Procedure GBEBC-AP(1): Criminal Background Checks - (Security)

In accordance with law and to protect the district's students, the district will conduct criminal background checks on persons who are employed, volunteer or otherwise work in the district, using the Missouri Automated Criminal History Site (MACHS). The district and district employees will comply with state and federal law, rules, procedures and policies regarding the receipt, use and dissemination of criminal history record information of any individual.

Definitions

Authorized Persons – Individuals determined by the superintendent or designee to need access to or need to view criminal history record information in their official capacity with the district.

Criminal History Record Information (CHRI) – A criminal history of an individual obtained through the Missouri State Highway Patrol (MSHP) and/or the Federal Bureau of Investigation (FBI) using the individual's fingerprints. CHRI includes information on the arrest, detention, complaint, indictment or former criminal charge of an individual as well as the disposition of any charges.

Rap Back – A program designed to provide school districts automatic criminal history updates about individuals who have been previously fingerprinted. “Rap” is an acronym for “record of arrest and prosecution.” Rap Back is available on the state and federal level.

Security Incident – An act of violating an explicit or implied security policy regarding CHRI including, but not limited to:

1. Attempts (either failed or successful) to gain unauthorized access to a system or its data.

2. Unwanted disruption or denial of service.

3. The unauthorized use of a system for the processing or storage of data.

4. Changes to system hardware, firmware or software characteristics without the district's knowledge, instruction or consent.

Privacy Rights

Before requesting CHRI on any individual, the district will give the individual written notification that his or her fingerprints will be used to obtain the CHRI of the individual, and the district will provide the individual a copy of the statement “Noncriminal Justice Applicant's Privacy Rights” and the FBI's “Privacy Act Statement.” All employees must agree in writing to allow the district to share their information with state and federal Rap Back criminal background check programs according to the terms of those programs.

Use

The district and its employees, officers and agents will only obtain CHRI when authorized by law and will only use CHRI or the personally identifiable information first obtained by the district in CHRI for the purposes of determining whether a person should be employed by or volunteer with the district or be employed by a contractor doing business with the district, as allowed by law.

Opportunity to Correct

Before releasing information regarding an individual to another district or taking adverse action against a person because of CHRI, the district will notify the individual who is the subject of the CHRI and give that person a reasonable opportunity to dispute and correct the record unless the person has declined to do so. If the individual is an applicant for employment with the district or a contractor doing business with the district and the position needs to be filled quickly, the district will not delay the employment decision solely because the individual seeks to correct his or her CHRI.

Access and Retention

Only authorized persons within the district may access, view or use CHRI. Authorized persons may not share or otherwise disclose information contained in CHRI to unauthorized persons unless explicitly allowed for in this procedure.

In general, the district will not print or electronically store CHRI within the district and instead will leave the information on the MSHP's secure website. The district will note in an employee's, volunteer's or applicant's personnel file that the background check was completed and whether the person was determined to be cleared for employment or assignment. In rare situations, the district may print or electronically share records when necessary to determine whether the person is authorized to work in or with the district. In those situations, the physical or electronic copy will be destroyed immediately after the decision is made.

The district will release CHRI to DESE or to other Missouri public school districts seeking to employ the subject of the CHRI upon request by the individual if the district still has access to the information on the MSHP's secure website. The information will be sent by U.S. Mail or encrypted e-mail.

The district may run a background check on employees of or applicants for employment with a contractor that does business with the district, but the district will not provide CHRI to the contractor. Instead, the district will provide a clearance letter notifying the contractor whether the employee is cleared to provide services in the district. The district will not disseminate CHRI across state lines.

Upon request the district will provide a copy of the CHRI to the person who is the subject of the background check. The CHRI will only be released to the individual and not to relatives, spouses or friends. The district will note in the dissemination log that a copy was provided to the individual.

