C-2420 Transporting IRS FTI

Revision 24-3; Effective Sept. 1, 2024

All Programs

Staff must transport media containing FTI in a way that prevents loss or unauthorized disclosure. The IRS prohibits staff from transmitting FTI by agency email systems, Microsoft Teams or by phone. Staff must not use HHSC email addresses to send confidential or agency-sensitive information to personal email addresses.

Staff must secure computers and electronic media that receive, process, store, access, protect or transmit FTI in an area with restricted access. The agency must use encryption mechanisms on all computers and mobile devices that contain FTI to prevent access if lost or stolen. Staff must label removable media containing FTI.

Authorized staff must keep all computers, electronic media and removable storage containing FTI in their immediate protection and control during use. When not in use, authorized staff must secure the device in the proper storage area or container. Staff may not leave devices unattended in a public area. HHSC management must maintain inventory records of computers, electronic devices and removable media and complete a semi-annual review for control and accountability.

loading…

C-2420 Transporting IRS FTI

Official source

Revision 24-3; Effective Sept. 1, 2024

All Programs

Staff must transport media containing FTI in a way that prevents loss or unauthorized disclosure. The IRS prohibits staff from transmitting FTI by agency email systems, Microsoft Teams or by phone. Staff must not use HHSC email addresses to send confidential or agency-sensitive information to personal email addresses.

Staff must secure computers and electronic media that receive, process, store, access, protect or transmit FTI in an area with restricted access. The agency must use encryption mechanisms on all computers and mobile devices that contain FTI to prevent access if lost or stolen. Staff must label removable media containing FTI.

Authorized staff must keep all computers, electronic media and removable storage containing FTI in their immediate protection and control during use. When not in use, authorized staff must secure the device in the proper storage area or container. Staff may not leave devices unattended in a public area. HHSC management must maintain inventory records of computers, electronic devices and removable media and complete a semi-annual review for control and accountability.