2009 - 07-20-09 Regular Meeting - Laserfiche WebLink

Home Browse Search

BOOK 22 mE S$3 Take reasonable measures when destroying sensitive data that will prohibit the information from being read or reconstructed. Documents with sensitive data should be shredded by the individual who has authorized access to the data or by another employee while in the presence of the authorized employee. The County may enter into a written contract with a third party in the business of record destruction to destroy sensitive information in a manner consistent with this policy. (c) In order to protect sensitive and confidential information, the County will only release sensitive information to the account holder or individual(s) who own the information upon confirmation of personal identifying information or a valid picture ID. The confirmed account holder or individual may authorize the release of sensitive information to a third party. Confidential information will only be released in accordance with state statute. The only exception will be the release of specified information pursuant to a court order, warrant, subpoena or other requirement by law. 2. Identification of Red Flags The Red Flags rule defines "Identity Theft" as "fraud" using "identifying information" of another person. "Identifying information" includes: name, address, telephone number, social security number, date of birth, government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number, unique electronic identification number, computer's internet protocol address, routing code. In order to identify relevant Red Flags, the County considers the types of accounts that is offers and maintains, the methods it provides to open its accounts, the methods it provides to access its accounts, and any previous experiences with Identity Theft. (a) Steo 1. Employees shall be aware of the following "Red Flags: that suggest a breach of sensitive or confidential information as occurred. 1. Physical Breach - The following are indications that there has been unauthorized access to sensitive and confidential information via a physical breach. Other activities may occur that are also physical breaches that are not included in this listing. a. Evidence of lock tampering on file cabinets or office doors. b. Evidence of unauthorized entry in an area where sensitive and confidential information is stored. c. Missing files or documents that contain sensitive information. Identity Theft/Red Flag Rules Page 5