Access to Criminal History Record Information by Non-criminal Justice Agencies

DCJIS may grant non-criminal justice agencies access to Criminal History Record Information (CHRI) in accordance with state and federal laws and regulations. (2) In order to access CHRI in accordance with applicable law, the non-criminal justice agency head shall be responsible for the following: (a) executing a Non-criminal Justice Agency User Agreement with DCJIS; (b) submitting requests for, reviewing, and disseminating CHRI results only as authorized by law; (c) executing and providing DCJIS with an employee designation form for each employee with direct access to the DCJIS system used to obtain CHRI; (d) ensuring that all employees with direct access to the DCJIS system used to obtain CHRI have been fingerprinted and have had a complete background investigation in accordance with the latest version of the CSP; (e) designating a local agency security officer (LASO); (f) ensuring that all employees with access to CHRI have completed an Individual Agreement of Non-disclosure (AOND) form; (g) ensuring that all employees with access to CHRI have completed training; (h) responding to audit questionnaires, complaints, and any other inquiries from DCJIS or from the FBI within the time period specified by DCJIS or the FBI; (i) reporting to DCJIS as soon as possible any misuse of CHRI or CJIS, including improper access to or improper dissemination CHRI or other information contained within or obtained through CJIS; (j) providing to DCJIS or the FBI the results of any investigation into the misuse of CHRI or CJIS or any system or source to which DCJIS provides access; (k) ensuring that the agency adheres to all DCJIS and FBI policies and procedures, including the CSP; (l) notifying DCJIS as soon as practicable of any changes in contact information for the agency, including the agency head, local agency security officer, and any employees authorized to access DCJIS systems; and (m) ensuring compliance with all state and federal laws, regulations, and policies related to CHRI, CJIS, and/or any other system or source to which DCJIS provides access. (3) The local agency security officer shall be responsible for the following: (a) completing the fingerprint-based criminal history background investigation, training, and AOND form; (b) submitting requests for, reviewing, and disseminating CHRI results only as authorized by law; (c) ensuring compliance with security procedures related to CHRI and DCJIS systems; (d) coordinating and reporting all personnel security clearance requests and any subsequent criminal history activity relating to an approved employee to the DCJIS CJIS Systems Officer (CSO) within five business days; (e) notifying the DCJIS Information Security Officer (ISO) of any and all security incidents within 48 hours of the discovery of the incident. (f) responding to audit questionnaires, complaints, and any other inquiries from DCJIS or from the FBI within the time period specified by DCJIS or the FBI ; (g) reporting to DCJIS as soon as possible any misuse of CHRI or CJIS, including improper access to or improper dissemination CHRI or other information contained within or obtained through CJIS; (h) providing to DCJIS or the FBI the results of any investigations into the misuse of CHRI or CJIS or any system or source to which DCJIS provides access; (i) ensuring that the agency adheres to all DCJIS and FBI policies and procedures, including the CSP; (j) notifying DCJIS as soon as practicable of any changes in contact information for the agency, including the agency head, local agency security officer, and any employees authorized to access DCJIS systems; (k) keeping user codes and passwords used to access CHRI confidential; and (l) ensuring compliance with all state and federal laws, regulations, and policies related to CHRI, CJIS, and/or any other system or source to which DCJIS provides access. Employees and other personnel designated by their agency head to access CHRI shall be responsible for the following: (a) completing the fingerprint-based criminal background investigation (employees with direct access to DCJIS systems and CHRI only); (b) completing the AOND form and training requirements; (c) submitting requests for, reviewing, and disseminating CHRI results only as authorized by law; (d) reporting any of their own subsequent criminal history to the LASO within five days; (e) reporting to the LASO as soon as possible any misuse of CHRI or CJIS, including improper access to or improper dissemination CHRI or other information contained within or obtained through CJIS; (f) keeping user codes and passwords used to access CHRI confidential; (g) notifying DCJIS as soon as practicable of any changes in contact information; and (h) ensuring compliance with all state and federal laws, regulations, and policies related to CHRI, CJIS, and/or any other system or source to which DCJIS provides access. CHRI shall not be disseminated except in accordance with the law that provides the non-criminal justice agency with access to CHRI. Whenever CHRI is disseminated, the non-criminal justice agency shall record it in a secondary dissemination log that it shall maintain. The log will record the following information for each dissemination: (a) the subject's name; (b) the subject's date of birth; (c) the date and time of dissemination; (d) the name of the person to whom the CHRI was disseminated along with the name of the organization for which the person works; and (e) the specific reason for dissemination. Each entry in the secondary dissemination log will be maintained for a minimum of one year. (7) Non-criminal justice agencies that make an adverse decision against an individual, which decision is based in any part on the individual's CHRI, shall first provide the individual with information on how to change, correct, or update the individual's criminal records in accordance with 28 CFR § 16.34. (8) Paper copies of CHRI shall be stored in locked file cabinets and shall not be left unattended. Electronic copies of CHRI shall be stored in accordance with the provisions of the latest version of the CSP. CHRI shall only be disposed of in a secure manner. Physical media shall be cross-shredded and/or burned, and electronic records shall be deleted and repeatedly over-written with random 0s and 1s, or the media shall be degaussed.