Recordkeeping

Authorized district employees will document when CHRI is disseminated to the individual who is the subject of the CHRI or any authorized person other than DESE or other Missouri public schools. Dissemination logs will minimally include the name of the subject of record, the person or agency requesting the information, a description of the record that was shared, the purpose for the request, how the record was sent or received, the date the information was released, and the name of the person who disseminated the information. This log will be retained for a minimum of three years or until the district is audited, unless the log is needed for other purposes.

Security

The district will provide for the security of any CHRI received, including the appropriate administrative, technical and physical safeguards to provide for the security and confidentiality of the information. This includes, but is not limited to, the following:

1. The district will not routinely maintain physical copies of CHRI; however, in the rare instance where the district has physical copies of CHRI, the district will restrict access to authorized persons only. Physical copies of CHRI, if any, will be maintained in a controlled, secure environment, such as a locked cabinet in a room that is free from public or unauthorized access. The room or the locked cabinet will include an “Authorized Personnel Only” sign.

2. The district will not routinely maintain electronic copies of CHRI; however, in the rare instance where the district has electronic copies of CHRI, the district will restrict access to authorized persons only. Electronic data will be protected with encryption as designed by the state or federal government or will only be accessible by individual password. Computers, printers and monitors used to access CHRI must be situated to prevent unauthorized viewing of the information. CHRI cannot be accessed using computers available to the general public or personal devices. CHRI will not be stored on a server that is unprotected or accessible by an unauthorized entity.

3. CHRI will not be relocated, transmitted or transported outside a secure location unless encrypted according to FBI standards or transported in a locked container or in folders where the information is not visible to the public. A log must be kept if electronic information systems, such as a laptop, flash drive or CD with CHRI information on it, leave a secured area.

4. The district will dispose of records securely. Physical records will be cross-shredded or incinerated. If the district contracts out for record destruction, the destruction must be supervised. Electronic records will be deleted and overwritten as required by the state.

5. The district will not provide auditors access to CHRI unless the auditor is authorized by the MSHP or the FBI.

Security Incident Response Plan

All district employees will immediately report information security incidents—such as the theft or loss of physical records or the hacking or failure of electronic systems—or suspicions that an incident has or will take place to the designated security officer. The security officer will document receipt of all reports, investigate incidents and report incidents to the MSHP.

CHRI Security Officer

The district designates the following individual to act as the district's CHRI security officer, also referred to as the local agency security officer (LASO) by the MSHP:

Assistant Superintendent/Human Resources Director

1501 School Road, Lake Ozark, MO 65049-1960

Phone: 573-365-4091 / Fax: 573-365-5748

[E-mail]

In the event the CHRI security officer is unavailable or is the subject of a report that would otherwise be made to the security officer, reports of security incidents should instead be directed to the acting CHRI security officer:

Director of Technology

1501 School Road, Lake Ozark, MO 65049-1960

Phone: 573-365-4091 / Fax: 573-365-5748

[E-mail]

The security officer shall:

1. Maintain a list of users who have access to CHRI.

2. Identify and maintain a list of persons who are authorized to use the approved hardware, software and firmware to access CHRI from the MSHP and ensure no unauthorized individuals have access to this technology.

3. Identify and document how the equipment is connected to the state system.

4. Ensure that personnel security screening procedures are being followed.

5. Ensure that approved and appropriate security measures are in place and working as expected.

6. Promptly notify the MSHP of any security incidents.

7. Support any district security audits.

Training

The district will train all employees who have access to CHRI on the rules and responsibilities for the receipt, use and dissemination of the information.

Consequences

Failure to follow this procedure or any laws or rules regarding the access, receipt, use or dissemination of CHRI for any individual will result in appropriate discipline and may result in termination and criminal charges.

Applicability

Applicants and employees fingerprinted before the district's Rap Back activation date or before July 1, 2015, must be fingerprinted to be included in the state and national Rap Back programs. All current district employees who fall into this category shall be fingerprinted in a timely manner.

Note: The reader is encouraged to review policies and/or forms to related information in this administrative area.

EHBC: Data Governance and Security

Procedure EHBC-AP(1): Data Governance and Security - (Incident and Data Breach Response Plan)

IICC: School Volunteers

IICC-AP(1)