1. Given the growing concern regarding the
confidentiality of personal data and protecting individual’s privacy
rights, are staff who have access to personal data under greater scrutiny
as to how they use such data?
A
Yes, organizations
(whether public or private) have a vested interest in assuring that
personal information/data to which they have access is used in such a
manner as to comply with all confidentiality and privacy statutes and
regulations.
As publicly funded resources and by the nature of the types of
information/data to which they have access, the organizations that
comprise the workforce investment system need to be particularly cognizant
of confidentiality/privacy requirements. To maintain public confidence and
trust, workforce investment entities must assure that staff are
knowledgeable of and carry out their official duties in a manner
consistent with all legal requirements relating to access and use of
customer information.
Q
2. Are there plans to provide
notification to Career Center customers and potential Career Center
customers of the policies relating to protecting the confidentiality and
privacy of their information, possibly through a website posting?
A
DWD, its member
organizations (DCS and DUA) and other workforce investment institutions
are exploring potential options that will assist customers and potential
customers to be informed of the commitment to maintaining the
confidentiality of information provided by them.
Q
3. Will training regarding the information
confidentiality be provided to staff?
A
In conjunction with the
implementation of the policy an e-learning training module has been
developed specifically covering the issues of information confidentiality
and security. The training module is currently available to all
Massachusetts workforce investment system staff. As cited in
WIA
Communication No. 05-76 the e-learning module can be accessed via the
internet or intranet by going to the
Training specifically for executive/management level staff of LWIBs,
One-Stop Career Centers, and other local workforce investment entities
will also be scheduled. Notification of the training schedule for
executive/management level staff will be forwarded under separate cover.
Q
4. What organizations, specifically, are
considered the “workforce investment entities” whose employees and/or
contracted personnel are subject to signing the Confidentiality Policy
form by virtue of their position or responsibilities must or may have
access to the types of information covered under the Confidentiality
Policy?
A
Local entities include:
Workforce Investment Boards, One-Stop Career Centers, Title I
Administrators, Fiscal Agents, Career Center Partners, local organizations
with access to MOSES, workforce investment service providers who serve
customers under Title I and/or Title III (Wagner-Peyser) or other funding
sources administered through the Department of Workforce Development, the
Division of Career Services, the Division of Unemployment Assistance or
the Commonwealth Corporation.
Q
5. Should One-Stop Career Centers
initiate/implement written information release forms to be signed by
customers authorizing use of their information and data for official
duties?
A
A signed release form does not necessarily
protect an organization (or a staff member) from sanction should a
customer’s information be improperly used or accessed. Generalized release
forms that do not fully specify the exact uses for which information may
be accessed or used by an organization’s staff may not pass legal scrutiny
in meeting the requirements of a customer’s “informed consent” that may
likely be applied in a legal action relating to an alleged breach of
information confidentiality and/or privacy.
Q
6. If a customer signs an information release
form, what specific information can be released?
A
While the release form signed by the
customer should fully specify the information elements for which release
is authorized, only information that is relevant to the specific service
or action being considered at that time by the staff person should be
accessed or released. For instance, if a customer is an ex-offender and
that information is recorded in the case management notes in MOSES, if a
staff person is looking to access child care services (under supportive
services) for the individual while going on job interviews it would not
appear that the customer’s status as an ex-offender is relevant and should
not be divulged . However, if in the course of conducting job development
on behalf of the individual it might be relevant to discuss the customer’s
status as an ex-offender with a potential employer in light of a specific
job requirement that the employee be “bondable” in relation to the
availability of the federal Bonding Program. [Note: see previous Q & A]
Q
7. Is personal information that is already part
of a “public record” (such as a customer’s status as a Level III sex
offender) subject to the confidentiality and privacy requirements
described in this policy? What about in terms of a personal safety issue
for the career center staff, themselves…should the career center staff be
made aware of the individual’s status?
A
To the extent the information is not
relevant to carrying out the official duties and responsibilities of the
staff person accessing the information, such information is subject to the
confidentiality/privacy requirements covered under this policy issuance.
