Chapter 4 – Information Technology

47110.7 Confidential and Sensitive Information

• Certain types of information maintained by CDCRCalifornia Department of Corrections and Rehabilitation are confidential and protected by State and federal law. The use of e-mail to send confidential information should be limited to an as-needed basis. Never send a user identity, password, or encrypted data and the decryption key in the same e-mail.

• The following is a list of the types of information defined as HRCI that shall not be included in e-mail or attached to an e-mail, unless the e-mail and/or attachments are encrypted:

  • Personally identifiable information such as a person’s name in conjunction with the person’s social security number, credit or debit card information, individual financial account, driver’s license number, State IDInstitutions Division (see DAI) number, or passport number, or a name in conjunction with biometric information.

  • Personal health information such as any information about health status, provisions of health care, or payment for health care information as protected under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

  • Criminal Offender Record Information as defined in California Penal Code (PCPenal Code), sections 13100-13104.

  • Information that if disclosed would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency as specified in GCGovernment Code, section 6254.19. Examples include but are not limited to firewall and router configuration information, server names and IP addresses, and other system configuration details.

  • Any documentation of information which contains information or data within any Gang Database as defined in the Department Operations Manual (DOMDepartment Operations Manual), Chapter 5, Article 22, Gang Management, sections 52070.22-52070.24.

  • Records of investigations, intelligence information, or security procedures as specified in GCGovernment Code, section 6254(f); this includes but is not limited to information identifying confidential informants and security procedures contained in Restricted DOMDepartment Operations Manual.

  • Personnel, medical, or similar files, the disclosure of which would constitute an unwarranted invasion of personal privacy protected under GCGovernment Code, section 6254(c) or the Peace Officers Bill of Rights under GCGovernment Code, section 3300 et seq.

  • Encrypted e-mail must be used when HRCI information is sent to non-CDCRCalifornia Department of Corrections and Rehabilitation e-mail addresses.

• Prior to sending any e-mail, verify the accuracy of the recipient’s e-mail address to prevent unintentionally sending it to an unauthorized individual. Once an e-mail is sent outside the department, it cannot be recalled and/or undone.