Ohio Administrative Code › Title 102 - Ohio Ethics Commission › Chapter 102-1 - Definitions and Operating Procedures › Section 102-1-12 - Restricting and logging access to confidential personal information in computerized personal information systems

Current through all regulations passed and filed through July 1, 2024
For personal information systems that
				are computer systems and contain confidential personal information, the Ohio
				ethics commission shall do the following:
(A)
								 Access
			 restrictions. Access to confidential personal information that is kept
			 electronically shall require a password or other authentication measure.
(B)
								
			 Acquisition of a new computer system. When the Ohio ethics commission acquires
			 a new computer system that stores, manages or contains confidential personal
			 information, the ethics commission shall include a mechanism for recording
			 specific access by employees of the ethics commission to confidential personal
			 information in the system.
(C)
								 Upgrading
			 existing computer systems. When the Ohio ethics commission modifies an existing
			 computer system that stores, manages or contains confidential personal
			 information, the ethics commission shall make a determination whether the
			 modification constitutes an upgrade. Any upgrades to a computer system shall
			 include a mechanism for recording specific access by employees of the ethics
			 commission to confidential personal information in the system.
(D)
								 Logging
			 requirements regarding confidential personal information in existing computer
			 systems.
(1)
									
			 The Ohio ethics commission shall require employees of the ethics commission who
			 access confidential personal information within computer systems to maintain a
			 log that records that access.
(2)
									 Access to
			 confidential information is not required to be entered into the log under the
			 following circumstances:
(a)
										 The employee of the ethics commission is accessing
			 confidential personal information for official agency purposes, including
			 research, and the access is not specifically directed toward a specifically
			 named individual or a group of specifically named individuals.
(b)
										 The employee of
			 the ethics commission is accessing confidential personal information for
			 routine office procedures and the access is not specifically directed toward a
			 specifically named individual or a group of specifically named
			 individuals.
(c)
										 The employee of the ethics commission comes into
			 incidental contact with confidential personal information and the access of the
			 information is not specifically directed toward a specifically named individual
			 or a group of specifically named individuals.
(d)
										 The employee of
			 the ethics commission accesses confidential personal information about an
			 individual based upon a request made under either of the following
			 circumstances:
(i)
											 The individual requests confidential personal
			 information about himself/herself.
(ii)
											 The individual
			 makes a request that the ethics commission takes some action on that
			 individual's behalf and accessing the confidential personal information is
			 required in order to consider or process that request.
(3)
									 For purposes of this paragraph, the ethics commission
			 may choose the form or forms of logging, whether in electronic or paper
			 formats.