Regarding the personal safety issue of career center staff, the situation
should be dealt with in accordance with the policies and procedures as
implemented under the career center’s Workplace Safety Plan.
Q
8. Can customer information, such as sensitive
personal information discussed as part of the case management process, be
kept confidential in MOSES?
A
While MOSES is not configured to
automatically keep all customer information “confidential”, staff should
use the “Confidential” button to secure the confidentiality of case
management “notes” where sensitive personal information should be recorded
in MOSES. Use of the “Confidential” button restricts access to the
information to the “case manager” and to supervisory staff with a higher
MOSES security level.
It should be noted that recording of any customer’s sensitive personal
information should be recorded in MOSES only if it is relevant to
effectively serving the customer’s needs.
Q
9. How far reaching is the Confidentiality
Policy?
A
Anyone who, by the nature of his/her
position may acquire or have access to confidential information, including
access through MOSES must sign the Confidentiality Policy form.
Q
10.If a “boilerplate” Confidentiality Statement
is already included in vendor contracts, will that suffice?
A
All staff of subcontractors who, by virtue
of their position may access confidential information in carrying out
their official duties under the terms of the contract must sign and submit
the Confidentiality Policy form.
Q
11. Must ITA (Individual Training Account)
vendors sign the Confidentiality Policy form?
A
Generally, by virtue of a WIA customer
having chosen the ITA vendor from the state listing of approved ITA
training vendors, it may be inferred that the customer has authorized the
sharing of pertinent information. If, however, an ITA approved training
vendor has MOSES access, vendor staff who would have access to information
through MOSES must sign the Confidentiality Policy form.
Q
12. Are One-Stop Career Center partners able
to share any confidential information with each other in the center?
A
The WIA Communication
No
05-76 provides the parameters that govern access to and the sharing of
information among the various workforce partners and stakeholders that
comprise the Massachusetts workforce development system, including
One-Stop Career Centers.
Q
13. Should there be two distinct and separate
policies – one for One-Stop Career Center employees and another for
contractors, other partners and vendors
A
No. While all forms of data/information
described in the Confidentiality Policy may not apply to everyone, the
characteristics of the data do not change depending upon who has
possession of the data. The data remains confidential and, therefore, a
single, uniform policy regarding accessing this information is
appropriate.
Q
14. Title I is not mentioned in this policy;
thus there is no mention of WIA income/eligibility information. Is that
confidential?
A
WIA income/eligibility information linked to
a particular person would be considered confidential under G.L. c. 66A
(State Privacy Act).
Q
15. If WIA vendors collect eligibility
information on behalf of customers (including income information and UI
status if necessary) are they allowed to give it to the One-Stop Career
Center/WIB/other?
A
This question is outside the scope of this
Confidentiality Policy. What vendors may disseminate would depend upon the
contract between the vendor and the contracting entity.
Q
16. What is the definition of “non-workforce
development entities”?
A
A “non-workforce development entity” is an
entity that is not part of the Massachusetts workforce development system.
Examples may include, but are not limited to marketing companies,
fraternal veterans’ organizations, proprietary training schools.
Q
17. Hypothetically, if a career center staff
person is working with an ex-offender (who happens to be a convicted
murderer, rapist or otherwise dangerous person) and under some
circumstances, such as through a CORI check or other legal avenue, this
background is discovered or comes to light, are we allowed and/or
obligated to share this information with staff? Or, by law are we
forbidden to share this information with staff. What about our obligation
to employers? Also, is there a difference in “handling” this information
if the person self-certifies to the information?
A
Access to information regarding the specific
nature of an individual’s criminal history acquired as a result of a CORI
check is specifically limited to individuals who have an approved
“Individual Agreement of Non-Disclosure” form on file with the
Massachusetts Criminal History Board. However, should the specific nature
of an individual’s offense become known through either the results of a
CORI check performed by staff of a career center (or other local workforce
development organization covered by WIA Communication No. 05-76) or
through other, legal means such information is to be considered “personal”
information subject to the same confidentiality protections/limitations as
other “personal” information or data and said information should only be
accessed or conveyed by a staff person if necessary to carry out his/her
professional duties and responsibilities. Staff should take caution to
convey only the level of information (such as to a potential employer)
that is minimally required to perform and complete their duties in a
professional manner.
