40. confidentialitymay 20, 2016 · pursuant to procedures and restrictions in w&i sections...

Common-Place Handbook page 40-1Confidentiality

40. Confidentiality

In accordance with Welfare and Institutions Code (W&I) Section 10850 and 45 Code of Federal Regulations (CFR) Section 205.50(a), confidentiality regulations were created to protect applicants and recipients against identification, exploitation or embarrassment that could result from the release of information identifying them as having applied for or having received public assistance. They also outline under what circumstances and to whom such information may be released.

These regulations pertain to all records, papers, files and communications pertaining to Social Services Programs. These regulations bind public and private agencies with whom the County contracts to perform any part of the covered public social services programs.

40.1 References

The following are references to State policy surrounding confidentiality:

• Manual of Policy and Procedures (MMP) 19-002 - 19-007,

• CalFresh Manual 63-201.2, and

• Title 22 of Administrative Code.

40.2 Confidential Information

Names, addresses and all other information concerning the circumstances of any individual for whom or about whom information is obtained is confidential and shall be safeguarded. This is true of all information whether written or oral.

No disclosure of any information, obtained by a representative, agent or employee of the Social Services Agency (County Welfare Department), in the course of discharging his or her duties, shall be made, directly or indirectly, other than in the administration of public social service programs.

Update # 16-11 Revised: 05/20/16

2 Common-Place HandbookConfidentiality

Disclosure of information which identifies by name or address any applicant or recipient of public social services to federal, state or local legislative bodies and their committees without such applicant or recipient’s consent is prohibited. Such bodies include the United States Congress, the California State Senate and Assembly, City Councils and County Boards of Supervisors.

Both the release and possession of confidential information in violation of the rules of this division are misdemeanors.

40.3 Tax Information

Tax information is defined as any information supplied by the Internal Revenue Service (IRS), concerning a taxpayer’s identity, the nature, source, or amount of his/her earned income, unearned income (including interest or dividends), payments, receipts, deductions, exemptions, credits, assets, liabilities, net worth, tax liability, tax withheld, deficiencies, over assessments or tax payments.

40.3.1 Safeguards

Counties shall establish the following safeguards in order to protect the confidentiality of, and to prevent the unauthorized disclosure of, tax information received from the IRS:

• Establish and maintain a secure area or place in which IRS tax information shall be stored;

• Restrict access to the tax information only to persons whose duties or responsibilities require access to this information;

• Provide other such safeguards or controls as prescribed by IRS guidelines and necessary or appropriate to protect the confidentiality of tax information;

• Report annually in a format prescribed by the California Department of Social Services (CDSS) the safeguard procedures utilized by the counties for ensuring that the confidentiality of tax information is being maintained;

• The county shall destroy IRS source material upon the independent verifications of IRS tax information or upon completion of appropriate case action, whichever is earlier. Methods of destruction shall be those used for confidential material.

Revised: 05/20/16 Update # 16-11


40.4 Penalties for Unauthorized Disclosure of Tax Information

The following are penalties for the unauthorized disclosure of tax information:

40.4.1 Franchise Tax Board (FTB)

It is a misdemeanor for the Franchise Tax Board or any member thereof, or any deputy, agent, clerk, or other officer or employee or other individual, who in the course of his or her employment or duty has or had access to returns, reports, or documents required under this part, to disclose or make known in any manner information as to the amount of income or any particulars set forth or disclosed therein.

40.4.2 Internal Revenue Service (IRS)

It shall be unlawful for any person willfully to disclose to any person, except as authorized in this title, any return or, return information. Any violation shall be a felony punishable by a fine in any amount not exceeding $5,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution.

40.4.3 Civil Damage

If any person knowingly, or by reason of negligence, discloses any return or return information with respect to a taxpayer in violation of any provision of Section 6103, such taxpayer may bring a civil action for damages against such person in a district court of the United States.

40.5 Non-Confidential Information

Statistical information and social data, that is not identified with a particular individual may be released.



Examples of information that may be released would include, but are not limited to such information as statements of the number of recipients, total expenditures per program or administration, average grant figures, or other general information concerning the case load as a whole.

40.6 Release of Confidential Information

Confidential information may be released without the consent of the applicant/recipient, only for purposes directly connected with the administration of public social services, except as specified in Section 44.7. Public social services are defined as aid or services administered or supervised by CDSS or the State Department of Health Services.

40.6.1 Contractors

Whenever a contract is entered into with a public or private agency which involves the release of confidential information, the contract shall contain a provision ensuring that such information will be used in accordance with the restrictions found in W&IC Section 10850 and this division.

