PENNSYLVANIA DEPARTMENT OF HEALTH Policy and Procedure: 1.05 WIC State Agency

USDA Approval DateMay 21, 2026

State Agency Effective Date: July 20, 2026

POLICY AND PROCEDURE MANUAL 1. GENERAL ADMINISTRATION 1.05 Information System Management Page 1 of 5

A. POLICY OVERVIEW To protect the sensitive information of WIC participants and follow federal and state rules, it’s important to keep the WIC Management Information System (MIS) secure and accurate. Both state and local agency staff must ensure that all hardware and data connected to the system are safe and properly managed. This includes following guidelines for creating and maintaining user IDs, using strong passwords, and keeping the system updated. Additionally, correct procedures for capturing participant signatures must be followed to prevent fraud and stay compliant with regulations.

B. POLICY 1. Equipment Management

a. When moving, closing or opening a clinic, staff must fill out the Data Equipment Request (DER). The DER form shall be submitted to the State Agency (SA) ninety (90) days prior to the expected date of change. If there are extenuating circumstances mandating completion prior to the end of this timeframe (e.g., unexpected lease termination, etc.) please contact your SA project officer immediately.

b. When requesting additional computer equipment or wiring, staff must fill out the DER at least sixty (60) days prior. If there are extenuating circumstances mandating completion prior to the end of this timeframe (e.g., water pipe burse making the equipment unusable, etc.) please contact your SA project officer immediately.

c. The Transfer Equipment Request (TER) must be filled out and sent to the SA. The TER must be approved prior to moving any computer equipment. The TER must be submitted at least thirty (30) days prior to transfer.

d. All staff members must have a full laptop setup assigned to them located at a permanent site. This equipment will be part of the inventory for that permanent site. Any Local Agency (LA) who allows that equipment to be removed will be responsible for tracking that inventory (i.e., staff allowed to work from home).

e. Staff must take their assigned laptop to any additional satellite or primary clinics at which they are to work.

f. When leaving a computer unattended, users shall apply the "Lock Workstation" feature (ctrl/alt/delete, enter).

g. Commonwealth approved encryption software is required on all WIC laptops whether they are purchased by the Commonwealth or with NSA funds by the LA. Software must also be updated regularly to mitigate any potential security risks.

h. Computers shall be set to time-out after fifteen (15) minutes of non-use and staff will have to resign into the WIC MIS system.

i. A physical inventory must be completed annually of all computer equipment (desktop PCs, printers, laptops, etc.) and sent into the SA.

PENNSYLVANIA DEPARTMENT OF HEALTH Policy and Procedure: 1.05 WIC State Agency

USDA Approval DateMay 21, 2026

State Agency Effective Date: July 20, 2026

POLICY AND PROCEDURE MANUAL 1. GENERAL ADMINISTRATION 1.05 Information System Management Page 2 of 5

j. Individual users shall not install or download software applications and/or executable files to any WIC computer without prior authorization. All software shall be loaded by state-level IT staff.

k. All equipment provided by the SA must be used exclusively for WIC program purposes and there shall be no personal use permitted.

l. All computer equipment used strictly for administrative purposes must be purchased with NSA funds and each LA will be responsible for keeping the equipment updated with security patches. Equipment purchased by a LA for administrative use shall never be connected to the state network and shall only be used for WIC purposes.

m. If computer equipment is lost/stolen, or suspected of being compromised, staff must immediately report the incident to the IT Help Desk and complete an incident report form.

n. All equipment that is provided by the SA will be maintained by state-level IT staff. Any equipment that is purchased with NSA funds is the responsibility of the LA to maintain.

o. Equipment provided by the SA must be returned back to state-level IT staff when replacement equipment has been purchased. Equipment that is purchased with NSA funds must be disposed of in accordance with Policy 2.05 Equipment Purchases Inventory and Disposition.

p. Users should log out of PENN and restart their computers at the end of each day. off at the end of each day. Equipment should be left powered on so that security patches and updates can occur as necessary.

2. Laptops

a. All laptops should be kept at the primary clinic site that is noted on the inventory records. The primary clinic is where the laptop is stored and connected to the network. If a laptop is moved to another primary clinic site, a Transfer Equipment Request (TER) form must be completed and submitted for proper documentation and tracking.

b. Laptops shall be:

(1) Protected from temperature extremes, precipitation and dampness. Do not leave laptops stored in vehicles overnight or for any length of time. (2) Transported in their protective carrying cases at all times. (3) Locked using CTRL/ALT/DELETE or logged off when not attended by staff to ensure sensitive data is protected.

c. All laptops must be connected to the Commonwealth network at a minimum of once per week for a minimum of 8 hours in order to receive vital security patches and updates as well as any additional times the SA requests for them to be connected.

PENNSYLVANIA DEPARTMENT OF HEALTH Policy and Procedure: 1.05 WIC State Agency

USDA Approval DateMay 21, 2026

State Agency Effective Date: July 20, 2026

POLICY AND PROCEDURE MANUAL 1. GENERAL ADMINISTRATION 1.05 Information System Management Page 3 of 5

d. Laptops that are assigned to a staff member(s) are the responsibility of the staff member(s) until they are returned.