Regarding the personal safety issue of career center staff, the situation
should be dealt with in accordance to the policies and procedures as
implemented under the career center’s Workplace Safety Plan.
Q
18. This policy communication appears to
establish distinct silos in which One-Stop Career Center partners do not
and will not have access to information. Please clarify?
A
WIA Communication No 05-76
provides the
parameters that govern access to and the sharing of information among the
various workforce partners and stakeholders that comprise the
Massachusetts workforce development system, including One-Stop Career
Centers.
Q
19. Must One-Stop Career Center employees use
only a private setting to discuss a customer’s personal information?
A
Yes, whenever possible One-Stop Career
Center employees should use a private setting to discuss a customer’s
personal information. An office type setting is best, but if only cubicle
type settings are available to conduct business, employee cubicles should
be located far enough away from public areas of the OSCC so that
conversations may not be overheard by visitors or customers. In centers
where space does not permit a sufficient separation of employee areas from
public areas, offices or conference rooms should be used when
circumstances require or a customer so requests. One-Stop Career Center
operators (as well as any other Massachusetts workforce development
entity) must take all reasonable care to assure the confidentiality of
customer information consistent with statutory requirements. The policy
assumes that reasonable care is being taken to protect the confidentiality
of the information and to ensure that confidential information is not
discussed or conveyed in an inappropriate setting or manner.
Q
20. My staff are already covered under the MOSES
Confidentiality Agreement, why must they also sign the Confidentiality
Policy form?
A
MOSES is only one data source of
confidential information. This policy is broader and intends to raise
awareness concerning proper information practices and procedures designed
to ensure customer confidentiality with paper records, telephone
conversations, meetings, etc. To assure that individuals, who by the
nature of their position and functional responsibilities have read,
understand and agree to comply with the policy it is necessary to
initially obtain, and maintain on file, a hard copy of the individual’s
signature. The MOSES Confidentiality Agreement does not provide for
acquisition of an original signature.
Q
21. Under the policy, why is the DCS Field
Manager in charge of getting employees on and off the list? It makes more
sense that this should be centralized at the local One-Stop Career Center
or other city entity. This way it would eliminate an extra step and
prevent employees from possibly being incorrectly added or deleted from
the list. The list should be managed by someone on-site. If kept locally
then policies and procedures would be written and internal reports
compiled to ensure that the data access and the use privileges of
employees and contractors are reviewed annually by the local One-Stop
Career Center staff.
A
While the policy places overall
responsibility for the identification of staff who must sign the
Confidentiality Policy form and the collection/maintenance of
Confidentiality Policy form signatures on the local DCS Field Manager,
nothing in the policy prohibits local areas from assigning or delegating
specific procedural tasks to other local staff under the overall oversight
and responsibility of the Field Manager to see that those tasks are
carried out and that the overall policy is followed. The local workforce
partners are encouraged to work together under the leadership and guidance
of the Field Manager to implement procedures that most effectively meet
the needs of the local area in complying with the requirements of the
policy.
Q
22. Local Workforce Boards have access to MOSES
data and would need to be under the same policies as other partners. Under
the UI data it is impermissible to provide claim information to the LWIB
A
Employees may access UI information
identifying a single individual or business only in connection with the
performance of their official duties. As a volunteer Board charged with
the planning and oversight responsibility of the One-Stop Career Center
system in their areas, the LWIBs do not require identifying UI information
as part of their official responsibilities. LWIBs may still be furnished
with summary UI Information unless a specific aggregated data element or
elements are sufficient to identify a specific individual or business
entity.
Q
23. With regard to wage record data, is it the
DCS One-Stop Career Center staff or the state level DCS staff that would
provide the cross-matching of U.I. claimants' information against wage
records to detect claimants who are working and collecting UI benefits at
the same time?
