2016 Compliance Training

Transcription

1 2016 Compliance Training EMERGENCY EXITS ELECTRONIC DEVICES ATTESTATION SHEETS ONLINE TRAINING DEADLINE TOPICS

2 Office of Audit, Compliance & Ethics University Code of Conduct and the Importance of Individual Behaviors

3 Code of Conduct "reflects the covenant that an organization has made to uphold its most important values, dealing with such matters as its commitment to employees, its standards for doing business and its relationship with the community." Driscoll, Dawn-Marie and W. Michael Hoffman, Ethics Matters: How to Implement Values-Driven Management, 2000, p. 77.

4 Purpose of the Code of Conduct Sets basic standards of workplace behavior States publicly the University s long-term commitment to the highest standards of integrity Assures that faculty, administrators and staff understand their shared responsibility for keeping the University in compliance

5 Standards Education Research Patient Care Campus-wide Business, Fiscal and Legal External Relations and University Advancement

6 Individual Behaviors Consult the Code of Conduct Seek guidance from appropriate individuals or offices Individual Responsibility Institutional Success Violations may result in appropriate disciplinary measures

7 Reportline If you wish to report a concern or a suspected violation anonymously you may contact the University s REPORTLINE Available 24 hours a day, 7 days a week Independent specialists trained to obtain complete and accurate information in a confidential manner Phone: Web reporting address:

8 University policy prohibits retaliation if you report in good faith a compliance concern to any supervisor, faculty, administrator, the Compliance Office, the REPORTLINE or any appropriate agency outside of the University Non-Retaliation

9 Office of Audit, Compliance & Ethics University Guide to the State Code of Ethics

10 State Code of Ethics for Public Officials Part of the Connecticut General Statutes Intended to prevent individuals from using their public position or authority for personal financial benefit University s policy is based upon the State Code

11 University Guide to the State Code of Ethics A conflict of interest (COI) occurs when an individual s personal interests diverge from his/her obligations as a state employee COI may take many forms including: Gifts Outside Employment Financial Benefit Contracts with the State Appearance fees

12 Gifts University employees generally may not accept gifts, discounts or gratuities from prohibited donors Anyone doing or seeking to do business with the University Anyone engaged in activities directly regulated by the University A lobbyist (current list can be found on the Office of State Ethics website) A contractor pre-qualified by Department of Administrative Services (DAS)

13 Gifts Gift exceptions: Items offered to the public at large Items valued at less than $10 with annual total equaling less than $50 Food and beverage less than $50 total in a calendar year from each donor and only if the person paying is in attendance Gifts valued at less than $100 from a supervisor or subordinate Major life events Gifts to the state

14 Outside Employment University employees may not: Use their state position to obtain another job Use state resources for their outside employment Compromise independent judgment Disclose confidential information from state service Benefit the private employer in any way through their official actions

15 Employees may not: Promote Advertise Outside Employment Solicit personal business through use of state resources

16 Faculty Consulting Faculty & AAUP Members State Ethics Exemption: Activity cannot be related to state employment Activity is related to expertise Must receive compensation (except royalties) o If compensation is only coverage of travel expenses and the faculty member will not net any compensation a consulting form is not needed. Instead, a necessary expenses form (and possibly a travel request) are required.

17 Appearance Fees May not accept fees/honorarium for appearances, speeches or articles written in an official state capacity Applies if state position was a significant factor in being asked Necessary expenses may only be accepted for items for which the University would otherwise pay

18 Necessary Expenses Reporting Reported directly to the Office of State Ethics within 30 days of receiving payment or reimbursement

19 Contracts with the State Unless an open and public process has been completed: Employees and their family members or business associates may not enter into a contract (valued at $100 or more) with the state

20 Political Activity Employees are not prohibited from seeking political office as long as it is not done on State time or with State equipment No employee of the University will engage in partisan political activities while on state time No employee will use state materials or equipment for the purpose of influencing a political election

21 Post-State Employment You may never use confidential information for financial gain You may not represent anyone concerning any matter in which you personally and substantially participated while in state service You may not, for one year, represent anyone before your former agency for compensation If you participated substantially in the negotiation or award of a state contract valued at $50,000 or more, you may not accept employment with a party to the contract for one year after leaving state service, if you resign within one year after the contract was signed

22 Office of Audit, Compliance & Ethics Information UConn

23 What is Privacy? Right to be left alone? Right to make decisions about your personal information? Right to have others who hold or use your data to keep it confidential?