40.6.2 Public Officials

Certain public officials, and their duly appointed agents and deputies, are entitled to examine confidential information. The right of public officials, including law enforcement personnel, to examine public assistance records does not exist if the request is for a purpose not connected with the administration of the public social service programs. Examples of situations under which information may not be given out include but are not limited to such things as traffic violations, tax fraud investigations or criminal investigations not related to welfare. Both the release and possession of confidential information in violation of these regulations is a misdemeanor. The officials who are entitled to examine confidential information include, but are not limited to:

• District Attorney or County Counsel In the administration of aid, it is necessary to disclose information to these offices when they are conducting investigations, prosecutions, criminal or civil proceedings directly connected to public social services including child support services and the location of families in which the caretaker has abducted or kidnapped the aided child(ren).



• California Department of Social Services (CDSS), State Department of Health and Children’s Services (DHCS) and Department of Health, Education and Welfare (HEW) and County Welfare Departments Within the State of California These agencies, their representatives and employees shall have access to public social services records as needed in the administration of public social services.

• County Auditor In addition to the authority to examine claims and other financial transactions in the routine line of duty, the auditor may examine records as necessary to satisfy him/herself that fiscal accountability is being maintained and the progress relating to payment, claiming and repayment of aid are proper and effective.

• Audits Federal, State and County auditors having direct or delegated authority are authorized to examine records as necessary to perform fiscal audits and/or procedure reviews. Legislative bodies and their committees authorized by law to conduct audits or similar activities in connection with the administration of public social services shall be permitted to examine records.

• Legislatures and their Committees Refer to Section 44.1 for the prohibition against release of confidential information to legislatures without applicant/recipient consent. Any releases made to legislatures and their committees should be accompanied by the warning that W&I Code Section 10850 makes the use or release of the information for a purpose not directly connected with the administration of public social services a misdemeanor.

• Social Security Administration Representatives of the Social Security Administration are authorized to receive client information from Social Services Agency staff, for the sole purpose of performing their duties and determining eligibility without client consent. Likewise, Representatives of the Social Services Agency are authorized to receive client information from the Social Security Administration necessary to perform their duties and determine eligibility without client consent.



40.6.3 Law Enforcement Officials - Exception to the Rule

Pursuant to procedures and restrictions in W&I Sections 10850.3 and 10850.7, law enforcement officials may be given otherwise confidential information when:

• The applicant/recipient is deceased. Information that may be released is limited to the name, address, telephone number, birth date, social security number, and physical description of the applicant for, or recipient of, public social services. A county welfare department may release the information specified by this section to any law enforcement agency only upon a written request from the head of the agency specifying that the applicant or recipient is deceased and that the agency is otherwise unable to adequately identify the deceased. The information specified may alternately be released by telephone, whereupon the head of the law enforcement agency shall submit the request in writing within five days of the release. This section shall not be construed to authorize the release of a general list identifying individuals applying for or receiving public social services.

• A Felony Arrest Warrant Has Been Issued for the Applicant/Recipient. The Social Services Agency may release the information specified in this section to any law enforcement agency only upon a written request from the agency specifying that a warrant of arrest for the commission of a felony has been issued to the applicant or recipient. This request may be made only by the head of the law enforcement agency, or by an employee of the agency so authorized and identified by name and title by the head of the agency in writing to the Social Services Agency. Information releasable pursuant to a felony arrest shall be limited to name, address, telephone number, birth date, and social security account number (where such items are present) from the record of disbursement.

Reminder:No data shall be released from the case record. This section shall not be construed to limit releases pursuant to Penal Code Section 11166.

• Release of CalFresh and CalWORKs Case Information to Law Enforcement Officials. In the CalFresh and CalWORKs programs, the address, social security number, and, if available, photograph (with the exception of photo images obtained from the Statewide Fingerprint Imaging System [MPP Sections 40-105.3 and 63.601.12]) of any CalFresh household member and/or CalWORKs applicant/recipient, shall be made available on request to any



Federal, State or local law enforcement officer if the officer furnishes the Social Services Agency with the name of the applicant/recipient and notifies the county welfare department that:

• The individual is fleeing to avoid prosecution, or custody or confinement after conviction, for a crime that, under the law of the place the individual is fleeing, is a felony, or

• The individual is violating a condition of probation or parole imposed under Federal or State law; or

• The individual has information that is necessary for the officer to conduct an official duty related these programs.

• Locating or apprehending the individuals is an official duty of the law enforcement officer, and

• The request is being made in the proper exercise of an official duty.

40.6.4 Requests that are not Authorized

Law enforcement officials have visited various District Offices requesting specific client information. Unless specified in [“Law Enforcement Officials - Exception to the Rule,” page 40-6], SSA staff shall not disclose any other information. The following situations that are in the form of questions and answers provide guidance that addresses requests that are not authorized:

• Can a client’s parole or probation officer request to see or verify that one of their parolees/probation clients is participating/attending at one of our District Offices?