A
The cross-matching of UI claimant
information against wage records to detect claimants working and
collecting is a DUA function. DCS employees are not involved.
Q
24. If we have specific questions about
confidentiality that we may need answered in a timely manner, who do we
call?
A
Specific questions regarding information
confidentiality and security may be submitted to
PolicyQA@detma.org. A timely
response will be provided.
Q
25. What if a staff person of a partner
organization does not want to sign (the language about imprisonment and
fines might scare some away)?
A
Failure to sign the Confidentiality Policy
form does not exempt a staff person from the statutory provisions. The
purpose of the policy is to provide basic information about the statutes
that pertain to release and access of information and data and to provide
a number of examples to illustrate permissible and impermissible uses.
Signing the form acknowledges receipt and understanding of the policy and
agreement to abide by its provisions.
A staff person who is a registered MOSES user jeopardizes his/her MOSES
access if a signed Confidentiality Policy form is not submitted.
Q
26. I have some concerns that specific UI
information needed to assist a career adviser in evaluating the ability of
a customer to sustain him or herself during training may not be requested
in planning individual services.
A
One-Stop Career Center employees may
continue to have access to UI information for the purpose of providing
claimants with employment and training related services.
Q
27. am also concerned that we should be given
positive examples of permissible information that we could give to LWIBs,
etc. in their role of review and oversight of services. Our local
Workforce Issues Committee occasionally asks for general trends and
non-specific information to better serve target populations including UI
recipients. What is allowable?
A
Generally, the related statutes, regulations
and the WIA Policy Communication, itself do not prohibit the use of
aggregated, non-specific information/data to allow for the analysis of
local, regional or national trends pertinent to the operation of the
Commonwealth’s workforce development system either at the state or local
level. However, in the case where the cohort used to produce the
aggregated data is so small that the data element, itself would in fact
allow for the identification of a specific individual or employer, that
data element must be kept confidential.
Q
28. As a local DCS manager I receive requests
from my Title I/NEG/Trade partners for printouts of the QSGN screen for
U.I. status verification in determining an individual’s program
eligibility. May I provide them with the QSGN printouts?
A
Employees whose official responsibilities
require them to verify UI status as a condition of eligibility under Title
I/NEG/Trade programs may receive UI information.
Q
29. May staff of the Food Stamp Unit and TAFDC
caseworkers request information from DCS if the customer has filed a claim
or is collecting U.I?
A
G.L. c. 151A, §46 authorizes disclosure of
U.I. information to the Department of Transitional Assistance in order to
carry out its official duties.
Q
30. May DUA or DCS staff comply with a local
City/Town Veterans’ Agent’s request as to the status of a veteran’s U.I
claim, specifically if the veteran has exhausted his/her claim in order to
determine eligibility for other locally provided services?
A
DCS employees, including Local Veterans’
Employment Representatives (LVERs) and Disabled Veterans’ Opportunities
Program staff (DVOPs) working in OSCCs, are authorized to receive U.I.
information in the performance of their official duties. DUA or DCS staff
may also provide UI Claims information/data to City/Town Veterans Agents
if the agents need such data in the performance of their official duties.
Q
31. If a claimant calls the One-Stop Career
Center and requests that a copy of his/her claim history be mailed to
him/her at the address shown on the claim, can this be done?
A
Such a request should be forwarded to Lisa
Soltero, Director of Internal Control and Security, C. F. Hurley Building,
4th floor, Boston, MA 02114. Ms. Soltero will respond to the request.
Q
32. We mail out employer follow-up letters every
month with a list of individuals who had been referred to the employer to
determine whether or not they were hired. The follow-up letters lists the
referred customers by name and includes their Social Security Numbers. Is
this allowable?
A
For the purpose of determining the outcome
of a referral, DCS/OSCC employees may send a follow-up letter to the
prospective employer. However, the follow-up letter should not contain the
Social Security Number unless authorized by the customer.
Q
33. Will we be provided with a consent form that
could be used by the customer when requesting U.I. information for other
program services?
