20060712-IR-010050319FRA Adds 10 IAC 5 to provide definitions, mitigating factors, and notice requirements regarding the release of Social Security numbers by state agencies. Effective 30 days after filing with the Secretary...

TITLE 10 OFFICE OF ATTORNEY GENERAL FOR THE STATE

Final Rule

LSA Document #05-319(F)

DIGEST

Adds 10 IAC 5 to provide definitions, mitigating factors, and notice requirements regarding the release of Social Security numbers by state agencies. Effective 30 days after filing with the Secretary of State.

10 IAC 5

SECTION 1. 10 IAC 5 IS ADDED TO READ AS FOLLOWS:

ARTICLE 5. RELEASE OF SOCIAL SECURITY NUMBERS BY STATE AGENCIES

Rule 1. Authority and Applicability

10 IAC 5-1-1 Authority

Authority: IC 4-1-10-13

Affected: IC 4-1-10

Sec. 1. This article is adopted under the authority granted to the attorney general by the release of Social Security number act (IC 4-1-10-13).

(Office of Attorney General for the State; 10 IAC 5-1-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)

10 IAC 5-1-2 Applicability

Authority: IC 4-1-10-13

Affected: IC 4-1-10

Sec. 2. The definitions in IC 4-1-10 and 10 IAC 5-2 apply throughout this article.

(Office of Attorney General for the State; 10 IAC 5-1-2; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)

10 IAC 5-1-3 Effective date

Authority: IC 4-1-10-13

Affected: IC 4-1-10-1

Sec. 3. The effective date of this article is July 1, 2006.

(Office of Attorney General for the State; 10 IAC 5-1-3; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)

Rule 2. Definitions

10 IAC 5-2-1 "Express consent" defined

Authority: IC 4-1-10-13

Affected: IC 4-1-10-5

Sec. 1. "Express consent" means a specific grant of authority made by an individual allowing a state agency to disclose that individual's Social Security number. The grant of authority shall:

(1) not be given:

(A) pursuant to or as a condition of a state agency's services that would otherwise be available to the individual; or

(B) by any person other than the individual to whom the Social Security number has been assigned by the Social Security Administration; and

(2) be:

(A) given in writing;

(B) signed by the individual; and

(C) dated in a legible form as determined by the state agency.

(Office of Attorney General for the State; 10 IAC 5-2-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)

10 IAC 5-2-2 "State law enforcement agency" defined

Authority: IC 4-1-10-13

Affected: IC 4-1-10-4

Sec. 2. "State law enforcement agency" includes the following entities or persons:

(1) The state police department.

(2) The office of attorney general for the state.

(3) The office of the inspector general.

(4) Prosecutors and their deputies.

(5) Other state agencies or entities that conduct investigations relating to the enforcement of state law.

(Office of Attorney General for the State; 10 IAC 5-2-2; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)

Rule 3. Attorney General's Discretion

10 IAC 5-3-1 Mitigating factors

Authority: IC 4-1-10-13

Affected: IC 4-1-10; IC 4-1-11

Sec. 1. The attorney general may, in his or her discretion, determine that the release of Social Security numbers was a negligent act and not a knowing, intentional, or reckless act if a state agency or employee establishes that the following provisions, singly or in combination, have been met:

(1) The release of the Social Security numbers is immediately stopped.

(2) Any individuals whose Social Security numbers are disclosed are immediately notified in a timely manner.

(3) The release of the Social Security numbers was as follows:

(A) Unintended.

(B) De minimis and nonsystematic.

(4) The handling of the Social Security numbers was conducted pursuant to a contractual relationship, and the contract contained a clause requiring the state agency and the contractor to comply with the following:

(A) The release of Social Security number provisions set forth in IC 4-1-10.

(B) The notice of security breach provisions set forth in IC 4-1-11.

(5) The state agency had established reasonable policies and procedures designed to prevent the unauthorized disclosure of individual Social Security numbers.

(6) Corrective measures are initiated to prevent future disclosures under similar circumstances.

(7) Other relevant circumstances as determined by the attorney general.

(Office of Attorney General for the State; 10 IAC 5-3-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)

Rule 4. Notice Requirements

10 IAC 5-4-1 Notification to the attorney general

Authority: IC 4-1-10-13

Affected: IC 4-1-10

Sec. 1. When a state agency becomes aware of a release of Social Security or other personal identifying information, the state agency or employee shall, within two (2) business days of the disclosure, notify the office of attorney general for the state in writing of the following:

(1) The nature of any release of Social Security or other personal identifying information.

(2) The steps taken by the agency or employee to do the following:

(A) Stop the current release.

(B) Notify the individuals affected.

(C) Prevent future releases.

(Office of Attorney General for the State; 10 IAC 5-4-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)

LSA Document #05-319(F)

Notice of Intent: December 1, 2005; 29 IR 833

Proposed Rule: January 1, 2006; 29 IR 1248

Hearing Held: March 31, 2006

Approved by Attorney General: May 18, 2006

Approved by Governor: June 16, 2006

Filed with Secretary of State: June 16, 2006, 2:50 p.m.

Documents Incorporated by Reference: None Received by Publisher

Small Business Regulatory Coordinator: Jason Thompson, Deputy Attorney General, Office of the Indiana Attorney General, Indiana Government Center-South, 302 West Washington Street, 5th Floor, Indianapolis, IN 46204, [phone], [e-mail]

Posted: 07/12/2006 by Legislative Services Agency

DIN: 20060712-IR-010050319FRA

Composed: Oct 31,2016 11:26:14PM EDT

A PDF version of this document.