No. A probation/parole officer is not considered a law enforcement authority for the purposes of W&I Code 10850.3. As much as we are not allowed to release case information to anyone unless a client provides us a written authorization/consent, we are not allowed to grant a parole/probation officer to see or verify/identify if one of their parolees/probation clients is in our facility. If the probation/parole officer presents a court order for the arrest of our client, the SSA District Office Manager is to contact County Counsel for further directions.

• Can a law enforcement officer investigating a crime that is not-related to CWES/Benefits programs request to speak to a client at one of our District Offices?



No. We may only disclose limited confidential information only upon a written request from the head of the law enforcement agency (identified by name and title) showing that a warrant has been issued for the arrest of the client for the commission of a felony or misdemeanor. Information that may be released must be limited to the client’s name, address, telephone number, date of birth, SSN, and physical description of our client. Under no circumstances would we orchestrate the meeting and arrest of the client in our office.

• Can a representative from the District Attorney’s office investigating a case or searching for witness(es) not related to CWES/Benefits programs request to speak to a client at one of our District Offices?

No. For the same reason as noted in the two example above. The DA’s office must not be allowed to simply come around the office fishing/searching for witnesses.

• Can an attorney who is representing one of our clients that is non-related to CWES/Benefits programs request to speak to a client at one of our District Offices if the client has given permission?

Guidance to this scenario is as follows:

Example 1: If a client is attending/participating at one of our District Offices and client provides written authorization/consent that he/she would like to talk to his/her own attorney in our office, client may be allowed to do so.

Example 2: If our client A authorizes/wants/recommends that his attorney speak to our client B as client A believes client B will be helpful to solve her non-related CWES/WTW case, SSA staff must not allow this to occur.

Example 3: Situation is similar to Example 2 but the difference is that client B provides written authorization/consent to speak with client A’s attorney; it is not in violation of confidentiality due to client B’s written permission/consent.

40.6.5 Written Request Procedures

Law enforcement personnel must submit a written request to the office SSPM when requesting review of any client related information. The office SSPM may contact County Counsel if there is anything in the request beyond what we can provide. Written requests allow for determining the scope of the information requested and identifying the law enforcement agency’s representative. As a reminder, if the information is related to a warrant, it needs to come from the head of the law enforcement agency or someone authorized to request it (WIC 10850.3 (b); this information is limited. [Refer to “Law Enforcement Officials - Exception to the Rule,” page 40-6].



40.6.6 Release of Confidential Information in Conjunction With a Lawsuit

If an applicant/recipient or caretaker relative becomes a party or plaintiff in any suit against the State of California, any political subdivision of the state, or any agency administering the laws governing the administration of public social services and such suit challenges the validity of the laws governing the administration of public social services or the manner in which the laws have been applied, the attorney representing the state, political subdivision, or agency shall be given access to all files and records relating to the plaintiff. Such files and records may be disclosed to the court having jurisdiction of the lawsuit insofar as they are relevant to the determination of any factual or legal issue in the case. In such cases, it should be brought to the court’s attention, when presented with the requested information, of the state law and policy against further disclosure of the information.

On notice of court action ordering records to be produced, where the action is not connected with the administration of public social services, the county shall notify the appropriate legal officer (county counsel). Such legal officer shall be requested to take immediate action to safeguard the confidential nature of the records.

40.6.7 Release to Schools

Confidential case information may be released to county superintendents of school and superintendents of school districts, and their representatives, as necessary for the administration of federally-assisted programs which provide assistance in cash, in-kind, or services directly to individuals on the basis of need. If such confidential information is released, the superintendent shall be informed of the criminal prohibition against the use or disclosure of such information for any purpose other than that for which it was obtained.

Information concerning the number of CalWORKs families living within a particular school district requested to support entitlement to funds under the Elementary and Secondary Education Act (ESEA) may be released to authorized representatives of the school district. A signed agreement with the school district stating that the confidential information obtained will only be used for purposes of fund claiming under the ESEA and that the district understands that there is a criminal penalty for release or use by the school district for any other purpose shall be obtained. The prohibition includes the use of confidential records to identify applicants or recipients to school teachers and administrators.



Note:Written consent must be obtained from the client prior to releasing specific client information to any school official, such as but not limited to, verification of the receipt of or the amount of assistance a client is receiving.

40.6.8 Disclosure to Parents Who Wish to be Reunited With Their Family

• Where a person claims to be an absent parent, his/her identification should be verified.

• No acknowledgement to the requesting parent that the child(ren) or other parent are receiving aid may be made.

