, or • Confidential. • Requires a higher than normal assurance of accuracy and completeness. • Key factor is integrity. • Typical records are agency financial transactions and regulatory actions.
Personal Information • Identifies or describes an individual • Must be protected from inappropriate • Access • Use • Disclosure • Must also be accessible to data subjects upon request
Personal Information • Identifies or describes an individual: • Name • Home address • Home phone • etc. • Sub-types of Personal Information: • Notice-Triggering Personal Information • Medical Information • Protected Health Information • Electronic Health Information
Notice-Triggering Personal Info • Name plus specific items or personal information: • Social Security Number • Driver’s license/I.D. card number • Financial Account Number • Requires notifying individuals if it is acquired by an unauthorized person.
Protected Health Information HIPAA Covered Entities
Protected Health Information • Individually identifiable information created, received, or maintained by health care payers, providers, health plans or contractors, in electronic or physical form. • State and federal laws require special precautions to protect from unauthorized use, access, or disclosure.
Electronic Health Information • Individually identifiable health information transmitted by electronic media or maintained in electronic media
Electronic Health Information • Health plans, clearinghouses or providers must ensure the privacy and security of electronic protected health information from unauthorized use, access or disclosure
Current Information • Assess current systems for protected health information in physical (paper) and electronic form. • Include personal information in the data classification portion of risk analysis and risk management • Risk analysis and risk management are required of HIPAA covered entities
Future Data Systems • Be aware of these data classifications as more data is created, maintained or transmitted. • Plan for protecting your data during the system design phase. • Collect data that you have the authority and need to collect.
Conducting a Privacy Inventory Where is your data? Where is your personal data?
Privacy Inventory Process • ISO/PO gets management support. • Each division/program identifies “Privacy Contact.” • ISO/PO explains process to Privacy Contacts. • Privacy Contacts complete Privacy Inventory Worksheet. • ISO/PO/Program implement appropriate safeguards. • ISO/PO conduct ongoing privacy awareness training for users (more on this later).
Overview of Worksheet • Part I: Records System Inventory • Part II: Privacy Practices Inventory
Part I of Inventory Worksheet • Records Systems Containing Personal Information • Start with Records Inventory for Records Retention Schedule • List only Records Systems containing personal information
1. Records System • Group of records maintained for official purposes • Same as “Records Series” in Records Retention Handbook: Group of related records under a single filing category that deal with particular subject
Personal Information • Information that describes an individual, including name, home address, home phone, etc. – defined in Civil Code 1798.3 • Information on clients, consumers, applicants, licensees, employees, contractors – everyone
2. Description of Records • Examples • Applications for general contractor’s license • Personnel records of current employees • Case records of recipients of in-home supportive service, past and present • Consumer complaints
3. Sources of Records • Examples: • Subject supplies information on application form • Schools provide information on transcripts. • DOJ provides information from criminal history records
4. Owner and Location • Owner: Department/Division/Program that collects and maintains the records • Location: Agency name and address where original records system is located • Contact: Name, title, business contact information of agency official responsible for records system
5. Authority • Citation of regulation or statute authorizing agency to collect and maintain records system
6. Media of Records System • Medium of “original” records system: electronic, paper, tape • Additional media on which records are stored or used: • PC • Laptop • Other portable device or medium
7. Type of Personal Information • Objective: Identify records systems containing personal information needing special protections • Notice-triggering personal information (name plus SSN, DL/State ID number, financial account number) • Health/medical information • Other personal information (Home Address, MMN, DOB, etc.)
8. Confidential or Sensitive Info • Does the records system contain any confidential or sensitive information (other than personal information)? • Confidential: Exempt from PRA • Sensitive: For example, network configuration, agency bank records
9. Routine Uses & Disclosures • Purposes for which records were created • Uses and users • Disclosures outside agency that collects and maintains records system
Part II of Inventory Worksheet • Privacy Practices • Checklist of major practices per IPA, Government Code, etc. • Optional – but good way to start to build privacy awareness
1. Privacy Policy Statement • Is your agency’s privacy policy statement posted in your office(s)? • Is it posted on your Web site(s)? • Government Code 11019.9
2. Rules of Conduct • Does your program/agency have written rules of conduct for handling records containing personal information? • Civil Code 1798.20 • If so, attach copy to Worksheet.
3. Access Guidelines • Does your program/agency have regulations or guidelines telling individuals how they can access their own records? • Civil Code 1798.34 – 1798.44 • If so, attach copy to Worksheet.
4. Notice on Collection • How do you provide notice (of authority, uses, disclosures, access procedures, etc.) when collecting personal information? • Civil Code 1798.17 • Printed on paper forms • On online forms • Other
5. Public Records Act Disclosures • Do you have written procedures for responding to PRA requests? • How do you protect personal information in public records? • If so, attach copy to Worksheet.
6. Retention & Destruction • Is this records system listed in your Records Retention Schedule?
7. Incident Notification Procedures • Does the program/division/department have written procedures for notification of privacy/security incidents? • For example, lost/stolen laptop containing (possibly notice-triggering) personal information: Report as information security incident, not property theft
Privacy Awareness • Privacy Inventory raises awareness of privacy vulnerabilities and protection requirements • Ongoing awareness training for all users is essential • Coming soon from COPP
End of Presentation • Questions • Comments