|
Outsourcing Review of Criminal History Records Document provided by the The National
Crime Prevention and Privacy Compact (Compact) establishes standards and
processes for exchanging criminal history records among states and between states
and the FBI for non-criminal justice purposes
such as licensing or employment.
Article VI of the Compact provides for a Compact Council with the
authority to announce rules and procedures that control use of the Interstate
Identification Index (III) system for non-criminal justice purposes. The III is the system of federal and state
criminal history records maintained by the Federal Bureau of Investigation
(FBI). The Compact
Council published a Final Rule in the Federal Register (the official daily
publication for rules, proposed rules, and notices of Federal agencies and
organizations, as well as executive orders and other presidential documents) regarding
a Security and Management Control Outsourcing Standard, which became effective December 15, 2005. The goal of the Outsourcing Standard is to
permit the outsourcing (delegation of non-core operations
from internal production to an external entity specializing in the management
of that operation) of non-criminal justice functions related to processing
criminal history record information from III. The Outsourcing Standard permits a governmental agency or
other authorized recipient of criminal history record information to select a
private or governmental agency to perform these non-criminal justice
administrative functions on behalf of the governmental or authorized agency,
subject to appropriate controls. The Outsourcing
Standard establishes minimum standards to ensure that security and privacy
requirements are satisfied when conducting FBI criminal history records
checks for non-criminal justice purposes. The contracting parties may not reduce these
minimum standards; however, they may adopt stricter standards than required
by this Standard. To ensure
agencies follow these minimum standards, the Outsourcing Standard provides
that contracts and agreements authorized by this Rule “shall incorporate by
reference a Security and Management Control Outsourcing Standard approved by
the Compact Council after consultation with the United States Attorney
General”. This document is for
contractors having access to criminal history record information on behalf of
an authorized recipient for non-criminal justice purposes as well as
contractors that only pass, or channel, non-criminal justice criminal history
record check requests and results between the authorized recipient and the
FBI. Additionally,
the Outsourcing Standard identifies duties and responsibilities for adequate
security controls between the authorized recipient and the contractor in
order to maintain the security, accuracy and reliability of the III system
and criminal history record information.
The standard security program will consider physical site security,
restrictions on dissemination of criminal history record information,
personnel security, system security and data security. Use of Outsourcing Standard by Prior to
outsourcing any non-criminal justice administrative functions, the
governmental authorized recipient must: 1) provide the State Compact Officer
copies of the specific authority for the outsourced work, criminal history
record check requirements, and/or a copy of the contract as requested; and, 2) request and receive written permission to
outsource the function. The authorized
recipient shall sign a contract or agreement prior to providing a contractor
access to criminal history record information. The governmental authorized recipient shall: 1) specify the terms and conditions
of such access; 2) limit use of such information to
the purposes for which it is provided;
3) limit retention of the information;
4) prohibit dissemination of the
information except as specifically authorized by federal and state laws,
regulations and standards as well as rules, procedures and standards
established by the Compact Council and the United States Attorney General; 5) ensure the security and confidentiality
of the information; 6) provide for audits and sanctions;
provide conditions for termination of the contract; 7) maintain up-to-date records of contractor
personnel who have access to criminal history record information; and, ensure
that contractor personnel comply with the Outsourcing Standard. For more
information on the Outsourcing Standard, please contact the State Compact
Officer at the following address. Paul C.
Heppner Deputy Director |