• If the family is aided, the aided caretaker shall be contacted for permission to release information. If permission is granted, the information shall be released.

• If the absent parent alleges that the aided parent has kidnapped, abused or neglected the child(ren), the case must be referred to the child protective services for appropriate action. The name and address of the applicant or recipient may be released to law enforcement officials for the purpose of locating abducting parents and the abducted child(ren).

40.6.9 Release to Research Organizations

Information requested by research organizations may be released without authorization of the applicant/recipient, provided that specific case information is not released, only case load statistics as a whole. Research organizations requesting information must guarantee in writing that they will meet the conditions and protections of this division and W & I Codes Section 10850.

40.7 Release to Client or Authorized Representative (AR)

For purposes of this section, an authorized representative (AR) is a person or group who has authorization from the applicant/recipient to act on his/her behalf.



Prior to releasing any case information, the client or AR must be properly identified. Acceptable items to identify the client or AR may include but are not limited to such items as identification card, case number, driver’s license number, social security account numbers or the mother’s maiden name.

40.7.1 Authorized Representative Authorizations

Except as otherwise provided, all authorizations to provide information to an authorized representative (AR) are to be provided by the client in writing. Written authorizations shall be dated and shall expire one year from the date on which they are given unless they are expressly limited to a shorter period or revoked. In cases involving pending appeals or state hearings, the time period, unless the authorization is expressly limited or revoked, shall extend to the final disposition of the issue involved in the fair hearing or, where applicable, by the courts.

When the AR and the client or responsible relative caring for the CalWORKs child are both present, written authorization is required for that particular occasion.

40.7.2 Information Supplied By the Client

Information relating to eligibility that was provided solely by the client contained in applications and other records made or kept by the Social Services Agency in connection with the administration of the public assistance program shall be open to inspection by the client or his/her AR.

40.7.3 Telephone and email Inquiries

Information provided by the client may also be released to the client and their AR by telephone and email when they have been properly identified.[See Telephone Authorizations below for acceptable items that may be used to identify a client or AR.] In instances where the client has previously provided us with their email address, this is sufficient verification that the request for information is coming from the client.

Reminder:Any email correspondence containing Personal Identifiable Information (PII) must be sent as Secure email.

Information that was NOT provided by the client, such as Client Index Number (CIN), absent parent’s whereabouts etc.,shall not be disclosed.



When the AR and the client, or responsible relative caring for the CalWORKs child are both present, no written authorization is required for that particular occasion.

40.7.4 Telephone Authorizations

Telephone Authorizations may be accepted in lieu of a written authorization where circumstances ensure that the applicant or recipient has adequately identified him/herself to the county. A telephone authorization is temporary and should be followed up by a written authorization and documented in the Maintain Case Comments subsystem.

Acceptable items to identify the applicant or recipient by phone may include but are not limited to such items as case numbers, driver’s license numbers, social security account numbers or the mother’s maiden name.

The procedure for telephone authorizations will usually involve the client first calling their EW and notifying them of whom will be calling on his/her behalf. This call will authorize the release of confidential information. Examples of typical circumstances for releasing confidential information by telephone authorization include inquires from medical offices, welfare rights organizations or legislators calling on behalf of the recipients.

40.7.5 Applicant/Recipient Written Requests for Assistance to Legislators

Written inquiries to members of legislative bodies signed by applicants or recipients of public social services concerning the receipt of public social services may serve as authorization for release of information sufficient to answer such an inquiry.

40.7.6 Release of Information in Conjunction With a State Hearing

The client or his/her attorney or AR may inspect the case records including the entire case narrative relating to the client.



40.8 Information Which May NOT Be Released to the Client or Authorized Representative

Portions of the client’s record which would qualify as privileged communications as defined by Evidence Code. This would include Sections 954 (lawyer-client) and 1041 (identity of informer).

Note:The physician-patient privilege in Evidence Code Section 990 belongs to the patient and may be waived by him/her. The right of the patient to inspect his/her records is confined to record maintained by the CWD and does not extend to the records kept by the physician.

[Refer to “Privileged and Confidential Information [EAS 19-006],” page 42-2]

40.9 Eligibility Determinations

The following is allowed when making eligibility determinations:

40.9.1 Collateral Contacts

Individual consent forms, signed by the applicant or recipient are required for each contact made during the evidence gathering process. An exception to this rule is found in MPP Section 20-007.36 which exempts Special Investigative Units (SIUs) from the requirement of permission to contact collateral sources.

40.9.2 Permission

If the client does not wish the county to contact a private or public source in order to determine eligibility, the client shall have the opportunity to obtain the desired information or verification for him/herself.



