Page 32

customer may request a Fair Hearing. Outside of these options, customers may not amend a submitted Medical Examination Form or other information in their case record in any other way.

Maintenance of Customer Records 3.8.2

ALL IMA shall retain all information in a customer’s record for at least three (3) years after the case is closed. A log of the disclosures of customer information shall be kept for at least six (6) years and shall be disclosed to an applicant, recipient or individual's representative upon written request in a manner consistent with the policy and procedures outlined above. SAFEGUARDING INFORMATION AND TRAINING ON SAFEGUARDING INFORMATION 3.9

ALL Pursuant to Publication 1075 from the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347, this policy is established in order to maintain and safeguard privileged and private government and customer information obtained from other agencies. As such, the District of Columbia Access System/Automated Client Eligibility Determination System (herein after, “DCAS /ACEDS”) personnel/users are required to participate in an initial training class for current users and when newly hired, and an annual training requirement thereafter, which emphasizes the safeguarding of privileged information. They must also sign a security disclosure statement at the conclusion of the training that indicates their cooperation and compliance with this policy. Any DCAS/ACEDS personnel/user that does not satisfactorily complete the training class, and submit a signed disclosure statement, will not have access to DCAS /ACEDS until these requirements are met. A signed disclosure statement for all DCAS/ACEDS personnel/users must be on file with the Division of Program Development and Training (“DPDT”) before access to the DCAS/ACEDS system is granted. Internal Procedures for Disclosure Statement(s): • New DCAS/ACEDS personnel/users that complete the training will not have access to the system until they submit their disclosure statement to the DPDT training staff. • Current DCAS/ACEDS personnel/users will have fifteen (15) calendar days from the completion of their training to submit a signed disclosure statement. If the statement is not submitted within the fifteen (15) days, then on the 16th day their user access will be denied until the signed statement is submitted to the DPDT training staff. • Each DCAS/ACEDS personnel/user will receive a disclosure statement at the beginning of the Safeguards & Awareness Training. • The disclosure document will be reviewed during the training. • The DPDT Trainer must notify Program Managers/Deputies whenever a new or current DCAS/ACEDS user has not satisfactorily completed the test and submitted a disclosure statement at the conclusion of their training. • Program Managers/Deputies must follow-up with users to ensure the signed disclosure statement is submitted, and, if not, take the appropriate personnel action for that user. Training and Implementation Procedures: • All levels of personnel, including, but not limited to, management, administration, technical personnel, design/developer personnel, and program personnel involved in the DCAS/ACEDS workflow will be required to participate in an initial and on-going annual training class for Safeguarding and Awareness of privileged and private vital government and customer information. • A test will be administered at the conclusion of each offered training class in order to determine each user’s comprehension of the information. • DCAS/CEDS personnel/users will have to repeat the training class if they score less than 75%