Non-Criminal Justice Agency User Agreement Jami Oakland – Identification Specialist Kallie Dresbach – Identification Specialist Angela Smith – Identification Section Leader

What is the Non-Criminal Agency User Guide? Sets forth procedures and guidelines for Noncriminal Justice Agencies that access criminal history records (CHRI) through finger print submissions. It is designed to be a reference for agencies regarding the access, maintenance, dissemination and audit requirements for CHRI.

What do I have to do? Authorized Agencies must sign a user agreement which is a contractual agreement between the authorized agency and SDDCI. Agencies are responsible for complying with mandatory training requirements DCI will provide: Training and instruction of fingerprinting Finger print handling and submission for accessing CHRI CJIS Security Training

CJIS Security Training All persons directly associated with the accessing, maintaining, processing, dissemination or destruction of CHRI shall be trained. Training Must be completed within 6 months of employment CJIS Security training has a 2 year recertify for non-crim agencies Training link and password will be emailed to individuals the end of June 2017

What is CHRI? CHRI is the information collected on individuals in which they were finger printed and arrested for CHRI is both state and FBI results received from the state/federal finger print based background check CHRI does not include driver License History SDDCI is the central repository for the state of SD NOTE: FBI CHRI could contain more or less information than the SD response.

Appropriate use of CHRI CHRI may be made available for use in connection with licensing or employment Agency must have an ORI (Originating Agency Identifier) in order to request a FBI background check When CHRI is needed for a subsequent use – a new request must be submitted Local Sheriff’s offices are not permitted to run a Triple I (Interstate Identification Index) for noncriminal justice purposes.

Application Notification and Record Challenge Agencies are required to have written policies which outline the disqualifiers for employment and how long they will allow an employee for an appeal Agencies are required to provide written notification to individuals who will be denied employment based on information revealed on the background check Agencies must allow a reasonable amount of time for the individual to appeal the denial of employment.

Misuse of CHRI Exchange of records and/ or information is subject to CANCELLATION of ORI if dissemination is made to an agency or individuals that is not authorized to receive it. Misuse of CHRI is a misdemeanor or felony depending on the circumstances. Exception to this rule: School districts are the only agencies that are allowed to Disseminate CHRI to another School district. CHRI must be securely mailed directly to the school district. A Secondary Dissemination log is required.

Examples of misuse of CHRI Pierre School District conducts a state/federal background check on Jane Doe. They receive the results and Jane asks for a copy of the background check, the school District makes a copy and gives it to her. NO, the individual can not have a copy or SEE the FBI results. The results are not to be filed in the personnel file, they must be filed separately.

Another Example: Sioux Falls School District conducts a state/federal background check on John Doe, once the results are received a daycare, where John Doe works part time asks for a copy of the background check instead of conducting one for their agency. NO, School districts are allowed to share results from one school district to another school district but can not share with other agencies.

Dissemination of Criminal History Record Information With all authorized dissemination a Secondary Dissemination log shall be maintained until the onsite audit is complete and the agency receives a successful Policy Compliance Review Again, currently only schools are allowed to share CHRI between districts

Secondary Dissemination Log Should Contain: Name of Subject Date of Birth SS# (optional) Agency name – releasing record Date of release Name of Person requesting record Requesting Agency Purpose of the Record Signature of person signing for the record (Must be released to the school district, not the subject of the background check.)

Outsourcing of Noncriminal Justice Administrative Function The Outsourcing Standard permits agencies to select a private or governmental agency to perform noncriminal justice administrative functions on behalf of the agency. Shredding IT Support Data Storage The NCJA must provide SDDCI written permission to outsource and SDDCI will notify the agency whether the outsourced vendor is approved or denied.

Examples of Outsourcing Aberdeen school district has shredding, which includes personnel files and state/FBI background checks, they contract with a local shredding company to shred once a month. The School district would have to provide SDDCI with written permission to outsource with this agency. SDDCI will contact the company and review their security policies and will either approve or deny the outsourcing agency

Example Spearfish school district does not have IT personnel within their school district, therefore they contract with a local IT computer support/repair shop. The school district would provide, in writing, a request to use the local computer shop to maintain their computers etc. SDDCI would contact the agency and inquire about their firewalls, encryption and security training policies. At that time SDDCI would either deny or approve the outsourcing agency.