A
Yes. The Legal Department in conjunction
with the Department of Internal Control and Security (ICS) will be
drafting a Model Consent Form.
In the interim, career centers may continue to use existing release forms.
Please note that no release form will protect against possible sanction
for impermissible use. A release form only authorizes the data holder to
release the information to another person for the purpose specified on the
form.
Q
34. We receive requests from Housing Authorities
for U.I. information on a release form signed by the customer. The Housing
Authorities use the information in determining eligibility for low-income
housing and fuel assistance. Is this method acceptable?
A
U.I. Claimants may authorize the release of
the U.I. information to third parties. We understand that some of the
forms used by Housing Authorities and other organizations may not be
specific enough to constitute an authorized release. Consideration is
being given to centralizing with Internal Control and Security (ICS) the
handling of these requests and to standardizing the release forms.
ICS will be working with the Housing Authorities and other entities that
request data on a regular basis to standardize the request and response
process.
Q
35. Several CBOs that JCS contracts with have
staff members who will be trained on MOSES in the near future (Nov., Dec.,
Jan). Should those staff members sign a confidentiality form now, or will
that be handled at their training?
A
There is nothing in the Confidentiality
Policy that prohibits an individual from signing the Confidentiality
Policy form in advance of MOSES training and gaining MOSES access.
Conversely, neither are they required under the provisions of the policy
to sign the Confidentiality Policy form at this time unless they currently
have access to confidential information/data through another media source
(emails, customer conferences, etc.) in which circumstance they should
sign and submit the form immediately.
Q
36. Who should an employee contact with any
questions or concerns about the confidentiality of data, data sharing,
particular data practices or data sharing requests?
A
The employee should address their questions
or concerns with his/her manager. If the manager needs assistance in
responding to those questions or concerns, the manager should contact the
Director of Internal Control and Security at gsoltero@detma.org .
Q
37. What are the limits on a Release of
Information (ROI) form used by a Career Center either to request
information or share information with another One-Stop partner or agency?
A
In addition to the customer’s name,
signature and date, the ROI form must contain sufficient information to
constitute an “informed consent.” This means that the form must inform the
customer what information will be requested and from whom; what
information will be shared and with whom; the purpose of such request or
sharing; and the consequences if the customer does not authorize the
release of information. The Legal Department is working with ICWS in
developing a Model Consent Form.
Q
38. It would help if more clarification could be
provided on what we can share and/or not share with each other in the
Career Center. For example, Case Example #10 indicates that we cannot ask
the UI Walk-In claims taker to use QDOR to determine if a customer has
returned-to-work.
A
Confidential information may be shared
within a Career Center only if authorized either through informed consent
or by statute. The Unemployment Insurance Law allows for the sharing of UI
information with DCS and OSCC employees. The Employment Service Law allows
for the sharing of ES data for the purpose of administering the public
employment service program. Finally, the Privacy Act allows the holder of
personal data to share that data with another entity provided that such
sharing is authorized by statute. In all cases, employees may request and
receive confidential data only in the performance of their official
duties.
Wage record information is furnished to DUA and DCS by the Department of
Revenue pursuant to an Agreement that contains strict confidentiality
provisions. DUA employees may use the wage record information in
administering the UI program. DCS employees may use the wage record
information for the purpose of evaluating the employment and earnings
outcomes of its programs. Without a release from the customer, DUA and DCS
employees may not share wage record information.
Q
39. Of the partner agencies, like Project ABLE,
Mass Rehab, or where our staff use offices of a partner agency, are the
employees of the partner agency covered by the terms of the
Confidentiality Policy and are they required to sign the Confidentiality
Policy form? Do the terms of the Confidentiality Policy and the
requirement to sign the Confidentiality Policy form apply to
staff/personnel who merely see the information (such as on an open MOSES
screen or from a memorandum viewed on another staff person’s desk), or do
they apply only to individuals who have direct access to MOSES?
