PERAC Memo #19 - 2003: Privacy and Security of Boards’ Records, Documents and Communications
Privacy and Security of Boards’ Records, Documents and Communications
View original on MA State Library →Summary
This memo, prompted by HIPAA's implementation, urges retirement boards to review the privacy and security of paper records, computer systems, and member counseling spaces, even though boards are not HIPAA-covered entities. It recommends practical steps such as locking file cabinets, restricting access to board personnel only, securing shared computer systems (potentially via confidentiality agreements or separate systems), and ensuring private spaces for member counseling. While no specific mandatory action is required, boards should proactively assess and improve their privacy/security practices, consulting board counsel and municipal IT staff as needed.
Full Text
Memorandum # 19/2003
M E M O R A N D U M TO: All Retirement Boards FROM: Joseph E. Connarton, Executive Director RE: Privacy and Security of Boards’ Records, Documents and Communications
DATE: June 9, 2003
The implementation of the federal Health Insurance Portability and Accountability Act (HIPAA) is an opportunity for all retirement boards to consider privacy and security issues concerning board offices and records. While retirement boards are not covered entities under HIPAA, the new law clearly raises the bar for all holders of confidential and personal information. This memorandum will discuss only a few of the important security and privacy issues. Boards are encouraged to seek assistance from board counsel, city and town privacy and information technology staff and other interested parties to assure compliance with the new “privacy and security norms.”
It has come to the Commission’s attention that several boards are confronting issues related to
the security of paper records. Records held by boards can include medical records, tax records,
social security numbers and other confidential information. Boards have an obligation to
maintain the privacy and security of such records. These records must be kept in locked file
cabinets separate from other municipal records when they are not in use. Only retirement board
personnel should have access to such records. If boards do not have space to lock all records in
their offices, ideas such as securing additional office space or renting secure off-site storage
facilities should be considered. In no event should records be left in boxes in halls or on desks.
A related issue is the security of US Mail and facsimiles. Mail that is centrally sorted should be
delivered unopened to the board. Boards should also consider whether shared fax machines are
appropriate given today’s privacy and security concerns.
Computer records are another area where boards have expressed security concerns. Like paper records, computer records (including word processing documents) should also be only accessible to board personnel. For retirement boards that share computer systems with their municipality, this is a serious and potentially costly problem. Boards should make it a priority to meet with M E M O R A N D U M - Page Two TO: All Retirement Boards FROM: Joseph E. Connarton, Executive Director RE: Privacy and Security of Boards’ Records, Documents and Communications DATE: June 9, 2003
municipal information technology staff to discuss computer security arrangements. It is possible that such individuals can suggest methods to allow retirement boards to segregate retirement files from general municipal files. Boards may wish to consider requiring confidentiality agreements with municipal officials, contractors and other individuals who have access to the boards’ computer files. Also, while it may be possible to build in security procedures in shared systems, boards may want to consider investing in separate, secure computer systems.
Lastly, but importantly, is the privacy accorded to members who seek retirement counseling, whether in person or on the telephone. It is crucial that boards provide space for staff to counsel members in private. For obvious reasons, members may be uncomfortable discussing a retirement within earshot of a city or town’s human resources or workers’ compensation officials. If a separate retirement office is not available, boards may need to arrange for the use of a private conference room for such counseling. Other policies, such as requiring board staff to sign confidentiality agreements and issuing periodic reminders not to discuss personal information in public, can provide great privacy protections at minimal cost.
While the Commission recognizes that these problems are large and solutions may be expensive and difficult, the privacy and security of member information must be paramount. Providing this privacy and security is one of the fiduciary duties of board members.
Members of the Commission’s staff are available to discuss these issues and we look forward to working with boards to provide necessary protections.