IT Security and Responsibilities of CHRI If you are storing records electronically Scanning CHRI into a file Please have your IT Staff Contact Jami Oakland at SDDCI and we will go over the IT requirements Keeping a checklist electronically A list that states State – FBI background check sent/ received You can not use the word of phrase “FBI background check” You can not email CHRI You can not fax CHRI You can not make copies of CHRI

Non-Criminal Justice Agency User Agreement Page 17 Fill out the following Agency Name Agency Mailing and Physical Address City, State, and Zip Point of Contact (Can be whomever you chose to be the contact person) Telephone and Fax number (of the contact person) Email address (of the contact person)

Page 18 Page 20 Provide description of Purpose You would enter why you submit state/FBI fingerprints to DCI Enter Law(s) requiring or allowing you this function Enter your agency ORI Page 20 Signature of Agency Representative Date Print or type name

Page 21 Non-Criminal Agency Coordinator (NAC) This individual will be the liaison between your agency and SDDCI. Will be the contact person when SDDCI sends out Audit information Will be the contact person when an onsite Audit is scheduled Will be responsible for notifying SDDCI when a new employee start or an employee leaves so SDDCI can keep our CJIS Security training records current. The NAC can be whomever you chose

Required information to complete the appointed NAC form Agency Name Agency ORI Agency mailing and physical address Work number (NAC’s) Fax number (NAC’s) Email address of the Agency Director Has this person received CJIS Security training? The answer will be no

Page 22 Local Agency Security Officer The LASO can be whomever you want to actively represent your agency in all matters pertaining to information security, to disseminate information security alerts and other material within your agency. The LASO must contact SDDCI when misuse of CHRI has been committed Use form on page 41 The LASO can contact SDDCI with specific questions and concerns

CJIS Security Training Please provide the following for individuals that have access to CHRI Name Physical and mailing address Email Address Telephone number Once this information is received the CJIS security training email with log in and password will be emailed to the individuals.

Once the individual has completed the CJIS online training and has taken the test please have them complete the following: User Rules of Behavior Acknowledgement form (pages 34-35) Disciplinary Policy (pages 36-39) Acknowledgment Statement of Misuse (page 40) You may need to make additional copies to accommodate your staff Also, please remember to keep a copy for your records

Audit Prep A notification letter along with a questionnaire will be mailed approx. 45 -60 days before the on-site audit. The Agency should review, complete and return the questionnaire to SDDCI in a timely manner. It is important for the agency to note any specific areas that the agency wishes to address during the on-site audit. Once the audit is reviewed by SDDCI the POC will be contacted to schedule an on-site audit.

Agency Administrative Interview (On-Site Visit) Topics to discuss during the on-site audit Use of criminal history Legal Authority Finger print submission information Dissemination of CHRI Outsourcing User Agreement Security Physical security Personnel (who has access to CHRI) Maintenance of criminal history record information Destruction process of CHRI

Agency Criminal History Record Review SDDCI Auditor will predetermine a random number of CHRI received by an agency The Auditor will document each discrepancy found during the on-site audit. Examples: Unauthorized – CHRI should not have been requested or received Unsecured – CHRI filed or maintained in a non-secure location Undocumented – Dissemination log and/or waiver is missing

Agency Exit Briefing The purpose of the exit briefing Is to present a summary of findings Overview of the general findings Should not be considered the official outcome The official findings and recommendations will be mailed to the agency LASO and NAC within 30 days of the on-site audit If the agency has failed compliance standards A follow up audit will be conducted 30 to 90 days of initial audit The follow up audit will include a new sampling of records

Audit Survey Form Along with the final report the agency will receive an Audit survey form. The survey provides the agency the opportunity to rate the audit process Our Goal of the survey Obtain information and/or opinions about the process Communication between the agency and SDDCI Identify areas in the audit process that needs improvement

Thank you!