A
As stated in Policy Communication No. 05-76
all MOSES users must sign the Confidentiality Policy form. All employees
of the Department of Workforce Development, including DCS and DUA must
sign the Confidentiality Policy form. In addition, staff of Local
Workforce Investment Boards, One-Stop Career Centers, and other career
center partners and any subcontractors to each who, by virtue of their
position may, in carrying out their official duties, may access any forms
of information covered under the policy must sign and submit the
Confidentiality Policy form.
The information covered under the policy is not limited only to that
accessed through MOSES. In addition to MOSES, information covered under
the policy may become known or communicated to an individual staff person
through a variety of methods that include but are not limited to written
reports, official organization notices, memoranda or emails, personal
conversations with other staff or customers, themselves (both job seeker
and employer customers). Notwithstanding the source or form of
confidential information or data, if the information or data is generated
as a function of the individual job seeker’s or the employer’s status as a
customer of the workforce development system staff of any of the
aforementioned organizations or entities who, in the course of conducting
their official responsibilities may receive or access covered information
are subject to the provisions of the policy to protect the confidentiality
of such information/data and are required to sign and submit the
Confidentiality Policy form.
Q
40. Are employers that are provided job seeker
information in the course of discussing or making a referral to one of its
job openings required to sign the Confidentiality Policy form?
A
No, generally speaking employers are not
required to sign the Confidentiality Policy form.
While there would be no requirement to sign the Confidentiality Policy
form based on the “job referral” scenario described, theoretically, the
circumstance might arise, such as in the case of a “dislocated worker”
situation where workforce investment services might be provided on-site at
a company location in a “partnership” arrangement with the employer. In
such cases, the provisions of the policy would be applicable to any
workforce investment staff working at the on-site location. Depending upon
the nature of the “partnership” the circumstances may warrant that at
least some of the employer’s staff would be required to sign the
Confidentiality Policy form.
For instance, if a service center was established at the company location
that included co-management and co-staffing with both workforce investment
and company personnel, and in regular service review meetings that
included company personnel in which the discussion of individual cases
would likely include a review of an individual’s UI claim information
related to the individual’s pursuit of training opportunities, it would be
necessary for any company personnel who would access such information (per
the discussion) to have signed the Confidentiality Policy form. Or, if a
company staff person was assigned the responsibility for entering all
participant information into MOSES (based on MOSES access being
established at the on-site location) the staff person would also have to
sign the Confidentiality Policy form.
Q
41. In conducting “job development” activity can
a career center staff person provide “Employment Service Information”
(e.g., an applicant’s name & address, demographics, employment history,
etc.) to an employer without the applicant’s knowledge or prior
authorization? When we run job matches based on employers’ job orders and
we match people to these job orders, can we provide information to the
employer without the applicant’s prior knowledge/approval, even if, in
MOSES, the Confidential YES button (which relates to JobQuest searches -
see below) has been selected?
Do you want your contact information confidential?*
Yes - Your contact information will
not be displayed to employers when they browse your profile via the
internet. Employers will not be able to contact you directly about
possible job openings.
No - Your contact information will be displayed to employers when they
browse your profile via the internet. Employers will be able to contact
you directly about possible job openings.
A
If the “applicant” is a registered customer
of the Massachusetts One-Stop Career Center system at the time the job
development activity is being conducted, the Confidentiality Policy does
not prohibit the use of customer “Employment Service Information” in
conducting the “job development” activity (defined in the classic sense as
‘cold calling’ potential employers on behalf of a specific job seeker to
identify possible employment opportunities without benefit of a specific,
job order from the employer) as long as the information elements are
relevant to the job development transaction process.
In the case of a career center staff person generating through the MOSES
“matching” functionality a list of job seekers that potentially meet the
requirements of an employer’s job order, again there is no prohibition
from utilizing the customer information, so derived, in the course of
transacting a referral to the employer as long as only that information
relevant to the referral process is used.
