Confidential Personal Information and Personal Information

Confidential personal information means personal information that is not public record for purposes of ORC § 149.43.

Personal information means any information that describes anything about a person, or that indicates actions done by or to a person, or that indicates that a person possesses certain personal characteristics, and that contains, and can be retrieved from a system by, a name, identifying number, symbol, or other identifier assigned to a person.

The Board's information owner is the Executive Director. The Executive Director determines the level of access required for an employee to fulfill their assigned job duties.

Valid reasons for authorized employees to access CPI and PI:

• Responding to a public records request
• Responding to a request from an individual for a list of information maintained on that individual
• Administering a constitutional provision or duty
• Administering a statutory provision or duty
• Administering an administrative rule provision or duty
• Complying with any state of federal program requirements
• Auditing purposes
• Licensure, renewal, reinstatement or restoration processes
• Law enforcement or investigation purposes, which may include reviewing confidential personal information of individuals who are not the subject of an investigation, but who otherwise may be witnesses with information related to or pertaining to the investigation
• Administrative hearings
• Litigation, complying with an order of the court, or subpoena
• Human resource matters
• Complying with an executive order or policy
• Complying with an agency policy or a state administrative policy
• Complying with a collective bargaining agreement provision
• Supervising the work of another employee

Applicable federal or state statutes or administrative rules that make confidential personal information confidential:

• Social security numbers: ORC § 149.43 and § 149.45 and U.S.C. 552 (a)
• Bureau of Criminal Identification and Investigation criminal records check results: ORC § 4776.04
• Medical records: ORC § 149.43 and Health Insurance Portability and Accountability Act, Title II 45 CFR 160, 42 USC 1320
• Financial and/or medical account numbers: ORC § 149.43 and § 149.45
• Law enforcement investigatory records: ORC §149.43 and § 4734.45
• Educational transcripts: Family Education Rights and Privacy Act, 34 CFR Part 99
• Records excluded by the Ohio Public Records Act: ORC § 149.43

Rights of persons who are subject to personal information.

Upon receipt of a signed written request from an individual for a list of PI about the individual (unless the information relates to an investigation about the individual in accordance with ORC § 149.42 and § 4734.45), the Board must:

• Permit the person, the person's legal guardian, or an attorney who presents a signed written authorization made by the person, to inspect all PI in the system of which the person is the subject;
• Inform the person about the types of uses made of the PI, including the identity of any users usually granted access to the system.
• If an individual who is authorized to inspect PI that is maintained in the system requests a copy of any PI that the individual is authorized to inspect, the Board must provide a copy to the individual.

Notice of invalid access

Upon discovery or notification that CPI or PI of a person has been accessed by an employee for an invalid reason, the Board shall notify each person whose information was invalidly accessed in the most expedient time possible, but not later than forty-five days following discovery or notification of the invalid access, subject to legitimate needs of law enforcement and consistent with measures necessary to determine the scope of the invalid access, including which licensees' information was accessed and acquired, and to restore the reasonable integrity of the system.

October 2, 2020

The following rules are incorporated into this policy:

4734-3-01        Personal Information Systems Definitions