40.9.3 Acceptability and Discontinuances

If the information or verification is unacceptable to the county and the applicant refuses to grant the county permission to collect the information, the applicant will be given the opportunity to withdraw his/her application or the application shall be denied for noncooperation. Recipients who refuse to give consent for a collateral contact for which no acceptable evidence or verification has been obtained by the recipient, shall be given the opportunity to withdraw from the program or shall be terminated.

40.9.4 Outside Contacts by Agencies Other than the CWD

When the assigned Eligibility Worker determines eligibility, he/she shall inform the client that, if it is necessary to contact outside sources (including employers) and the client wishes to keep the service confidential, he/she is entitled to request that such contacts be made by our Agency. The Social Services Agency, upon notification of the individual’s request, shall make the outside contacts for the client. While the client may not object to such contacts, he/she may object to a contact’s learning of the particular kind of service sought. To the maximum extent possible, such inquiries should not reveal the specific nature of the service sought by the client.

40.10Documentation in Case Record

The purpose of public assistance and social service records is to evidence eligibility and the delivery of public social services. The applicant/recipient’s record should only contain facts relevant to his/her case.

40.11Medi-Cal Personal Identifiable Information (PII)

Federal law requires that a Medi-Cal client’s Personally Identifiable Information (PII) be protected and secured. As such, the California Department of Health Services (DHCS) and the County of Santa Clara have entered into a “Medi-Cal Data Privacy and Security Agreement.”



All information, whether written or oral, of any individual for whom or about whom information is obtained is confidential and must be safeguarded.

40.11.1 Privacy and Confidentiality

Client’s information, such as: name, social security number, date of birth, driver’s license or identification number and address are confidential and shall be safeguarded.

County workers must only use or disclose client’s information to perform their official job related functions.

Unauthorized disclosure is a violation of Welfare & Institutions Code, Section 14100.2 and County Policy and is subject to disciplinary action, as well as civil and criminal sanctions.

40.11.2 MEDS Privacy and Confidentiality

Staff is not to share their Medi-Cal Eligibility Data System (MEDS) password or User Name with anyone. Passwords must be changed immediately if revealed.

Any suspected unauthorized use of an ID or password is to be reported to the Supervisor/Manager immediately.

Any unauthorized release of confidential information will be subject to civil and criminal sanctions.

40.11.3 CalWIN Privacy and Confidentiality

All CalWIN information is confidential and must not be disclosed. Unauthorized disclosure is a violation of County Policy and a violation of law.

Information may not be accessed unless there is a legitimate business need to do so. Information may not be disclosed to anyone who does not have a legitimate business need to receive it.

40.11.4 Computer Security Safeguards

The “Send Secure” e-mail option must always be used in Outlook when sending messages containing information to recipients outside of our Agency. Staff must ensure that data is encrypted when using Removable Media (Jump Drives/CD/USB) to transport client information.



Staff must always log off/lock computer (using CNTRL+Alt+Delete) when away from the work station, to avoid unauthorized access.

40.11.5 Physical Security

All client’s information must be stored in an area that is physically safe from access by unauthorized persons during working and non-working hours.

County workers must wear their identification badges at all times.

40.11.6 Paper Control Documents

All paperwork containing client’s information must be discarded in burn bags. Burn bags must be emptied daily, following the Agency’s Burn Bag Policy.

[Refer to “Burn Bag Policy,” page 40-26]

Staff is not to take any paperwork and/or file containing client’s information outside the Agency except for identified routine/approved business purposes (i.e., home visit).

Faxes and copies containing client information must be promptly picked up from fax machines, as well as printers and copiers.

Client information must NEVER be left unattended at any time.

40.11.7 Miscellaneous

Client’s names or personal information is NEVER to be discussed with co-workers not associated with the case, friends or family members. Staff is to avoid discussions involving personally identifiable information in hallways or public places.

Note:Persons receiving faxes containing client information in error must be notified to destroy them immediately.



40.12Federal Tax Information (FTI)

Both the Internal Revenue Services (IRS) and the Social Security Administration (SSA) require agencies that receive, store process or transmit FTI to develop, document, and disseminate policy and procedures covering incident response for FTI. Additionally, the SSA requires agencies that receive PII to establish a similar incident response process.

FTI is data originally sourced from a federal tax return that the IRS then provides to social services agencies. When the same information is provided by the taxpayer to the county, it is NOT FTI.

Example:If Jane Doe provides the county with her federal tax return, this data is not considered FTI. When the IRS provides data from Jane Doe’s federal tax return directly to the county, this data is considered FTI.

