1018-4          CONFIDENTIALITY

Confidentiality is essential in maintaining records, sending documents, and working with clients. Work Services providers will adhere to all DPADivision of Public Assistance confidentiality expectations, see Admin MS 100-3.

All WSPWork Services Providers who serve or interact in any manner with clients must sign a DPADivision of Public Assistance approved confidentiality form. Confidentiality forms will be maintained on file and accessible upon request by DPADivision of Public Assistance.

Work Services providers are required to sign new client confidentiality statements and DPADivision of Public Assistance system security agreements annually. New staff hired during the fiscal year must read, complete, sign, and submit to DPADivision of Public Assistance confidentiality and security agreements. Signed agreements must be received by DPADivision of Public Assistance within five working days of the date the employee begins working on this project.

All information, lists, data, documents, and records containing client specific information that is collected by the WSPWork Services Provider either in hard-copy or electronic formats are the sole property of the State of Alaska. The WSPWork Services Provider shall implement and document policies, practices, and procedures necessary to safeguard the confidentiality of all client information in accordance with state laws and regulations. The WSPWork Services Provider is prohibited from allowing third parties access to confidential client information without the express written permission of the Division. The WSPWork Services Provider may not use either aggregate or disaggregate client information or statistical data for any purpose outside the direct administration of Work Services, including but not limited to the WSPWork Services Providers administration of other projects, programs, grants, or contracts without written permission from the Division.

Work Services providers are not allowed to maintain records, lists, databases, documents, or other identifying material unless it is directly connected to the administration of a Public Assistance program. Work Services providers must submit a written request to maintain separate databases that details security protocols necessary to safeguard confidential information and that describes procedures for permanently deleting confidential information upon termination of the project. Work Services providers will not enter DPADivision of Public Assistance client information into a non-DPADivision of Public Assistance data system without written approval from WSTAWork Services Technical Assistance. Information stored on the WSPWork Services Providers database may be restricted by the Division.

Work Services providers will be required to identify all data elements to be stored in their systems and how the information and data will be used.

Substantial failure on the part of the WSPWork Services Provider to establish, implement, and maintain safeguard policies, procedures, and protocols, may cause the Division to terminate the project.

If approved, such databases must meet safeguards that include deleting all DPADivision of Public Assistance client information at the end of this project. DPADivision of Public Assistance will enforce regulations governing the custody, use, and preservation of client records. All client files created and maintained as a result of administering Work Services are the property of the Division of Public Assistance and must be given to the Division upon request or within 30 days of the end of the project.

All WSPWork Services Provider's staff with access to the DPADivision of Public Assistance Eligibility Information System (EIS) and/or the Case Management System (CMS) or have access to any information in files, records, or databases containing client information are required to read the DPADivision of Public Assistance Systems Operations Security Manual and to sign computer security agreements. The WSPWork Services Provider shall notify WSTA@alaska.gov within 24 hours when any staff with access to CMSCase Management System and/or EISEligibility Information System resigns or terminates from employment.

1018-4 A.          EMAIL COMMUNICATION

Work Services providers who do not have state sponsored email addresses are required to secure confidential material. No external (non-.gov email address) email communication may contain the combination of the client's name and social security number. Clients may be identified by client number, see Admin MS 100-8.

1018-4 B.      SECURE MESSAGING

Work Services providers are required to use a secure messaging system directed by the State. Contact WSTA@alaska.gov for guidance on establishing a secure message account. If a WSPWork Services Provider is not using a secure messaging account to transmit documents with client identifiers, the provider may fax to a station approved by WSTA@alaska.gov.

Hard copy documents must be shipped in double envelopes and sent through USPSUnited States Postal Service overnight express, FedEx, and Gold Streak or similar. This method will provide for confidentiality and is traceable.

1018-4 C.      FAX

All facsimile equipment will be monitored by staff, to ensure there is no public access to incoming messages.

1018-4 D.      HARD COPY FILES

Secure all hard copy files and records containing client information in locked cabinets and a secure location that is not accessible by the general public.

1018-4 E.      CASE DOCUMENTATION

The WSPWork Services Provider shall document and maintain all client information according to the standards described in the WSPMWork Services Procedure Manual, Administrative Procedures Manual, and other applicable DPADivision of Public Assistance written guidance.

The WSPWork Services Provider will maintain and store client case files for the duration of this contract. Case files will be transferred to DPADivision of Public Assistance when the contract ends or when files are requested by DPADivision of Public Assistance.