DC WIC POLICY & PROCEDURE MANUAL

Policy 3.001 1 | P a g e Title: MIS Security Overview Category: MIS CFR Reference: 2 CFR 200.313(d)(1) 2 CFR 200.333 CFR 246.25(a)(2) CFR § 246.26(d) Policy Number: 3.001 Effective Date: 01/01/2016 Revised Date: 11/30/2023

POLICY STATEMENT: The DC WIC State and Local Agency must ensure the security and integrity of participant and program data within the MIS by adhering to the following:

1. Confidentiality Agreements -Upon hiring, the Local Agency requires each staff member to sign and submit attachment 3.001A MIS Confidentiality Agreement – New User Account to ensure WIC participant data privacy. The signed form must be submitted to the State Agency before the new employee can receive access to the MIS.

Additionally, each staff member* must complete the Online Annual DC WIC Data Confidentiality/ Security Agreement as provided by the State Agency.

*Staff within their first year of hire are not required to submit the additional Online Annual DC WIC Data Confidentiality/Security Agreement.

2. MIS User ID Requests - Each State and Local Agency staff member must be given a unique user identifier (ID) to access the MIS. User access must be assigned based on the staff member’s title and role within the DC WIC program. See attachment 3.001B HANDS Permission Settings for access levels and permission settings.

If a staff member’s title and role within the DC WIC program changes, including termination of employment from the DC WIC program, the Local Agency must request a change in MIS user access.

3. IT Security Awareness Training - All State and Local Agency staff receive ongoing IT security awareness training. The State Agency will provide IT security awareness training annually (see DC WIC policy 4.004 Staff Training).

4. Protection of DC WIC IT Equipment - The Local Agency ensures that DC WIC program IT resources (e.g. computers, cell phones, laptops, scanners, etc) are secured against theft, intrusion, and unauthorized access and use. The State Agency will perform a biennial security review of the Local Agency to ensure that data files and computer programs are protected.

5. Ensuring Participant Privacy - Participant data is kept secure at employee workstations by locking computer screens when not in use, securing any loose documents that contain personal identifiable information (PII), and ensuring a private and secure space when speaking with WIC participants.

DC WIC POLICY & PROCEDURE MANUAL

Policy 3.001 2 | P a g e PROCEDURE Confidentiality Agreements

The Local Agency must maintain a record of all signed initial Confidentiality Agreements for auditing purposes.

The State Agency will maintain a record of all annual employee Confidentiality Agreements for auditing purposes.

MIS User ID Requests 1. The Local Agency must submit all MIS User ID requests, including change in employee’s title and role, to info.wic@dc.gov and contain the following:

Full Name

Email Address

Phone Number (if applicable)

Clinic Roles / Job Title

MIS Permission #

MIS environments (Production and/or Training)

Local Agency and Clinic Codes (“All Clinics” for access to all clinics within LA)

Reason of the request

Additionally, all new user requests must submit a signed attachment 3.001A – MIS Confidentiality Agreement – New User Account. 2. Termination of MIS user IDs – The employee’s full name, email address, and effective date of termination.

3. The State and Local Agency must maintain a record of all MIS user ID requests for auditing purposes. IT Security Awareness Training The State Agency provides annual IT security awareness training and is responsible for maintaining an annual record of staff who have completed the training.

Protection of DC WIC IT Equipment The Local Agency is responsible for monitoring staff’s use of DC WIC program IT equipment to ensure proper use. If local agency staff mishandle DC WIC IT equipment (e.g., conducting personal business, download or install unapproved software, etc.), the Local Agency must promptly notify the State Agency. The State Agency will provide directives on the course of action. Ensuring Participant Privacy In addition to locking computer screens when not in use, using screen protectors when in use, securing any loose documents that contain PII, and ensuring a private and secure space when speaking with WIC participants, State and Local Agency staff must be mindful of what information is shared and with whom and where. See DC WIC policy 12.019 Confidentiality for additional guidance.

DC WIC POLICY & PROCEDURE MANUAL

Policy 3.001 3 | P a g e The State Agency recommends the following: • The Local Agency provides annual training on participant data privacy. • In written correspondence, using the participant’s WIC Client ID in place of name or other PII. • Disposing of participant and/or program information via shredders or use of locked shred bins. • The Local Agency ensures facility security by establishing or following Local Agency protocols for limiting access to buildings, rooms, and equipment that store DC WIC participant and program data.

The Local Agency is responsible for notifying the State Agency promptly if a breach of confidentiality occurs.

DC WIC IT Equipment Configuration and Updates

The Local Agency must ensure all DC WIC IT equipment is regularly updated and protected against malware. See DC WIC policy 3.003 MIS Configurations and Equipment Inventory for additional guidance.

REFERENCES 2 CFR 200.313(d)(1) 2 CFR 200.333 CFR 246.25(a)(2) CFR § 246.26(d) DC WIC policies 3.003 MIS Configurations and Equipment Inventory, 4.004 Staff Training, 12.019 Confidentiality ATTACHMENTS & FORMS 3.001A MIS HANDS Confidentiality Agreement - New User Account 3.001B HANDS Permission Settings