901.1 Policy 901 TWIST Data System Security February 9, 2015 (revised) POLICY Local WIC programs shall follow established procedures for TWIST security processes. PURPOSE To ensure security of access to TWIST and confidentiality of WIC participant records. Participant data security is essential to the WIC program. OREGON WIC PPM REFERENCES

 450— Confidentiality TWIST TRAINING MANUAL REFERENCES: Chapter 1, Lesson 100 — Introduction to TWIST and TWIST Security APPENDICES Page 3 Appendix A Local Agency Security Roles DEFINITIONS TWIST: The WIC Information System Tracker. The data system for the Oregon WIC Program. User: A staff member who has access to the TWIST data system. Role: A designation in TWIST that defines levels of access (edit, view, or no access). Roles are assigned to users. Add-on role: A specialized role in TWIST that does not stand alone. These roles are granted to specific individuals who already have a role in TWIST but need additional access to a certain area of TWIST in order to perform a specific function. Unique identifiers: Any data element that can be used to identify a participant (i.e., participant name, address, phone number).

PROCEDURE Confidentiality statement 1.0 All WIC staff must sign a confidentiality statement to confirm they have been notified that all participant data must be kept confidential. See ⧫450--Confidentiality. 1.1. Ensure each staff member signs a confidentiality statement when hired and maintain this documentation on file. Security roles in TWIST 2.0 Security roles shall be assigned and removed in TWIST with the permission of the Local Coordinator or their designee. Staff should be properly trained in the areas of

TWIST Data System Security, Continued 901.2 TWIST for which they have security. For a list of roles and their corresponding access, run report SA130R ‘FamilyNet User Role Authorities’ from the Security module. 2.1. The WIC Coordinator or designee is granted the role ‘Set User Security Local’ 2.2. The role ‘Set User Security Local’ grants the ability to add/remove users, change TWIST passwords, and assign or remove security roles to users. 2.3. A user with the ‘Set User Security Local’ can also grant add-on roles to staff members. 2.4. When a staff member is no longer working in the WIC program, the WIC Coordinator or designee must remove their WIC role(s). If they are no longer working in a program that requires them to use FamilyNet, their name should also be removed from the “Security” table in TWIST. 2.5. When the WIC coordinator leaves the program and no other staff member has the “Set User Security Local” role, the local agency administrator may contact the State WIC office to assign a new “Set User Security Local” role.

Security of TWIST reports 3.0 Participant data must be kept secure: 3.1. At employee workstations, staff should ‘lock’ their computer screen if they leave their workstation while they have TWIST open. 3.2. All documents and reports that are generated from TWIST must be kept secure (i.e., Verification of Certification (VOC), ineligibility notifications, etc.) 3.3. Any document or report that includes a participant’s name or any other unique identifier must be kept secure. 3.4. Keep documents in a locked drawer or file cabinet, turned face down on a staffed workstation, or in an area where non-WIC staff are not permitted. 3.5. See ⧫450 – Confidentiality for more detailed information on security of participant data.

POLICY HISTORY Date * Revised, Reviewed, Released

If you need this in large print or an alternate format, please call 971-673-0040. This institution is an equal opportunity provider.

TWIST Data System Security, Continued 901.3

The date located at the top of the policy is the date of the most recent release. Policies are to be implemented on release date and will become compliance findings 6 months from the release date. *Released: Significant changes made to policy. Release notes can be found in the corresponding document on the Policy and Procedure Manual page. Reviewed: The writer looked at this policy to make sure it was still accurate. Formatting changes may have occurred. Revised: Minor edits or formatting has occurred without need for release. USDA has accepted a policy and watermark is reviewed. Date of Origin: Date policy was initially released

901.2 APPENDIX A Local Agency Security Roles PRIMARY ROLE: WIC Administrator, Manager, Supervisor

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Outputs

Scheduling Tables Wait List

Client Process

Outputs

All other

Financial Management

Caseload: Participating Caseload

Caseload: Priority Freezing, State Caseload Tables

Budgets FNS Outputs Rebates

FI

Outputs

Packages Tables: All other

Tables:

Oper. & Mgt.

Outputs

Operations Tables

Compliance Operations: state acknowledgment, Library Check in/Check Out Outputs: Compliance, Vendor investigations

Systems Admin.

Administration: Bandwidth Meter, Outputs

Maintain: Counties

Vendor Mgt.

Communication Farmers Market: Farmers, Markets, Reconciliation FI: All other

901.3

MODULES

SCOPE

Edit/Update

View Only

Not Allowed Farmers Market: Administration, Coupon Maintenance, Look up and Markets. Outputs: FM coupons sent to local agencies Tables Vendor: Look Up Monitoring Outputs Training Vendor: All other

901.4

PRIMARY ROLE: WIC Certifier (CPA)

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Outputs Scheduling: Daily Clinic Schedule, Family Appointment, Group Education Classes, Group Screening Wait lists

Scheduling: Autodialer Extract, Automatic Scheduler, Mass Reschedule, Replace Staff, Template Maintenance Tables

None

Client Process

All menu items but Tables

Tables

None

Financial Mgt.