3. Digitized Signatures

a. The State Agency has elected to capture secure electronic digitized signatures to meet WIC Program signature requirements in both the administration of the program and for endorser/participant signature capture. This policy is compliant with the security requirements outlined by USDA and the Commonwealth of PA. Digitized signatures will be captured and maintained in accordance with record retention requirements.

b. Staff shall comply with all policies related to fraud prevention and control and the separation of duties that are contained in Policy 1.02 Abuse and Fraud Prevention and Investigation.

c. One digitized signature pad will be provided for every WIC personal computer, including laptops taken to satellite clinics, at each LA.

d. The digitized signature pads are to be used in accordance with State Policies related to digital documentation of the provision and receipt of WIC services, including certification and benefit issuance.

e. Each LA clinic manager shall be responsible for ensuring that staff comply with all security policies and procedures related to the use of digitized signature pads.

f. Connectivity problems or malfunctions should be reported to the Help Desk immediately.

e. Signature recordkeeping

a. Digitized signatures will be displayed under signature history within the family’s record.

(1) If the digitized signature pad fails to operate, follow these steps: (2) Use paper forms as a backup; (3) Ensure all forms are completed, signed, and dated; (4) Document the operational failure in the MIS system; and (5) Place the completed form in the client's chart file or scan into the system.

4. MIS and Vendor Assistant Security

a. The PA WIC Program and the MIS and Vendor Assistant systems are required to comply with all Commonwealth security policies. This applies to all personnel who have access to an account on any system that resides at a facility that provides WIC services and is connected to the Commonwealth network.

b. Staff are only permitted to access the MIS and Vendor Assistant systems using their own user IDs and passwords to ensure accountability and security of sensitive data.

PENNSYLVANIA DEPARTMENT OF HEALTH Policy and Procedure: 1.05 WIC State Agency

USDA Approval DateMay 21, 2026

State Agency Effective Date: July 20, 2026

POLICY AND PROCEDURE MANUAL 1. GENERAL ADMINISTRATION 1.05 Information System Management Page 4 of 5

c. User IDs and passwords are an important aspect of computer security. As such, all Commonwealth employees, contractors, subcontractors, grantees and any other temporary staff person or person(s) with access to the Commonwealth systems are responsible to maintain the security of their user IDs and passwords.

d. All Local Agency staff shall sign the confidentiality form (Attachment 13) each year at their employee performance review. The form shall be kept in the employee’s folder and will be reviewed during the state program review.

e. A formal request to obtain access to the MIS system for new employees, reinstated employees,changes to MIS security for employees, or inactivation of employees shall be submitted to the State Agency and attaching the WIC MIS System Request Form.

(1) SA staff will authorize the staff person in the system and send out an email informing the LA of the authorization. (2) LAs shall submit the WIC MIS System Request form to inactivate MIS user IDs no later than 48 hours after staff have terminated their employment. (3) A retailer who wishes to access Vendor Assistant must register to use the system via the Vendor Assistant website, and the system will automatically process the request.

5. Creating User IDs

a. MIS user IDs shall consist of first letter of the first name and the last name. If two users have the same combination additional letters from the first name will be added to create a unique ID.

b. Temporary MIS system user IDs shall have the same naming convention as above but be prefaced with a T.

c. For a vendor user, Vendor Assistant user IDs is the user's current email address. For State and Local Agency staff, the user ID is the user's CWOPA account email address For SA and LA staff, the user ID is the users’ CWOPA account email addresses.

6. Creating and Resetting Passwords

a. The MIS will automatically assign a temporary password.

b. MIS system passwords must be changed at least once every sixty calendar days. Failure to do so will result in the user ID being locked.

c. Passwords must be kept confidential and should never be written down. Use a secure password manager if necessary to store your passwords.

d. MIS passwords must be at least twelve, no more than sixteen, characters in length. Passwords shall contain both upper- and lowercase alphabetic characters (e.g., a-z, A- Z), and have at least one digit (e.g., 0-9) or special character (e.g., !@#$%^&*()). MIS passwords must not contain your user ID.

PENNSYLVANIA DEPARTMENT OF HEALTH Policy and Procedure: 1.05 WIC State Agency

USDA Approval DateMay 21, 2026

State Agency Effective Date: July 20, 2026

POLICY AND PROCEDURE MANUAL 1. GENERAL ADMINISTRATION 1.05 Information System Management Page 5 of 5

e. At any time should you suspect that your MIS password has been compromised, reset your password immediately.

7. CWOPA Accounts

a. Fill out the contractor assignment form for any staff that needs CWOPA access and send to the SA.

b. Passwords expire every sixty days, and CWOPA users must log in at least once every forty-five days. Failure to do so will result in account deactivation, and a new user account request must be submitted.

c. Fill out the contractor separation form for any staff that no longer need CWOPA access or if the staff person no longer works for WIC.

8. Password Protection Standards

a. Do not share passwords with anyone.

b. If someone demands your password, refer them to this policy or have them call the SA.

c. MIS passwords will be locked after three consecutive failed log-on attempts and will require administrator-level access to unlock them. In addition, once a user is logged in, the MIS system will be locked after fifteen minutes of inactivity, requiring the user to re- enter the password to regain access to the system.

9. Protecting Data a. Please refer to 1.04 Confidentiality of Participant Records.

Reference(s): 1. P&P 2.05 Equipment Purchase, Inventory and Disposition 2. Commonwealth of PA ITBSEC007 – Minimum Standards for User ID and Passwords 3. WIC Regulations: 7 CFR Part 246. 4. WIC Regulations: 7 CFR Part 246.2. 5. Commonwealth of PA ITBSEC006 - Electronic Signature Policy

Policy and Procedure Status: 1. This P&P supersedes P&P Number 8.01 dated April 23, 2009. 2. This P&P supersedes P&P Number 8.02 dated March 11, 2014. 3. This P&P supersedes P&P Number 8.03 dated March 14, 2008. 4. This P&P supersedes P&P Number 8.04 dated June 11, 2012. 5. This P&P supersedes P&P Number 8.05 dated August 31, 2012. 6. This P&P supersedes P&P Number 1.08 dated May 29, 2015