Additional Data Practices Acknowledgement

Additional Data Practices Information Acknowledgement

I acknowledge that I have read and understand the and Security and Confidentiality Policies and Procedures, along with all associated appendices. (Please be sure to access the full document via the link provided above. Note that edit options are disabled.)

I understand and agree to comply with the following security practices related to handling Personally Identifiable Information (PII):

PII includes lab data, client name, date of birth, address, state no., or medical record number

1. Email Communication:
   • I will not send any PII via unencrypted email within MDH.
   • In general, sending PII via email is discouraged.
   • Any email attachments containing PII must be password-protected, and the password must be sent in a separate email.
2. Document Disposal:
   • Paper documents containing PII must be disposed of in one of the two secure data bins located in the MDH Freeman Building 4B, which use cross-cut shredding and on-site destruction.
3. Workstation Security:
   • Screen protectors must be used on computer monitors when working in shared or open spaces to prevent unauthorized viewing of PII.
   • Computers must be locked or otherwise secured when unattended during the workday, and at the end of each business day.
4. Device and Data Access:
   • PII may only be accessed using MDH-issued or MDH-approved devices.
   • When taking PII into the field (e.g., lab data or diagnosis dates), only the minimum necessary information should be used, and it must be securely maintained at all times.
5. Data Breach Reporting:
   • Any suspected or confirmed data breach must be reported to my supervisor within one hour to ensure timely reporting to the CDC.
6. Messaging and Communication Tools:
   • I will not send PII through messaging platforms such as Microsoft Teams or other similar services.
7. End-of-Shift Protocols:
   • I will shut down my computer completely at the end of each shift.
   • All paper documents containing non-public data will be locked in a secure location at the end of my workday.

Data Privacy and Security Acknowledgement

I acknowledge while completing my assigned duties as a Ryan White provider I must ensure the following:

Data Confidentiality

To ensure data security and confidentiality, registered users must:

▪ Access Minnesota CAREWare/At A Glance only using a work-issued device (i.e., laptop or desktop).

▪ Access Minnesota CAREWare/At A Glance on a secure, password protected, private network only (i.e., your home internet that requires a password to access, preferably on a work-issued virtual private network [VPN]), and not access Minnesota CAREWare/At A Glance using public wi-fi (i.e., coffee shops, libraries).

▪ Not share logins, usernames, or passwords.

▪ If a data breach involving PII occurs (i.e., inadvertently emailing personally identifiable data to the wrong recipient), notify your assigned contract manager with Hennepin County or the Minnesota Department of Human Services as detailed in service contracts.

All data is subject to the Minnesota Government Data Practices Act. Inappropriate access to or use of data from this system will result in termination of your access to this system. Additional sanctions may also apply, depending on the severity of the violation.

Using Laboratory (Lab) Data

To ensure data security and confidentiality, registered users must:

▪ Restrict the use of lab data to minimal necessary need, such as providing services and monitoring programs, since it is confidential.

▪ Send the minimal amount of lab data as possible.

▪ Send in a password protected document and in an encrypted email.

▪ Use only work-issued equipment and software to send and receive lab data.

▪ If a data breach involving lab PII occurs (i.e., inadvertently emailing lab data to the wrong recipient), please notify the Minnesota CAREWare Help Desk at help.cwpems@state.mn.us within 1 hour of discovery. Additionally, notify your assigned contract manager at Hennepin County and/or Minnesota Department of Human Services as detailed in service contracts.