40.13Breach of Confidentiality Policy [ACL 15-56, IRS Code Sect 6103, SSA Public Law 98-369 Sect 1137]

It is the responsibility of every county employee to protect the security and confidentiality of client’s:

• Medi-Cal Personal Identifiable Information (PII)• Federal Personally Identifying Information (PII)• Federal Tax Information.

This section outlines the steps to be taken in the event of a real, perceived or potential Medi-Cal or Federal PII or FTI security incident. To minimize county-wide impact, it is imperative that a formal reporting and response policy be followed when reporting Medi-Cal or Federal PII or FTI security incidents.

This policy applies to all users and staff with direct or indirect access to Medi-Cal client information whether or not on County premises.



40.13.1 Responsibility

Designated personnel have the responsibility to take the action indicated in this section in a timely manner as dictated by the nature and severity of the incident. Those incidents having agency-wide implications should be given the most immediate attention, including escalation during any time period, 24 hours a day/7 days a week:

User

Reports any perceived Medi-Cal or Federal PII or FTI security incidents to his/her Supervisor or Manager.

Supervisor/Manager

• Evaluates the reported security incident.

• Keeps a record of actions taken.

• Completes the “Medi-Cal Personally Identifiable (PII) Incident Report” (SCD 2284), if the Medi-Cal or Federal PII or FTI could have been accessed or viewed by anyone other than those with direct business needs.

• Submits the SCD 2284 within the date of discovery to the Medi-Cal/Federal PII and FTI Security Coordinator at 333 W. Julian Av.

• Takes prompt corrective action to reduce the risk of similar incidents.

Medi-Cal/Federal PII and FTI Security Coordinator

Receives the SCD 2284 and notifies the appropriate agencies if the information breach involved any Information Systems Asset.

40.13.2 Frequently Asked Questions

The following are frequently asked questions concerning a breach of confidentiality:

• What is a privacy or security breach? A privacy or security breach is an intended or unintended unauthorized disclosure of client Medi-Cal data or personally identifiable information (PII). Privacy or security breaches may be paper or electronic. If the breach involves



computerized information that is unencrypted; including name, social security number (SSN), Department of Motor Vehicles (DMV) financial account information, then the breach triggers state breach notification law.

• What are some examples of privacy or security breaches that involve paper?

• Misdirected paper faxes with PII outside of Santa Clara County’s Social Service Agency.

• Loss or theft of paper documents or listings containing PII.

• Mailings to incorrect providers or beneficiaries.

• What are some examples of electronic privacy or security breaches?

• Stolen, unencrypted laptops, hard drives, PCs with PII.

• Stolen, unencrypted thumb drives with PII.

• Stolen briefcases with unencrypted compact discs containing PII.

• Misdirected electronic fax with PII to persons outside of Santa Clara County’s Social Services Agency.

• If some of the information is stolen or otherwise involved in a privacy or security breach, does this mean that the client is a victim of identity theft? No, this does not mean that the client is a victim of identity theft. The fact that some of the information may have been involved in a privacy breach does not mean that a person attempted to or did access the information or that the information has been used inappropriately. Clients may be advised to place a fraud alert on their credit files and review their credit reports.

• How will clients know if any of their personal information was used by someone else? The best way to find out is for them to order their credit reports from the three credit bureaus: Equifax, Experian and Trans Union. If they notice accounts on their credit report that they did not open or applications for credit (“inquiries”) that they did not make, these could be indications that someone else is using their personal information, without permission.



• Do clients have to pay for a credit report? As a possible fraud victim, they are entitled to a free copy of their credit report. They can call any one of the three credit bureaus at the numbers provided and follow the “fraud victim” instructions. They will automatically place a fraud alert on their credit file with all three of the bureaus. They will soon receive a letter from each bureau confirming the fraud alert and telling them how to order a free copy of their credit report. Clients should follow the instructions in the letters to receive their free reports. NOTE: This free credit report that they are entitled to as a potential fraud victim is in addition to the free annual report that everyone is now entitled to. Clients should be referred to www.privacy.ca.gov for more information on the free annual report.

• Trans Union - 1-800-680-7289• Experian - 1-888-397-3742• Equifax - 1-800-525-6285

• Are credit bureaus going to ask for the client’s SSN? Is it okay to provide it? The credit bureaus ask for an SSN and other information in order to identify the client and avoid sending their credit report to the wrong person. It is okay for the client to give this information to the credit bureau that they call.

• Does the client have to call all three credit bureaus? No. If they call just one of the bureaus, that bureau will notify the other two. A fraud alert will be placed on their file with all three and the client will receive a confirming letter from all three.

• Why can’t the client talk to someone at the credit bureaus? They must first order their credit reports. When they receive their reports, each one will have a phone number they can call to speak with a live person in the bureau’s fraud unit. If they see anything on any of their reports that looks unusual or that they don’t understand, they may call the number on the report.

