Arkansas Administrative Code › Agency 016 - DEPARTMENT OF HUMAN SERVICES › Division 14 - Department of Finance (Administrative Services) › Rule 016.14.10-006 - Policy 5014: Facility Identification and Protection Policy

Current through Register Vol. 49, No. 6, June, 2024
5014.0
Facility Identification and Protection Policy Overview:
5014.1
Purpose:
This policy
			 establishes requirements that provide a safe work environment for the
			 Department of Human Services (DHS) workforce as well as visitors and
			 contractors while in DHS Facilities.
5014.2
Applicability:
All
			 individuals granted access, as defined below, are covered by this policy. These
			 individuals include all members of the DHS workforce, those employed by others
			 to perform DHS work, and others authorized to access DHS facilities. This
			 policy applies to all DHS facilities as designated by the DHS Chief Information
			 Officer (CIO).
5014.3
Failure
			 to Comply:
Any member of the DHS workforce or volunteer granted access
			 to DHS facilities who violates this policy is subject to sanctions, or
			 disciplinary action as authorized under DHS Policy 1084, DHS Employee
			 Discipline Policy: Conduct/Performance. Contractors and visitors may be subject
			 to termination of contractual agreements, denial of access to DHS facilities,
			 and criminal and civil remedies.
5014.4
Policy:
5014.4.1
Proper
			 Identification
A. All members of
			 the DHS workforce, contractors, and visitors in a DHS facility must wear their
			 issued DHS identification badge in plain view on their outer garments so that
			 both the picture and information on the badge are clearly visible. If a person
			 in a DHS facility is asked to show his or her badge by a member of the DHS
			 workforce, the person must do so. A person's failure to show his or her ID
			 badge must be reported as a security incident on DHS Share at
https:/?dhsshare.arkansas.gov
and may result in
			 disciplinary action.
B. All new
			 employees must obtain a DHS identification badge within 30 days of hired
			 date.
5014.42
Badges
A.
Temporary Badges
: Members of the DHS workforce, and
			 DHS contractors assigned to work at the DHS Central Complex who have been
			 issued an identification badge, and who misplace or forget to bring their
			 badges to work, must check out a temporary employee badge at the main lobby
			 reception desk. Loaner identification badges must be returned on a daily basis.
			 Identification badges are the property of DHS and are the responsibility of the
			 owner or borrower to safeguard from unauthorized use.
B.
Lost or Stolen
			 Badges
: Lost or stolen identification badges must be reported as
			 soon as possible after the loss or theft is discovered at
http://www.arkansas.gov/dhs/security
.
5014.4.3
Visitors
A. All
			 visitors to DHS facilities must comply with identification badge procedures
			 pertaining to the specific facility visited. Visitors to the Little Rock
			 Complex must check in to the main lobby reception desk in Donaghey Plaza South
			 (DPS) to be issued a visitor's badge.
B. Visitor badges may only be issued for a
			 specific event or meeting or a specific day. All visitor badges must be
			 returned on a daily basis.
C.
			 Visitors must present a piece of photo identification in order to obtain a
			 visitor badge. If a visitor does not have acceptable identification, as
			 determined by the badge issuer, the member of the DHS workforce being visited
			 must vouch for the identity of the visitor.
D. All visitors must be escorted at all times
			 when in areas where confidential, sensitive, or DHS information systems are
			 present.
E. Children of employees
			 or visitors under the age of 12 are not required to obtain a visitor badge. If
			 at any time, children will be unaccompanied by an adult, guardian, or a member
			 of DHS workforce, a visitor badge must be assigned and worn.
5014.4.4
Extended
			 Visitors
A. A DHS extended
			 visitor badge will only be issued to a person who is on contract or works
			 regularly with the Department of Human Services, and who must be in a DHS
			 facility three or more times a week conducting business.
B. Extended visitors must obtain a DHS
			 extended visitor badge by coordinating with the personnel specialist in the
			 division with which they will be working.
C. The extended visitor badge will only be
			 issued for a limited time period. At the end of this period, the visitor must
			 return the badge to the issuing personnel specialist.
