Ohio Administrative Code › Title 3901 - Department of Insurance › Chapter 3901-1 - General Provisions › Section 3901-1-02 - Access to confidential personal information

Current through all regulations passed and filed through July 1, 2024
(A) Purpose
This rule is to regulate employee access to the confidential
				personal information that the department of insurance (department) keeps. This
				rule applies to both electronic records and records kept on paper.
(B) Authority
This rule is promulgated under the authority of division (B) of
				section
				1347.15
				of the Revised Code that requires each state agency to adopt rules under
				Chapter 119. of the Revised Code to regulate access to confidential personal
				information. Section
				3901.041
				of the Revised Code provides that the superintendent of insurance
				(superintendent) shall adopt, amend and rescind rules to discharge the
				superintendent's duties and exercise the superintendent's
				powers.
(C) Definitions
For the purpose of this rule promulgated in accordance with
				section
				1347.15
				of the Revised Code, the following definitions, as set out by the department of
				administrative services in rule
				123:3-2-01
				of the Administrative Code, apply:
(1)
			 "Access" as a noun means an instance of copying, viewing, or otherwise
			 perceiving whereas "access" as a verb means to copy, view, or otherwise
			 perceive.
(2) "Acquisition of a new
			 computer system" means the purchase of a "computer system," as defined in this
			 rule, that is not a computer system currently in place nor one for which the
			 acquisition process has been initiated as of the effective date of the agency
			 rule addressing requirements in section
			 1347.15
			 of the Revised Code.
(3) "Computer
			 system" means a "system," as defined by section
			 1347.01
			 of the Revised Code, that stores, maintains, or retrieves personal information
			 using electronic data processing equipment.
(4) "Confidential personal information" (CPI)
			 has the meaning as defined by division (A)(1) of section
			 1347.15
			 of the Revised Code and identified by rules promulgated by the agency in
			 accordance with division (B)(3) of section
			 1347.15
			 of the Revised Code that reference the federal or state statutes or
			 administrative rules that make personal information maintained by the agency
			 confidential.
(5) "Employee of the
			 state agency" means each employee of a state agency regardless of whether he or
			 she holds an elected or appointed office or position within the state agency.
			 "Employee of the state agency" is limited to the specific employing state
			 agency.
(6) "Incidental contact"
			 means contact with the information that is secondary or tangential to the
			 primary purpose of the activity that resulted in the contact.
(7) "Individual" means a natural person or
			 the natural person's authorized representative, legal counsel, legal custodian,
			 or legal guardian.
(8) "Information
			 owner" means the individual appointed in accordance with division (A) of
			 section
			 1347.05
			 of the Revised Code to be directly responsible for a system.
(9) "Person" means a natural
			 person.
(10) "Personal information"
			 has the same meaning as defined in division (E) of section
			 1347.01
			 of the Revised Code.
(11) "Personal
			 information system" means a "system" that "maintains" "personal information" as
			 those terms are defined in section
			 1347.01
			 of the Revised Code. "System" includes manual and computer systems.
(12) "Research" means a methodical
			 investigation into a subject.
(13)
			 "Routine" means commonplace, regular, habitual, or ordinary.
(14) "Routine information that is maintained
			 for the purpose of internal office administration, the use of which would not
			 adversely affect a person" as that phrase is used in division (F) of section
			 1347.01
			 of the Revised Code means personal information relating to employees and
			 maintained by the agency for internal administrative and human resource
			 purposes.
(15) "System" has the
			 same meaning as defined by division (F) of section
			 1347.01
			 of the Revised Code.
(16) "Upgrade"
			 means a substantial redesign of an existing computer system for the purpose of
			 providing a substantial amount of new application functionality, or application
			 modifications that would involve substantial administrative or fiscal resources
			 to implement, but would not include maintenance, minor updates and patches, or
			 modifications that entail a limited addition of functionality due to changes in
			 business or legal requirements.