• What is a fraud alert? A fraud alert is a message that credit issuers receive when someone applies for new credit in their name. The message tells creditors that there is a possible



fraud associated with the account and gives them a phone number to call (the client’s) before issuing new credit. When the client calls the credit bureau fraud line, he/she will be asked for identifying information and will be given the opportunity to enter a phone number for creditors to call. The client may want to make this his/her cell phone number.

• Will a fraud alert stop the client from using his/her credit cards? No. A fraud alert will not stop the client from using your existing credit cards for other accounts. It may slow down his/her ability to get new credit. Its purpose is to help protect the client against identity thieves trying to open credit accounts in their name. Credit issuers get a special message alerting them to the possibility of fraud. Creditors know that they should take “reasonable steps” to re-verify the identity of the person applying for credit.

• How long does a fraud alert last? An initial fraud alert lasts 90 days. An alert can be removed by calling the credit bureaus at the phone number given on a credit report. If the client wants to reinstate the alert, he/she can also do so.

• What if the client has a fraud alert on, but wants to apply for credit? The client should still be able to get credit. While a fraud alert may slow down the application process, the client can prove his/her identity to a prospective creditor by providing identifying information.

• How long does it take to receive a credit report? It could take about 20 days from the day the client calls the credit bureaus. It takes about 5 to 10 days from the time the client calls the credit bureaus to get his/her fraud alert confirmation letter with instructions on ordering his/her credit report. The client should receive his/her reports in another 5 to 10 days from the time they are ordered.

• Should the client contact the Social Security Administration and change his/her SSN? The Social Security Administration rarely changes a person’s SSN. The mere possibility of fraudulent use of your SSN would probably not be viewed as a justification. There are drawbacks to doing so. The absence of any history under the new SSN would make it difficult to get credit, continue college, rent an apartment, open a bank account, get health insurance, etc. In most cases, getting a new SSN would not be a good idea.



• Should the client close his/her bank account? No, not unless the client’s bank account number was among the items of personal information compromised in the breach. As a general privacy protection measure, the client should limit the use of your SSN where it's not required. For example, if his/her bank account number or PIN is the client’s SSN, he/she should ask the bank to give him/her a different number. Clients should NOT use the last four digits of their SSN, their mother’s maiden name or their birth date as a password for financial information.

• Should the client close his/her credit card or other accounts? No, not unless his/her account number was among the items of personal information compromised in the breach. As a general privacy protection measure, the client should always look over his/her credit card bills carefully to see if there are any purchases he/she didn’t make. If so, the card company should be contacted immediately.

• What should a client look for on his/her credit report? The client should look for any accounts that he/she doesn’t recognize, especially accounts opened recently. Clients should look at the inquires or requests section for names of creditors from whom they haven’t requested credit. It should be noted that some kinds of inquiries, labeled something like “promotional inquiries,” are for unsolicited offers of credit, mostly from companies with whom they do business. Clients should not be concerned about those inquiries as a sign of fraud. (Persons are automatically removed from lists to receive unsolicited pre-approved credit offers when a fraud alert is placed on an account. Offers can also be stopped by calling 888-5OPTOUT). Clients should look into the personal information section for addresses where they’ve never lived. Any of these things might be indications of fraud. Also they should be on the alert for other possible signs of identity theft, such as calls from creditors or debt collectors about bills that they don’t recognize, or unusual charges on their credit card bills.

• What happens if the client finds out that they have been a victim of identity theft? The client should immediately notify his/her local law enforcement agency, contact any creditors involved and notify the credit bureaus. For more



information on what to do, they should view the Identity Theft Victim Checklist on the Identity Theft page of the California Office of Privacy Protection’s Website at www.privacy.ca.gov.

• How often should a client order new credit reports and how long should he/she go on ordering them? It might be a good idea for clients to order copies of credit reports every three months for a while. How long they continue to order them is up to them. Identity thieves usually, but not always, act soon after stealing personal information. We recommend checking credit reports at least twice a year as a general privacy protection measure.

• I heard that the client could “freeze” his/her credit files. How does that work? A security freeze is a stronger measure than a fraud alert. A freeze prevents others from seeing the client’s credit history without his/her permission. Unlike the fraud alert that lasts 90 days, a credit freeze remains in effect until such time as the consumer elects to terminate the freeze. It costs $10 to place a freeze with each of the three credit bureaus, for a total cost of $30. The client can also temporarily lift the freeze for $10, if he/she wants to apply for new credit. For more information on the freeze, the client should view the Identity Theft page of the Office of Privacy Protection’s Website: http://www.privacy.ca.gov/cover/identitytheft.htm. If the client has no internet access, they may call the California Office of Privacy Protection at 1-866-785-9663.

