Ohio Admin. Code 3354:1-43-05 - Personal information system policy

(A) The college operates one or more personal information systems regulated by section chapter 1347. of the Revised Code. The executive vice president of Administration is directly responsible for the system. For the purposes of this policy:

(1) "Personal information" means any information that describes anything about a person, or that indicates actions done by or to a person, or that indicates that a person possesses certain personal characteristics, and that contains, and can be retrieved from a system by a name, identifying number, symbol, or other identifier assigned to a person.

(2) "System" means any group of related records maintained by the college and from which personal information can be retrieved by the name of the person or by some identifying number, symbol, or other identifier assigned to the person. System includes records that are manually stored and those stored through the use of electronic data processing equipment.

(B) The college will inform, in writing, all employees responsible for the operation or maintenance of the system or for the use of personal information in a system of the existence of section chapter 1347. of the Revised Code and of this policy.

(C) An individual who initiates or contributes to any disciplinary or other punitive action against another individual who brought to the attention of appropriate authorities, the press, or any member of the public, evidence of unauthorized use of information contained in a personal information system will be subject to disciplinary action pursuant to the college's corrective action procedure.

(D) Any individual who is asked to supply personal information for a college system will be informed, in writing, whether or not the individual is legally required to supply the information or that the individual may refuse to supply the information.

(E) The accuracy, relevance, timeliness and completeness of personal information in a system will be monitored and maintained.

(F) The college shall take reasonable precautions to protect personal information in a system from unauthorized modification, destruction, use, or disclosure.

(G) The college will periodically review its personal information systems and eliminate personal information that is no longer necessary and relevant, pursuant to applicable record retention schedules.

(H) Upon request from and proper identification of an individual who is the subject of personal information in a system, the college shall:

(1) Inform the person of the existence of any personal information in the system of which the person is the subject.

(2) Permit the person or his legal guardian or an attorney who presents a signed written authorization made by the person to inspect all personal information in the system of which the person is the subject.

(3) Inform the individual about the types of uses made of the personal information including the identity of any users usually granted access to the system.

(4) Disclose upon request, medical, psychiatric, or psychological information to a person who is the subject of the information or to his legal guardian, unless a physician, psychiatrist, or psychologist determines for the college that the disclosure is likely to have an adverse effect on the person, in which case the information shall be released to a physician, psychiatrist, or psychologist who is designated by the person or by his legal guardian.

(5) Provide copies of personal information to the person upon request. Charge a fee of twenty-five cents per page for copies of personal information.

(I) Disputes concerning information in system

(1) An individual may request, in writing, that the college investigate the status of personal information in a system that the individual believes is not accurate, relevant, timely, or complete.

(2) The college shall investigate the matter within a reasonable time but no later than ninety calendar days after the request has been made to determine if the information is accurate, relevant, timely and complete.

(3) The college shall notify the individual, in writing, of the results of the investigation and of the intended action of the college. The college shall delete any personal information that it cannot verify or that it finds to be inaccurate.

(4) If the individual is not satisfied with the college decision, the college may do either of the following:

(a) Permit the individual to include within the system, a brief statement of the individual's position on the disputed information. The college shall maintain a copy of the individual's statement in the individual's personnel or student file. The college may limit the statement to not more than one hundred words if the college assists the individual to write a clear summary of the dispute.

(b) The college shall include the statement in any subsequent transfer, report, or dissemination of the disputed information and may include with the statement of the individual a statement by the college that it has reasonable grounds to believe that the dispute is frivolous or irrelevant, and of the reasons for its belief

(c) The college shall, at the written request of the individual, furnish notification that the disputed information has been deleted, or furnish a copy of the individual's statement of the dispute, to any person specifically designated by the individual. (The college shall clearly and conspicuously disclose to the individual the individual's right to make such a request.)

(J) The college shall comply with all applicable provisions of section chapter 1347. of the Revised Code, whether or not explicitly set forth in this policy.

(K) The president or the president's designee is hereby directed to take all steps necessary and appropriate for the implementation of this policy.

Effective date: December 15, 2005

Replaces: 3354:1-43-05

Notes

Ohio Admin. Code 3354:1-43-05

Effective: 12/15/2005
Promulgated Under: 111.15
Statutory Authority: 3354.09
Rule Amplifies: 3354.09
Prior Effective Dates: 12-15-05