Budgets Caseload

FNS 798 Outputs Rebates Tables

FI

Outputs

Packages Tables: All other

Tables:

Oper. & Mgt.

Compliance: Complaints

Operations: Agency/Clinic Information-WIC Review, Formula Standing Order, Staff Information

Compliance: All other

901.5

MODULES

SCOPE

Edit/Update

View Only

Not Allowed Operations: Agency/Clinic Information (except review), Communications, Organizations Outputs Tables: All but investigation violations and sanctions

Operations: Check in/out, Forms Ordering, State Acknowledgement, Reservation Outputs: Compliance Tables: investigation violations and sanctions

Systems Admin.

Outputs

none

Maintain: Client Archive Parameters, Counties

Vendor Mgt.

Farmers Market: Coupon Look up. Administration, Maintenance Outputs: Farmers Market Coupon sent to LA, FM mkt elig., FM recipient profile, FM participants receiving coupons, Newly Added Vendor, Terminated Vendor, Vendor by Name. Vendor: Look up

Compliance: Complaints Farmers Mkt: Coupon Maintenance, Markets FI: Vendor FI Look-up Tables

Communication Farmers Mkt: Farmers, Markets, Reconciliation FI: all other Monitoring Training Outputs: All other Training Vendor

PRIMARY ROLE: WIC Clerk

901.6

MODULE S

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Outputs Scheduling: Auto Dialer Extract, Daily Clinic Schedule, Family Appt. Records, Group Education Classes, Group Screening, Mass Reschedule, Replace Staff Wait Lists Scheduling: Automatic Scheduler, Template Maintenance Tables

None

Client Process

Certification: BF Tracking, Medical Data, Health History, Diet assessment, NE Plan, Food Package Assignment, Temporary Newborn Enrollment and Intake

Farmers market Look Up Outputs Transfer

Certification: Progress Notes Tables

None

Financial Mgt.

Caseload: Priority Freezing

All Other

FI

Outputs Tables

Packages Tables: All others

Tables:

901.7

MODULE S

SCOPE

Edit/Update

View Only

Not Allowed

Oper. & Mgt.

Compliance: Complaints Operations: Agency/Clinic Information (except review), Communications, (except state acknowledgment), Organizations, Reservations Outputs: all other

Operations: Agency/Clinic Information - WIC Review, Staff Information Tables

Compliance: All other Operations: Check in, Check out, Forms Ordering, Formula Standing Order, State Acknowledgemen t Outputs: Client Detail Report, Modules Completed, Compliance, Open Vendor investigations, Payment details, Payment past due.

901.8 PRIMARY ROLE: WIC Clerk, cont.

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Systems Admin.

Outputs

Maintain

Vendor Mgt.

Farmers Market: Administration, Coupon Look-up, Coupon Maintenance Outputs: FM Coupons sent to LA, FM Coupon Summary, FM Mkt Elig., FM Recipient Profile, FM Recipients receiving coupons Vendor: Look up

Tables Outputs: Newly Added Vendor, Terminated Vendor, Vendor by Name

Communication Farmers Mkt: Farmers, Markets, Reconciliation FI: All others Monitoring Outputs: All others Training Vendor

901.9 PRIMARY ROLE: WIC Coordinator

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Outputs Scheduling

Tables: Appointment Notices, Appointment Type Duration, Class Location, Nutrition Education Classes, Generic Appointment Types, Time Preferences, Postcard printer. Wait list

Tables: Appointment Statuses, Appointment Types, Non-Client Activities, Translations, Wait List Reason Codes

None

Client Process

Certification Client Master Enrollment and Intake Farmer’s Market Look-up Output Tables: LA Interventions and LA questions Transfers

Tables: All other

None

Financial Mgt.

Caseload: Participating Caseload – LA, Priority Freezing Output: All other

Budgets Caseload: State caseload assignment Rebates Tables

FNS Output: Contract Food Redemptions

901.10

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

FI

Outputs

Packages Tables: All other

None

Oper. & Mgt.

Compliance: Complaints, Complaint Look up. Operations: Agency/Clinic except Review, Communications, Organizations, Reservations, Staff Information Tables: Only Forms and Materials - Forms Inventory Outputs: All other Tables: Forms Inventory, Breastpump inventory

Operations: Check in, Check Out, Agency/Clinic-WIC Review Tables: All but Forms and Materials - Forms Inventory

Compliance: All other Operations: Forms Ordering, Formula Standing Order, State Acknowledgement Outputs: Client Detail Report, Compliance-client redemptions, client status, investigation summary, open vendor investigations, payment details, payment past due, vendor violations

PRIMARY ROLE: WIC Coordinator, cont.

901.11

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Systems Admin.

Outputs Security: Maintain User

Maintain: Client archive parameters, counties

Vendor Mgt.

