Written Information Security Program (Wisp) For Protection Of Personal Information Template Page 4
ADVERTISEMENT
1
2
3
4
5
6
7
8
9
10
11A. Information and Access
1. The amount of Personal Information collected shall be limited to that
amount reasonably necessary to accomplish the Corporation’s
legitimate business purposes, or necessary to the Corporation to
comply with other state or federal regulations.
2. Access to records containing Personal Information shall be limited to
those persons who are reasonably required to know such information
in order to accomplish the Corporation’s legitimate business purpose
or to enable the Corporation to comply with other state or federal
regulations.
3. Access to electronic Personal Information shall be restricted to active
users and active user accounts only.
4. Access to electronically stored Personal Information shall be
electronically limited to those employees or Board Members (see Part
I.A on page one for definition of “Board Member”) having a unique
log-in ID; and re-log-in shall be required when a computer has been
inactive for more than a few minutes.
5. Paper or electronic records (including records stored on hard drives or
other electronic media) containing Personal Information shall be
disposed of only in the following manner, in compliance with M.G.L.
c. 93I:
a. paper documents containing Personal Information shall be
either redacted, burned, pulverized or shredded so that Personal
Information cannot practicably be read or reconstructed; and
b. electronic media or other non-paper media containing Personal
Information shall be destroyed or erased so that Personal
Information cannot practicably be read or reconstructed.
B.
Board Members and Employees
1. A copy of the WISP must be distributed to each employee, including
part-time, temporary and contract employees, and to each Board
Member (see Part I.A on page one for definition of “Board Member”).
As a condition of their employment or Board service, all employees
and Board Members must sign an acknowledgement and certification
(see Acknowledgement & Certification at the end of this document)
that they have received a copy of the Corporation’s WISP and that
they will comply with the provisions of the WISP. These signed
acknowledgements and certifications shall be retained by the Data
Security Coordinator.
2. There must be regular training of employees and Board Members on
the detailed provisions of the WISP, including training at the inception
of a new employee’s employment or new Board Member’s board
service. The Data Security Coordinator shall organize such training.
4
ADVERTISEMENT
0 votes
Related Articles
Related forms
Related Categories
Parent category: Life