5014.4.5
Contractors
Persons who contract with DHS and conduct business in a DHS
				facility three times a week or more will be issued a DHS identification badge.
				This badge must be returned at the end of the contract or when the contract
				employee terminates services to DHS, whichever is sooner.
5014.4.6
Temporary
			 Staff
A. Persons who are employed
			 by DHS on a temporary basis or through a local business and work in a DHS
			 facility for limited duration, etc., will be issued a DHS identification badge.
			 The supervisor or division personnel specialist must complete or assist the
			 employee in completing the required documentation.
B. If at any time the person's employment
			 status changes, his or her supervisor must make the proper notifications in
			 accordance with DHS termination or other policy.
5014.4.7
Packages and
			 Items
A. Certain DHS facilities
			 require special handling of packages and items introduced to the facility. Each
			 facility director may develop procedures for the proper handling of packages
			 and items. Facility procedures will be attached to Policy 5014.
5014.4.8
Facility
			 Evacuation and Disaster Preparation
A. Each facility director shall create and
			 maintain procedures for proper evacuation of DHS facilities.
B. Each facility director shall create and
			 maintain disaster response plans for facilities as appropriate or required by
			 state regulation.
5014.5
Definitions:
5014.5.1
DHS Information
			 Systems
: DHS Network services (Network, access, e-mail, Internet,
			 etc.), DHS applications (client-server," web-based, mainframe, etc.), or any
			 third-party software legally acquired and installed on the DHS devices for
			 which it was intended. Also includes any computer file, on any device in use by
			 DHS or its agents that is shared across the DHS network or requires DHS support
			 or that contains DHS-related information, the privacy of which must be
			 safeguarded.
5014.5.2
Confidential Information
: Information that is
			 protected from disclosure by federal or state law or regulation.
5014.5.3
Sensitive
			 Information
: Information or knowledge that might result in loss of
			 an advantage or level of security if revealed (disclosed) to others who might
			 have low or unknown trust ability and/or indeterminable or hostile intentions.
			 Loss, misuse, modification or unauthorized access to sensitive information can
			 adversely affect the privacy of an individual, trade secrets of a business or
			 even the security, internal and foreign affairs of a nation depending on the
			 level of sensitivity and nature of the information.
5014.5.4
Person
: For
			 the purposes of this policy, a person is defined as a uniquely identifiable and
			 distinguishable individual, whose identity has been validated and whose
			 association with DHS has been certified by the division requesting access
			 credentials. A person may or may not be a DHS employee.
5014.5.5
DHS
			 Facility
: A location on the approved site list maintained by the
			 CIO of DHS. This location must be under direct DHS control and supervision and
			 under compliance with the state and department physical and logical security
			 standards.
5014.5.6
Identification Badge
: A DHS issued badge that is used
			 to verify an employee's, visitor's, or contractor's personal
			 identity.
5014.5.7
Visitor
: Persons who are not contractors or DHS
			 employees.
5014.5.8
Workforce
: DHS employees, volunteers, trainees, and
			 other persons under the direct control of DHS, whether or not they are paid by
			 DHS.
5014.6
Exceptions to Policy:
5014.6.1
			 Exceptions to this policy and related standards must be requested in writing to
			 the DHS IT Security Officer. Exceptions are granted in writing on a per
			 instance basis and approved by the CIO. Individual exceptions do not extend
			 beyond the party to whom they are issued.
5014.7
References:
5014.7.1 Arkansas Physical and Logical
			 Security Standard
[LESS THAN]
http: //www .techarch. state. ar.
				us/domains/security/standards/S S-70-008 phys log
				standard.pdf
[GREATER THAN]
5014.7.2 Health Insurance Portability and
			 Privacy Act of 1996, United States of America
5014.8
Originating Section/Department
			 Contact:
5014.8.1 Office of Systems and
			 Technology 1st Floor Donaghey Plaza North POBox
			 1437, Slot N101 Little Rock, AR 72203-1437 Telephone: 682-0032