• If the notice is addressed to a child who is a minor, what should the client do? The client should call each of the credit bureaus at the numbers in the notice letter. The fraud cues on the automated system should be followed and the child’s information entered. If he/she gets a message of “report not found” or something of that nature, that’s good. That means the child doesn’t have a credit history. A creditor doing a credit check would get the same message, pretty much eliminating the risk of new credit being established in the child’s name. The client may want to go through this process every few months for six months to a year. If the fraud alert process goes through, then the client will receive a confirming letter in the mail from each of the credit bureaus with instructions for ordering his/her child’s credit report. The client should check the report(s) and call the credit bureaus about any information that looks suspicious or inaccurate.



• If the notice is addressed to the client’s spouse, who is deceased, what should the client do? The client should call each of the credit bureaus at the numbers in the notice letter. The fraud cues should be followed and the deceased person’s information entered. If the message received says “reported deceased” or “no report on file” or something of that nature, that’s good. That means the credit bureaus have been notified by the Social Security Administration that the holder of the SSN is deceased. A creditor doing a credit check would get the same message, pretty much eliminating the risk of new credit being established in the deceased person’s name/number. NOTE: Counties notify SSA when a death certificate is filed. If the fraud alert process on the automated phone system goes through, that may mean that the credit bureaus haven’t been notified of the death. In that case the spouse (or the executor of the state) would notify the credit bureaus in writing that the person is deceased and that the person’s information may be at risk of identity theft. The credit bureaus will flag the file as deceased. The spouse (or executor) must include the following information in the letters to the credit bureaus:

• Deceased’s full name, date of birth, most recent address and SSN.

• Copy of the death certificate.

• The spouse may request and receive a copy of the deceased’s credit report at the spouse’s home address.

• An executor wishing to receive a copy of the deceased’s credit report should enclose a copy of the executorship papers.

Mail to the credit bureau addresses below:

Experian Trans Union Equifax

Phone 888-397-3742 800-680-7289 800-525-6285

TDD 800-972-0322 877-553-7803 1-800-255-0056 and ask for Auto Disclosure Line, 1-800-685-1111

Address P.O. Box 9532 Allen, TX 75013

P.O. Box 6790 Fullerton, CA 92834

P.O. Box 740241 Atlanta, GA 30374-0241



40.14Numbering System in District Offices

To preserve client confidentiality, it is necessary for district offices to utilize a numbering system when calling clients from the lobby. Workers must extend their voice mail greeting to include: “Due to client confidentiality, if you are in the lobby, please take a number and state it on the voice mail message along with your name and case number.”

40.14.1 Clerical Staff

Clerical staff will no longer call client’s by their name. Instead, clerical staff will call the client to the appropriate window using the numbering system. District Office procedures must be followed in order to process the particular request.

40.14.2 Eligibility Staff

Eligibility Workers (EWs) and Department of Employment and Benefit Services (DEBS) staff must page clients to the designated area using either:

• The number the client has selected, or

• The client’s first name or last name, not both, or

• The process established in the respective district office.

Note:There may be a variance to the numbering system in each district office, as policy is established using Social Services Program Manager (SSPM) discretion.



40.15Confidentiality in Office Lobbies

As part of DEBS Program Improvement Plan to ensure the safeguard of confidential information, the “Personal Information Registration” form (SCD 2377) is to be used in office lobbies. This form replaces the interactive verbal request of personal information needed to identify the case in reception areas. The process associated with the form is as follows:

• Client approaches reception area based on order, such as through kiosk-assigned number.

• Instead of front desk staff verbally requesting client Personal Information (PI), the SCD 2377 is given to the client to complete.

• Front Desk Staff utilizes the PI on the form to assist client as per current procedures (i.e. researches CalWIN or other systems, etc).

• Upon completion of current procedures, the SCD 2377 is placed in burn bag.

40.16Burn Bag Policy

Documents containing client information are strictly confidential and must be treated as such. Under no circumstances are documents containing any source of client information to be disposed of in regular trash receptacles. The Social Services Agency provides “burn bags” to all employees to discard such information (in the absence of a paper shredder).

Placing documents in a burn bag does not in itself comply with confidentiality requirements. To protect client information, burn bags cannot be left out in the open. On a daily basis, upon ending their shift, staff is to do the following with burn bags containing confidential information:

• Place the burn bag in a drawer that has lock capabilities, or

• Shred the documents that were placed in the burn bag, or

• Empty the contents of the burn bag in one of the locked bins provided in each district office.



There are no exceptions to this rule. Under no circumstances is staff allowed to leave at the end of their shift without having taken one of the above actions with their burn bags.
