to an agency’s computer, this data then becomes the responsibility of the agency. A Partner Agency should develop protocol regarding the handling of data downloaded from the Report Writer; Agency Policies Restricting Access to Data: The Partner Agencies must establish internal access to data protocols. These policies should include who has access, for what purpose, and how they can transmit this information. Issues to be addressed must include storage, transmission, and disposal of this data; Access to Community and Regional Data: Access will be granted based upon policies developed by Homeward. 4.4 Access to Client Paper Records Policy: Partner Agencies shall establish procedures to handle access to client paper records. These procedures will: Identify which staff has access to the client paper records and for what purpose. Staff should only have access to records of clients, which they directly work with or for data entry purposes; Identify how and where client paper records are stored; Develop policies regarding length of storage and disposal procedure of paper records; Develop policies on disclosure of information contained in client paper records. 4.5 Physical Access Control Policy: Each Partner Agency shall adhere to Physical Access Control Procedures. Physical access to the system data processing areas, equipment, and media must be controlled. Access must be controlled for the transportation of data processing media and other computing resources. The level of control is contingent on the level of risk and exposure to loss. Personal computers, software, documentation, and storage media (e.g., CDs, zip drives) shall be secured proportionate with the threat and exposure to loss. Available precautions include equipment enclosures, lockable power switches, equipment identification, and fasteners to secure the equipment. Homeward staff with the Agency Administrators within Partner Agencies will determine the physical access controls appropriate for their organizational setting based on the HCIS security policies, standards, and guidelines; All those granted access to an area or to data are responsible for their actions. Additionally, those granting another person access to an area are responsible for that person’s activities; Printed versions of confidential data should not be copied or left unattended and open to unauthorized access; Media containing client-identified data will not be shared with any agency other than the owner of the data for any reason. HCIS data may be transported by authorized employees using methods deemed appropriate by the Partner Agency
to an agency’s computer, this data then becomes the responsibility of the agency. A Partner Agency should develop protocol regarding the handling of data downloaded from the Report Writer; Agency Policies Restricting Access to Data: The Partner Agencies must establish internal access to data protocols. These policies should include who has access, for what purpose, and how they can transmit this information. Issues to be addressed must include storage, transmission, and disposal of this data; Access to Community and Regional Data: Access will be granted based upon policies developed by Homeward. 4.4 Access to Client Paper Records Policy: Partner Agencies shall establish procedures to handle access to client paper records. These procedures will: Identify which staff has access to the client paper records and for what purpose. Staff should only have access to records of clients, which they directly work with or for data entry purposes; Identify how and where client paper records are stored; Develop policies regarding length of storage and disposal procedure of paper records; Develop policies on disclosure of information contained in client paper records. 4.5 Physical Access Control Policy: Each Partner Agency shall adhere to Physical Access Control Procedures. Physical access to the system data processing areas, equipment, and media must be controlled. Access must be controlled for the transportation of data processing media and other computing resources. The level of control is contingent on the level of risk and exposure to loss. Personal computers, software, documentation, and storage media (e.g., CDs, zip drives) shall be secured proportionate with the threat and exposure to loss. Available precautions include equipment enclosures, lockable power switches, equipment identification, and fasteners to secure the equipment. Homeward staff with the Agency Administrators within Partner Agencies will determine the physical access controls appropriate for their organizational setting based on the HCIS security policies, standards, and guidelines; All those granted access to an area or to data are responsible for their actions. Additionally, those granting another person access to an area are responsible for that person’s activities; Printed versions of confidential data should not be copied or left unattended and open to unauthorized access; Media containing client-identified data will not be shared with any agency other than the owner of the data for any reason. HCIS data may be transported by authorized employees using methods deemed appropriate by the Partner Agency