In generating such MOSES job matching lists, a special circumstance
regarding the Massachusetts JobQuest functionality warrants discussion in
relation to the provisions of the Confidentiality Policy. JobQuest is an
internet based application available to any person with internet access. A
JobQuest user is not required to be a registered One-Stop Career Center
customer in order to utilize JobQuest (although the JobQuest website
provides the capacity for an individual to register as a One-Stop Career
Center customer, if he/she so chooses). When an individual registers as a
JobQuest user, the personal profile information that he/she submits
automatically populates the data fields in the MOSES “Basic” and “Full”
registration tabs and creates a MOSES customer record for that individual
(the JobQuest user is not notified of this occurrence and he/she is not
automatically registered as a One-Stop Career Center customer).
Because the individual has a MOSES record, it is possible for the
individual to “match” against an employer’s job order when a career center
staff person conducts a MOSES job seeker match (generating a list of
individuals who may meet the listed job requirements), even if the
individual is not a registered career center customer. In such cases, is
the staff person who is utilizing the “match” list to generate possible
referrals to the employer’s job opening required to obtain the
individual’s authorization to provide information to the prospective
employer prior to transacting the referral?
The answer is yes. The JobQuest customer who is not a registered One-Stop
Career Center customer is not informed through the JobQuest website that
profile information he/she submits may be used in any context other than
an employer conducting a search for potential job applicants. Until such
time as the JobQuest website is updated to include such notification,
One-Stop Career Center staff generating MOSES “Match” lists must determine
if any individual in the list is not a current One-Stop Career Center
customer and must receive the individual’s express authorization to
provide profiled information to a prospective employer in advance of any
communication with the employer about the individual.
Q
42. What information, if any, can be discussed
or provided to a training provider prior to a customer enrolling in the
vendor’s program? Once a customer has enrolled in a training program, must
written authorization be obtained in order to communicate with the vendor
regarding the customer?
A
In carrying out one’s professional/official
duties, discussion of information appropriate to transacting a potential
referral to a training program on behalf of a job seeker customer is
consistent with the provisions of the Confidentiality Policy as described
in WIA Communication No. 05-76. However, only information relevant to
carrying out the transaction should be discussed. In this scenario, it
might be appropriate to discuss the person’s name, city or town of
residence (if a commuting issue existed), educational or prior training
experience and former job title or work history. It would not likely be
appropriate to discuss the individual’s telephone number, specific street
address, age, birth date, marital status or UI claim status in transacting
the referral process.
Additionally, as cited in a prior response, if the training vendor in
question is an ITA approved training vendor, and the customer’s choice of
that vendor from the state listing is the basis for the discussion, the
act by the customer “choosing” the vendor implies authorization to discuss
relevant information with the training vendor. Furthermore, even in the
case where the training vendor is not an ITA approved provider, and
whether or not the discussion occurs prior to or post enrollment, if the
discussion is conducted in the course of carrying out one’s official
workforce investment duties, the inclusion in the discussion of relevant
customer information is consistent with the permissible uses of
information as described in the Policy.
Q
43. As a staff person who is a MOSES user, why
do I have to use the 4 digits of my Social Security number to obtain MOSES
access? I believe my SS# should be protected as well.
A
There is no technical requirement that a
MOSES user employ his/her Social Security number to obtain MOSES access.
Use of any 9-digit identifier is technically feasible and permissible as
long as the user follows the established annual procedures for activating
MOSES access. If you so choose, you may change the 9-digit identifier the
next time you are scheduled to renew your MOSES user registration.
Q
44. I used to be a career center customer and am
now a career center employee. What provisions if any is the state
undertaking to protect my identity as a previous career center customer?
My UI and MOSES case management notes are available to all staff members
including my salary, home address, home phone number, etc.
A
Federal regulations pertaining to One-Stop
Career Center performance require career center customers to be tracked
for two years following exit from a WIA funded program or from the last
receipt of a WIA funded service. This requirement necessitates that a
customer’s record be retained in MOSES for the required tracking period,
whether the record remains “active” or “inactive”. Additionally, per the
request of the entities that comprise the Massachusetts One-Stop Career
Center system, current policy related to the administration of MOSES does
not provide for “archiving” customer records after a specified time
period.
