Page 29

ESA SNAP Policy Manual 13 If the request is in the form of an administrative or judicial subpoena, the administrator must immediately contact the Office of the General Counsel. If the subpoena is upheld, the administrator must provide only the information specified in the subpoena and note the disclosure in the case record. 1.6.7 Safeguarding Information As required by the Federal Information Security Management Act, District of Columbia Access System (DCAS) staff must participate in initial and annual trainings that emphasize the safeguarding of privileged information. Staff must sign a security disclosure compliance statement at the conclusion of the training. Any staff with access to DCAS who do not satisfactorily complete the training or submit a signed disclosure statement will be restricted from accessing DCAS until the requirements are met. A signed disclosure statement for all DCAS staff must be on file with DPT&QA before access to the DCAS system is granted. ESA provides safeguarding awareness training classes for appropriate agencies, facilities, clinics, contractors or outreach centers that have access to privileged and vital customer information. 1.6.8 Nondisclosure and Authorized Official Use As required by regulations under the IRS, personally identifiable information (PII) or Health Insurance Portability and Accountability Act (HIPAA) and related regulations, ESA staff must not disclose privileged government or customer information. This policy includes the following:  Verbal or written disclosure  Causing information to be disclosed  Unauthorized use or disclosure ESA must protect personal information of customers by safeguarding the information and not leaving documentation unsecured in staff workstations for anyone to see, obtain or take from the work area. Department staff may only share sensitive information with those who need it to perform their duties to conduct official business of determining eligibility for public benefits in the District. DCAS access is monitored and tracked to ensure appropriate use of the system. Example Molly and Sue are friends. Molly is a DCAS user. Sue calls Molly and asks her to verify or look up information about her estranged husband’s income status. Molly looks up the husband’s information because she has access to it at her center. By following through on Sue’s request, Molly is engaging in unauthorized and unofficial case access. Molly is subject to penalties, including loss of wages, loss of job and imposed fines, and she can be held personally liable in a civil action for her unauthorized use and disclosure of privileged information.

Return