10 IAC 5 — ARTICLE 5. RELEASE OF SOCIAL SECURITY NUMBERS BY STATE AGENCIES

TITLE 10 OFFICE OF ATTORNEY GENERAL FOR THE STATE

ARTICLE 5. RELEASE OF SOCIAL SECURITY NUMBERS BY STATE AGENCIES

Rule 1

10 IAC 5-1-1 10 IAC 5-1-1 Authority

Rule 1. Authority and Applicability

10 IAC 5-1-1 Authority

Authority: IC 4-1-10-13

Affected: IC 4-1-10

Sec. 1. This article is adopted under the authority granted to the attorney general by the release of Social Security number act (IC 4-1-10-13).

(Office of Attorney General for the State; 10 IAC 5-1-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA; readopted filed Aug 8, 2012, 11:11 a.m.: 20120905-IR-010120294RFA; readopted filed Nov 21, 2018, 2:02 p.m.: 20181219-IR-010180318RFA; readopted filed Oct 9, 2024, 2:38 p.m.: 20241106-IR-010230771RFA)

10 IAC 5-1-2 10 IAC 5-1-2 Applicability

10 IAC 5-1-2 Applicability

Authority: IC 4-1-10-13

Affected: IC 4-1-10

Sec. 2. The definitions in IC 4-1-10 and 10 IAC 5-2 apply throughout this article.

(Office of Attorney General for the State; 10 IAC 5-1-2; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA; readopted filed Aug 8, 2012, 11:11 a.m.: 20120905-IR-010120294RFA; readopted filed Nov 21, 2018, 2:02 p.m.: 20181219-IR-010180318RFA; readopted filed Oct 9, 2024, 2:38 p.m.: 20241106-IR-010230771RFA)

10 IAC 5-1-3 10 IAC 5-1-3 Effective date

10 IAC 5-1-3 Effective date

Authority: IC 4-1-10-13

Affected: IC 4-1-10-1

Sec. 3. The effective date of this article is July 1, 2006.

(Office of Attorney General for the State; 10 IAC 5-1-3; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA; readopted filed Aug 8, 2012, 11:11 a.m.: 20120905-IR-010120294RFA; readopted filed Nov 21, 2018, 2:02 p.m.: 20181219-IR-010180318RFA; readopted filed Oct 9, 2024, 2:38 p.m.: 20241106-IR-010230771RFA)

Rule 2

10 IAC 5-2-1 10 IAC 5-2-1 "Express consent" defined

Rule 2. Definitions

10 IAC 5-2-1 "Express consent" defined

Authority: IC 4-1-10-13

Affected: IC 4-1-10-5

Sec. 1. "Express consent" means a specific grant of authority made by an individual allowing a state agency to disclose that individual's Social Security number. The grant of authority shall:

(1) not be given:

(A) pursuant to or as a condition of a state agency's services that would otherwise be available to the individual; or

(B) by any person other than the individual to whom the Social Security number has been assigned by the Social Security Administration; and

(2) be:

(A) given in writing;

(B) signed by the individual; and

(C) dated in a legible form as determined by the state agency.

(Office of Attorney General for the State; 10 IAC 5-2-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA; readopted filed Aug 8, 2012, 11:11 a.m.: 20120905-IR-010120294RFA; readopted filed Nov 21, 2018, 2:02 p.m.: 20181219-IR-010180318RFA; readopted filed Oct 9, 2024, 2:38 p.m.: 20241106-IR-010230771RFA)

10 IAC 5-2-2 10 IAC 5-2-2 "State law enforcement agency" defined

10 IAC 5-2-2 "State law enforcement agency" defined

Authority: IC 4-1-10-13

Affected: IC 4-1-10-4

Sec. 2. "State law enforcement agency" includes the following entities or persons:

(1) The state police department.

(2) The office of attorney general for the state.

(3) The office of the inspector general.

(4) Prosecutors and their deputies.

(5) Other state agencies or entities that conduct investigations relating to the enforcement of state law.

(Office of Attorney General for the State; 10 IAC 5-2-2; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA; readopted filed Aug 8, 2012, 11:11 a.m.: 20120905-IR-010120294RFA; readopted filed Nov 21, 2018, 2:02 p.m.: 20181219-IR-010180318RFA; readopted filed Oct 9, 2024, 2:38 p.m.: 20241106-IR-010230771RFA)

Rule 3

10 IAC 5-3-1 10 IAC 5-3-1 Mitigating factors

Rule 3. Attorney General's Discretion

10 IAC 5-3-1 Mitigating factors

Authority: IC 4-1-10-13

Affected: IC 4-1-10; IC 4-1-11

Sec. 1. The attorney general may, in his or her discretion, determine that the release of Social Security numbers was a negligent act and not a knowing, intentional, or reckless act if a state agency or employee establishes that the following provisions, singly or in combination, have been met:

(1) The release of the Social Security numbers is immediately stopped.

(2) Any individuals whose Social Security numbers are disclosed are immediately notified in a timely manner.

(3) The release of the Social Security numbers was as follows:

(A) Unintended.

(B) De minimis and nonsystematic.

(4) The handling of the Social Security numbers was conducted pursuant to a contractual relationship, and the contract contained a clause requiring the state agency and the contractor to comply with the following:

(A) The release of Social Security number provisions set forth in IC 4-1-10.

(B) The notice of security breach provisions set forth in IC 4-1-11.

(5) The state agency had established reasonable policies and procedures designed to prevent the unauthorized disclosure of individual Social Security numbers.

(6) Corrective measures are initiated to prevent future disclosures under similar circumstances.

(7) Other relevant circumstances as determined by the attorney general.

(Office of Attorney General for the State; 10 IAC 5-3-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA; readopted filed Aug 8, 2012, 11:11 a.m.: 20120905-IR-010120294RFA; readopted filed Nov 21, 2018, 2:02 p.m.: 20181219-IR-010180318RFA; readopted filed Oct 9, 2024, 2:38 p.m.: 20241106-IR-010230771RFA)

Rule 4

10 IAC 5-4-1 10 IAC 5-4-1 Notification to the attorney general

Rule 4. Notice Requirements

10 IAC 5-4-1 Notification to the attorney general

Authority: IC 4-1-10-13

Affected: IC 4-1-10

Sec. 1. When a state agency becomes aware of a release of Social Security numbers or other personal identifying information, the state agency or employee shall, within two (2) business days of the disclosure, notify the office of attorney general for the state in writing of the following:

(1) The nature of any release of Social Security numbers or other personal identifying information.

(2) The steps taken by the agency or employee to do the following:

(A) Stop the current release.

(B) Notify the individuals affected.

(C) Prevent future releases.

(Office of Attorney General for the State; 10 IAC 5-4-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA; errata filed Aug 25, 2006, 1:00 p.m.: 20060906-IR-010050319ACA; readopted filed Aug 8, 2012, 11:11 a.m.: 20120905-IR-010120294RFA; readopted filed Nov 21, 2018, 2:02 p.m.: 20181219-IR-010180318RFA; readopted filed Oct 9, 2024, 2:38 p.m.: 20241106-IR-010230771RFA)