Q
45. Does our Career Center Membership form need
to be updated to include a clause giving us permission to discuss the
information with other internal resources and outside training vendors?
A
What information is included in a One-Stop
Career Center’s membership form is not within the purview of the
provisions of the Confidentiality Policy as delineated in WIA
Communication 05-76. As cited in a prior response, information release
forms (or clauses) do not necessarily protect an organization (or
individual) from potential sanction if a customer’s information is used in
an impermissible way. The pertinent statutes already allow for the use of
customer information in carrying out one’s official workforce investment
duties and responsibilities without the need for the customer’s
authorization to do so.
Q
46. Do outside vendors who conduct workshops and
networking events in a One-Stop Career Center need to sign the
confidentiality policy? What information can we share with them?
A
To the extent that an “outside” vendor may
access customer information covered under the provisions of the
Confidentiality Policy delineated in WIA Communication No. 05-76, in the
course of conducting its workforce investment related business in
agreement with (or under contract to) a Massachusetts workforce investment
entity subject to the provisions of the confidentiality policy, the
vendor’s representative must sign the Confidentiality Policy form.
Q
47. What is the policy on identifying ourselves
when initially contacting a customer to schedule an appointment? If the
spouse of the customer or other family member answers and asks the purpose
of the call or would like additional information as to why I am calling,
or what services are available, etc. what is allowable? Does the policy
impose any specific limitations as to what information may be left in a
telephone message if the customer is not available?
A
With regard to sharing a customer’s
information with the customer’s spouse or family members (such as in the
case of a telephone inquiry to the customer’s home), the “Unemployment
Insurance Information/Data” section of the Confidentiality Policy
delineated in WIA Communication 05-76 as well as “Case Example # 11”
specifically cite the prohibition of sharing a customer’s UI claim
information with any individual (including a spouse and family members)
without express written authorization from the customer. With regard to
customer personal information/data that is not UI claim related, WIA
Communication No. 05-76 also specifically states that “the same
permissible and impermissible use and disclosure limitations that apply to
both employment service and unemployment insurance data also apply to
personal data”.
Q
48. May we slightly alter the Confidentiality
Policy form by adding producing it on our Career Center letterhead for our
staff to sign?
A
No, the form itself may not be printed on
career center (or other organizational) letterhead. You may, however
attach a cover page printed on your career center letterhead.
Q
49. May we add numbering to the pages of the
Confidentiality Policy form such as “one of four”, “two of four”, etc. and
have staff initial each page?
A
The Confidentiality Policy form as posted on
the Massachusetts Workforce System website at www.massworkforce.org
includes page numbers. The Confidentiality Policy includes no requirement
that each staff person initial each page in addition to signing the form.
As long as the initialing of each page is “requested” and not “required”
and there is no sanction implied or imposed against an employee or staff
person for not initialing each page the Commonwealth has no reason to
prohibit such a request.
However, while there is no prohibition from making such a request, such a
request is not advised in order to lessen any apprehension on the part of
employees and/or staff with regard to signing the Confidentiality Policy
form.
Q
50. If EAS staff see in MOSES that an EAS
customer has attended a Career Center Seminar, indicating that the
customer is receiving U.I. benefits, can the EAS staff person furnish this
information to DTA?
A
An EAS customer’s attendance in a Career
Center Seminar does not necessarily indicate that the individual is also
receiving U.I. benefits as EAS customers are regularly encouraged to
attend Career Center Seminars as part of their case management activities
in order to learn about employment related services available through the
One-Stop Career Center system. Additionally, under certain circumstances,
it is possible that a U.I. eligible individual, because of his/her low
weekly U.I. benefit rate, may in fact also be eligible for DTA benefits,
and would not constitute an issue of potential fraud.
However, if in carrying out his/her official responsibilities an EAS staff
person learns that a current EAS customer is, in actuality, concurrently
receiving UI benefits and notwithstanding if a clear issue of fraud is
evident, MGL c.151A §46 authorizes disclosure of UI information to the
Department of Transitional Assistance in order to carry out its official
duties (see response to Question # 29, above).
