Idaho Admin. Code r. 09.01.08.013

Current through September 2, 2024

Section 09.01.08.013 - DISCLOSURE TO THIRD PARTIES WITH WRITTEN, INFORMED CONSENT

A person may agree, through written, informed consent, to allow a third party to obtain employment security information pertaining to the person from the Department, subject to the following terms and conditions:

01.Informed Consent Release.

a. An informed consent release must be signed by the person providing informed consent and dated within one (1) year of the date of the request for access to the records.

b. In the document, the person providing informed consent must:

i. Identify the specific records to be disclosed;

ii. Acknowledge Department files will be accessed to obtain the records;

iii. List all third parties authorized to access the person's information; and

iv. Indicate specific purpose(s) of the disclosure and state the records will be used only for the specified purpose(s). If the disclosure is not for purposes of the Employment Security Law, the purpose(s) specified must provide a service or benefit to the person providing informed consent or to administer or evaluate a public program to which informed consent release pertains.

c. Unless disclosure is for the purposes of the Employment Security Law, the Department will not comply with disclosure requests to a third party on an ongoing basis. Only existing records in the Department's custody as of the date of receipt of the request will be disclosed pursuant to the informed consent release, not records that may be created in the future.

02.Agreement by Third Party. Before the Department will disclose employment security information to a third party pursuant to an informed consent release, the third party must sign an agreement containing the following provisions:

a. A description of the specific information to be furnished by the Department and the purpose(s) for which the information is sought and will be used, as specified in the informed consent release;

b. A statement that those who request or receive information under the agreement will be limited to those individuals, identified by name, with a need to access it for the purpose(s) specified in the informed consent release;

c. The method for the disclosure, including format;

d. Provisions for payment of the Department's costs of disclosure as required by Subsection 020.02 of these rules, including the Department's costs of performing audits to ensure compliance with State and Federal law and the requirements of the agreement;

e. Provisions for safeguarding the information disclosed, including the following requirements:

i. Recipient will use the information only for purposes authorized by law and specified in the informed consent release;

ii. Recipient will store the information in a place physically secure from access by unauthorized persons;

iii. Recipient will store and process the information maintained in electronic format in such a way unauthorized persons cannot obtain the information by any means;

iv. Recipient will undertake precautions to ensure only authorized personnel have access to the information stored in computer systems;

v. Recipient will instruct and have all personnel with access to the information sign an acknowledgment that they will adhere to the agreement's confidentiality requirements; understand the civil and criminal penalties in Sections 72-1372 and 72-1374, Idaho Code for unauthorized disclosure of information; and will fully and promptly report to the Department any breach of the confidentiality requirements.

vi. Except for any information possessed by any court, Recipient will dispose of the information and any copies made by the requesting agency or its agent or contractor after the purpose of the disclosure has been served, and will not retain the information with personal identifiers for any longer period of time than the Department deems appropriate; and

vii. Recipient will redisclose the information only as authorized under informed consent release and for purpose(s) specified in the release or as required by State or Federal law.

f. Provisions for on-site audits of the recipient by the Department as the Department may deem necessary to ensure compliance with State and Federal law and agreement requirements;

g. Provisions for the immediate suspension of the agreement if the Department determines that the recipient is not adhering to the requirements of the agreement;

h. Provisions for termination of the agreement if, after a breach of the agreement prompt and satisfactory corrective action is not taken, and for immediate surrender to the Department of all employment security information, including copies in any form, obtained under the agreement by the recipient;

i. Acknowledgment by recipient the agreement is governed by the laws of the State of Idaho, and civil and criminal penalties in Sections 72-1372 and 72-1374, Idaho Code, apply to any unauthorized disclosure of information no matter where the unauthorized disclosure may occur; and

j. Provisions for the Department to take any remedial action permitted under State or Federal law to enforce the agreement, including seeking damages, penalties, restitution, and attorneys fees and costs incurred by the Department for any breaches of the agreement and required enforcement.

03.Department's Right to Audit. After a third party receives employment security information pursuant to an informed consent release, the Department may perform an on-site audit of the third party to ensure the information is used for authorized purposes only.

Idaho Admin. Code r. 09.01.08.013

Effective March 23, 2022