Join Zoom Meeting

https://wcsdpa.zoom.us/j/94254575995

Meeting ID: 942 5457 5995

        +1 301 715 8592 US (Washington DC)
       

Executive Summary

Executive Summary

The mission of the Warren County School District is to support the personal and intellectual success and wellness of every student, every day.

Executive Summary

Executive Summary

Financial Reports

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Heartland School Solutions, the manufacturer of the district’s current cafeteria financial software has stopped support for the version currently in use at the Warren County School District. In order to stay compliant and to be eligible for support, we must upgrade our software platform from version 2.6.1 to 3.11.0. Other benefits to the district will be additional reports and user features to address accountability for MyLunchMoney.com, meal application processing and Direct Certification processing. This upgrade will also allow the district to meet reporting requirements.  The upgrade and training invoice were approved at the May 22, 2023, special meeting.

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

Executive Summary

I.       Purpose

This policy addresses the manner in which the District will respond to unauthorized access and acquisition of computerized data that compromises the security and confidentiality of personal information.

II.     Reporting a Data Breach

The Board directs any actual or suspected data breach (including unauthorized access to sensitive electronic data or exceeding one's authorization to electronic data) must be reported to the Director in charge of Technology as soon as is practicable under the circumstances.  The Board further directs that any data breach resulting in unauthorized access to unredacted and unencrypted personal information shall be reported to the Superintendent as soon as is practicable under the circumstances.  

III.    Definitions

Data Breach - Unauthorized access and acquisition of computerized data that materially compromises the security or confidentiality of personal information maintained by the District as part of the database of personal information regarding multiple individuals and that the District reasonably believes has caused or will cause loss or injury to any state resident. Good faith acquisition of personal information by an employee or agent of the school District for the purpose of the District is not a breach of the security of the system if the personal information is not used for a purpose other than the lawful purpose of the District and is not subject to further unauthorized disclosure.

Encryption - The use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of confidential process or key.

Health insurance information - An individual's health insurance policy number or subscriber identification number in combination with access code or other medical information that permits misuse of an individual's health insurance benefits.

Individual - A natural person.

Medical information - Any individually identifiable information contained in the individual's current or historical record of medical history or medical treatment or diagnosis created by a health care professional.

Personal information - Includes an individual’s first name or first initial and last name in combination with and linked to any one or more of the following, when not encrypted or redacted:

1. Social security number.

2. Driver’s license number or state identification card number issued instead of a driver’s license.

3. Financial account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual’s financial account.

4. Medical information.

5. Health insurance information.

6. A username or e-mail address, in combination with a password or security question and answer that would permit access to an online account.

Personal information does not include publicly available information that is lawfully made available to the general public from federal, state or local government records, or widely distributed media.

Records - Any material, regardless of its physical form, on which information is recorded or preserved by any means, including written or spoken words, graphically depicted, printed or electromagnetically transmitted. This term does not include publicly available directories containing information that an individual has voluntarily consented to have publicly disseminated or listed, such as name, address or telephone number.

Redaction - Includes, but is not limited to, alteration or truncation such that no more than the last four digits of a social security number, driver's license number, State identification card number or account number is accessible as part of the data.

IV.    Notification of a Data Breach

In the event of a data breach that results in unauthorized access to unredacted and unencrypted personal information the Superintendent, or his/her designee, shall follow the notification procedures required by the Breach of Personal Information Notification Act and provide notification to any resident of the Commonwealth whose unencrypted and unredacted personal information was, or is reasonably believed to have been, accessed and acquired by an unauthorized person.  Such notice shall be made within seven (7) business days of the day on which the breach was determined, except when a law enforcement agency determines and advises the District in writing that the notification would impede a criminal or civil investigation (in such case, the required notification will then be made after the law enforcement agency determines that such notification does not compromise the investigation or national or homeland security).

Additionally, the District shall provide notice to the District Attorney in the county where the breach occurred within three (3) business days of the day on which the breach was determined.   The District shall also provide notice of the breach if the encrypted information is accessed and acquired in an unencrypted form, if the security breach is linked to a breach of security of the encryption, or if the security breach involves a person with access to the encryption key.