Farmers Market: Coupon Maintenance, Administration, Coupon Look-up Outputs: Farmers Mkt coupons sent to LA, FM Coupon summary by LA, FM Mkt elig. Report, FM recipient profile rpt., FM, Part. Receiving FM coupons, Newly Added Vendor, Terminated Vendor Vendor: Look-up

Tables Vendor: Look Up

Communication

Farmers Market: Farmers, Markets, Reconciliation FI: All Other Outputs: All Other Training Vendor: All other

901.12

SPECIALIZED ROLES (These can stand alone, but they have limited functionality. Only allowed roles are defined, all other roles are not allowed.)

SPECIALIZED ROLE: Breastfeeding Peer Counselor

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Client Process

Certification: BF Tracking only, Client Master update and edit comes with this.

Rest of area

Vendor Mgt.

FI

Financial Mgt.

Systems Admin.

Oper. & Mgt.

901.13 SPECIALIZED ROLE: Call Center

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Outputs Scheduling: Autodialer Extract, Daily Clinic Schedule, Family Appointment, Group Education, Group Screening. Wait Lists

Scheduling: Auto Scheduler, Template Maintenance

Scheduling: Mass Reschedule, Replace Staff

Client Process

Certification: NE Plan Enrollment Look-up Output: Ineligibility, Termination, VOC Transfers Certification: Infant/Child Medical Data Certification: All Other Output: All Other

Financial Mgt.

FI

All other

Oper. & Mgt.

Systems Admin.

Vendor

901.14 SPECIALIZED ROLE: Lab Tech LA

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Client Process

Certification: Medical Data

Rest of area

Vendor Mgt.

FI

Financial Mgt.

Systems Admin.

Oper. & Mgt.

901.15

ADD-ON ROLES (These roles do not stand alone.)

ADD-ON ROLE: WIC Appointment Scheduler

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Outputs Scheduling Tables: Appointment Notices, Appointment Type Duration, Class Location, Generic Appointment Types, Nutrition Education Classes, Postcard printer base table, Time preferences.

Wait list

Tables: Appointment Statuses, Appointment Types, Non-Client Activities, Translations, Wait List Reason Codes

Client Process

Financial Mgt.

Caseload: Priority Freezing

901.16

MODULES

SCOPE

Edit/Update

View Only

Not Allowed FI

Oper &Mgt.

Operations: Staff Information-Staff Info.

Operations: Agency/Clinic Info Staff Information-Job Desc, Staff Training

Systems Admin.

Vendor

ADD-ON ROLE: WIC Complaint Expert

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Client Process

Financial Mgt.

FI

Oper. & Mgt.

Compliance: Complaints Outputs: Complaints Referral Report

901.17

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Systems Admin.

Vendor Mgt.

ADD-ON ROLE: WIC Complaint User

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Client Process

Financial Mgt.

FI

Oper. & Mgt.

Compliance: Complaints

901.18

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Systems Admin.

Vendor Mgt.

ADD-ON ROLE: WIC Local Super User

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Scheduling: All Tables: Appt. Types, Appt. Durations, Class Locations, Generic Appt. Type, Nutrition Ed

Tables: Appt. Statuses, Appt. Types, Non Client Actvities, Translations, Wait List Reason Codes.

901.19

MODULES

SCOPE

Edit/Update

View Only

Not Allowed Classes, Post Card Printer Base Tables, Time Preferences. Wait List: Wait List

Client Process

Certification: All

Fin Mgmt Caseload: Priority Freezing

FI

Oper. & Mgt.

Operations: Agency/Clinic Information, Communications, Formula Standing Order, Organizations, Reservations, Staff Information. Tables: Forms Inventory

Operations: Check In, Check Out, Forms Ordering, State Acknowledgement. Outputs: None

Systems Admin.

Vendor Outputs: Newly Added Vendor, Terminated Vendor, Vendor by Name

Outputs: All Other

ADD-ON ROLE: WIC Print Reports

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Outputs

901.20

MODULES

SCOPE

Edit/Update

View Only

Not Allowed Client Process Outputs

Vendor Mgt.

Outputs

FI

Outputs

Oper. & Mgt.

Outputs

Outputs: Compliance Outputs, Vendor violation outputs.

Systems Admin.

Outputs

Vendor

Outputs: All

ADD-ON ROLE: WIC Training Supervisor

901.21

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Client Process

Vendor Mgt.

FI

Farmer’s Mkt.

Reports

Systems Admin.

Oper. & Mgt.

Operations: Staff Info - Staff Training tab

Rest of area

ADD-ON ROLE: Set Security

901.22

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Client Process

Vendor Mgt.

FI

Farmer’s Mkt.

Systems Admin.

Security: Maintain-User

Security: Maintain-Roles

Rest of area

Oper. & Mgt.

ADD-ON ROLE: Breastpump Coordinator

901.23

MODULES

SCOPE

Edit/Update

View Only

Not Allowed

Appt. Sch.

Client Process

Vendor Mgt.

FI

Farmer s Mkt.

Systems Admin.

Oper. & Mgt.

Tables: Breastpump Inventory