Ohio Administrative Code › Title 5101:9 - ODJFS Practices › Chapter 5101:9-9 - Federal Tax Return Information Safeguarding Procedures › Section 5101:9-9-25.1 - County agency federal tax information safeguarding procedures

Current through all regulations passed and filed through July 1,
			 2024
(A) This
			 supplemental rule provides general guidance to county agencies on the
			 safeguarding of federal tax information (FTI), with the exception of child
			 support enforcement agencies, which are required to comply with the
			 requirements of rule 5101:12-1-20.2 of the Administrative Code. Individual
			 program offices may, at their discretion, establish additional rules and/or
			 additional training programs. County agencies should consult their respective
			 program office for additional information regarding the safeguarding of
			 FTI.
(B) Required employee
			 awareness training:
Each county agency must provide disclosure awareness training
				to employees and contractors in accordance with guidelines set forth in
				internal revenue service (IRS) publication 1075, "Tax Information Security
				Guidelines for Federal, State and Local Agencies." Employees and contractors
				must maintain their authorization to access FTI through annual training and
				recertification. Prior to granting an agency employee or contractor access to
				FTI, each employee or contractor must certify his or her understanding of the
				IRS's and the agency's security policy and procedures for safeguarding IRS
				information. Employees must be advised of the provisions of sections 7431,
				7213, and 7213A of the Internal Revenue Code regarding the "Sanctions for
				Unauthorized Disclosure" and the "Civil Damages for Unauthorized Disclosure."
				The disclosure awareness training records must be maintained for a minimum of
				five years or in accordance with the agency's applicable records retention
				schedule, whichever is longer.
(C) Proper record keeping of FTI:
County agencies must keep records detailing internal requests
				for FTI by agency employees as well as requests received from outside of the
				agency, except for child support enforcement agencies, which are required to
				follow rule 5101:12-1-20.2 of the Administrative Code.
A tracking log must be used to record all movement, storage,
				and destruction of both electronic and non-electronic FTI received by the
				agency from the IRS. The data elements of the tracking log shall comply with
				the guidelines set forth in IRS publication 1075 and those provided by the
				applicable ODJFS program office. FTI must not be recorded on any tracking log.
				The logs must be maintained for a minimum of five years or in accordance with
				the agency's applicable records retention schedule, whichever is longer.
(D) Secure storage and handling of
			 FTI:
(1) FTI must be handled in such a manner
			 that it does not become misplaced or available to unauthorized staff. When not
			 in use, FTI must be secured via the required two barrier minimum pursuant to
			 the "Minimum Protection Standards (MPS)" section of IRS publication 1075. Refer
			 to table 3
			 in section 4.2 of IRS publication 1075 for further guidance.
(2) Minimum protection standards establish a
			 uniform method of physically protecting data and systems as well as
			 non-electronic forms of FTI. Local factors may require additional security
			 measures, therefore, local county management must analyze local circumstances
			 to determine location, container, and other physical security needs at
			 individual facilities. The MPS have been designed to provide management with a
			 basic framework of minimum security requirements. The objective of these
			 standards is to prevent unauthorized access to FTI. MPS requires two barriers.
			 Examples of two barrier minimum under the concept of MPS are outlined in IRS
			 publication 1075.
(3) FTI should
			 not be filed in areas used by employees not authorized to have access to FTI
			 such as areas used for breaks, food preparation or any similar facilities. FTI
			 files should not be maintained in areas that allow clients access. However,
			 when this is not practical, caution must be exercised by the agency pursuant to
			 the "Minimum Protection Standards (MPS)" section of IRS publication 1075. Refer
			 to table 3
			 in section 4.2 of IRS publication 1075 for further guidance.