The District shall provide notice by at least one (1) of the following methods:

1. Written notice to last known home address for the individual.

2. Telephone notice - if the individual can be reasonably expected to receive the notice and the notice is given in a clear and conspicuous manner; describes the incident in general terms; verifies the personal information but does not require the individual to provide personal information; and provides a telephone number to call or Internet website to visit for further information or assistance.

3. Email notice - if a prior business relationship exists and the school District has a valid email address for the individual.

4. Electronic notice - if the notice directs the individual whose personal information has been materially compromised by breach of the security of the system to promptly change the individual’s password and security question or answer, as applicable, or to take other steps appropriate to protect the individual’s online account, and other online accounts that may use the same user name, email address and password or security question or answer, to the extent the District has sufficient contact information for the individual.  

5. Substitute notice - if the District demonstrates one (1) of the following:

1. 1. The cost of notice would exceed $100,000.

1. 2. The affected individuals exceed 175,000 people.

1. 3. The District does not have sufficient contact information for the individual. 

Substitute notice shall consist of an email notice, when the District has an email address for the individual; conspicuous posting of the notice on the District’s website; and notification to major statewide media.

If the District provides notification to more than 1,000 persons at one (1) time, the District shall also notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis of the timing, distribution, and number of notices, without unreasonable delay.

V.     Data Security Controls

The District shall utilize technical controls such as firewalls, virus/malware detection, network access controls, user access controls, intrusion detection systems, encryption,
and/or regular software updates to maintain the integrity and security of all the District's electronic data.  Unredacted and unencrypted personal information shall be accessible to individual users on a need-to-know basis only, and the District shall utilize technical controls to restrict access to individuals with a legitimate educational or operational purposed to access such information.  

VI.    Vendors

The District may engage vendors who will need to have access to unredacted and unencrypted personal information to perform a service for the District.  The contract for any such vendor shall include a provision that the vendor is required to adhere to the same data security standards as outlined in this Policy and that to the fullest extent permitted by law, the vendor shall defend, indemnify and hold harmless the School District, and the School District’s employees, agents, Board Members, directors, officers, and representatives from and against any and all claims, liabilities, losses and expenses (including reasonable attorney fees and costs) arising from a data breach associated with the vendor, an employee of the vendor, the vendor’s computer system, or any personal device used by an employee of the vendor.

Any vendor that maintains, stores or manages computerized data on behalf of the District shall provide the District with notice of any breach of the security of the system following discovery by the vendor.  The District shall then be responsible for complying with the Breach of Personal Information Notification Act.  

VII.  Personal E-mail & Personal Electronic Devices

Employees shall not use personal e-mail accounts (accounts not issued by the District) or personal electronic devices (those not issued by the District) to transmit or store personal information.  

VIII. Administrative Procedures

The Superintendent or his/her designee may develop administrative procedures to implement this Policy.  

IX.    Penalties for Violations

A District employee who violates this Policy or any associated administrative procedure may be subject to disciplinary action, up to and including termination, in accordance with all applicable District disciplinary policies and procedures.  If warranted, referrals will be made to law enforcement.

The violation of this Policy by a vendor, depending on the severity, may be considered a material breach of contract that warrants contract termination and/or that serves as just cause to not contract with the vendor in the future.  If warranted, referrals will be made to law enforcement.

X.     Handbooks and Website

This Policy shall be included in applicable handbooks and posted on the District website.   

Adoption Date                  -     ______________, 2023

Revision Date                   -    

Review Date                     -    

Legal Reference                -     73 P.S. §2301, et. seq., 15 U.S.C. §1681a

Cross Reference                -    

Executive Summary

The School-Based Access Program (SBAP), is administered by the Department of Human Services (DHS) and its contractors, Public Consulting Group (PCG) and Sivic Solutions Groups (SSG). The agreement is necessary for (1) Direct Service Claiming Process and Fees and (2) Medicaid Administrative Claim (MAC) Process and Fees.

Executive Summary

Executive Summary

Executive Summary