24 What are the Rules? Privacy Rules (laws, regulations) are based on internationally recognized Fair Information Privacy Principles (FIPPS)

25 Difference Between Privacy & (Data) Security Lots of philosophical discussions about the difference Practically speaking at UConn, it comes down to this: Privacy is the WHAT: Privacy dictates what information we need to protect Security is the HOW: Security is the measures we take to go about protecting that information

26 The WHAT What is considered private?

27 What Information is Considered private or confidential at UConn? Confidential Data: requires highest level of privacy protection by law (e.g., student data, medical data, financial data) or through contract (e.g., non-disclosure agreements) Protected Data: must be protected, but can be released through appropriate University procedures (most University data falls in this category) Public Data: considered public and widely available to all users usually through websites, brochures or mailings

28 The HOW How do we secure what we consider to be private?

29 Information Security Policies and Protocols Available at Check out resources available through the Information Security Office (ISO) at Additional guidance is available at

30 Information Management: Combining the What & the How

31 What is a Record? recorded data or information relating to the conduct of the [University s] business prepared, owned, used, received or retained by [the University] whether such data or information be handwritten, typed, taperecorded, printed, photo-stated, photographed or recorded by any other method.

32 Records & Information Management (RIM) Lifecycle of a record Creation Records Retention Proper Storage Maintenance Privacy Information Security Destruction

33 RIM Steps 1. Inventory 2. Records Review 3. Clean up and clear out! 4. Privacy & Security review (paper & electronic) 5. Rinse & Repeat

34 When things go wrong: What happens when the WHAT or the HOW are compromised?

35

36 Repercussions for Inadequate Information Management Costs of the clean up Reputational harm Employment actions (for violations of law/university policy) Regulatory enforcement/litigation

37 My Role: Understanding the What and the How

38 Information Management & Me 1. Know what your responsibilities are What are my job duties? Am I a data custodian? For WHAT records? (And WHAT are their data classifications (public, protected, private)? Know the HOW for the records you have access to as part of your job (what level of security is required/best practice?) Understand the difference between what you CAN access and what you SHOULD access

39 Information Management & Me 2. Inventory your records Know what records you are responsible for Know where you are storing your records Have a game plan for how long you/your office will retain records Know where to get more info about RIM & Records Retention requirements at UConn:

40 Information Management & Me 3. Know what records you are permitted to access as part of your job duties Only access what you are permitted to and when you are permitted to Refer/defer to appropriate offices/records custodians when it is not your role to access the info or to answer questions about the info

41 Information Management & Me 4. Even if your access to a record is appropriate, know to whom and under what circumstances you can share information (both inside & outside the University)

42 Information Management & Me 5. Keep control of University devices and data storage locations Inventory Control tagging devices Physical Security use strong passwords, don t share passwords, lock or log out of computers, encrypt sensitive files, lock doors to storage areas where records or devices are housed, know who has access to spaces where data is stored

43 Information Management & Me 6. DO NOT keep copies of records you do not need for a business purpose Whenever possible do not store records locally Maintain records in source systems Protect any records that do need to be stored

44 Information Management & Me 7. DO store sensitive University information securely Ensure paper records are physically secured Ensure electronic records are stored on professionally maintained and encrypted computers Work with UITS to identify secure storage locations

45 Information Management & Me 8. DO transmit sensitive University data securely is not a secure transmission method FileLocker is a secure file transfer tool Do not assume recipient is secure, be particularly vigilant if sending outside of the University

46 Information Management & Me 9. Know who and what to report when things go wrong Suspect a compromised WHAT or HOW? Follow the University s Protocols: i. Report missing devices ii. Report compromised devices, systems iii. Report missing paper or compromised to physical security iv. Security Incident Protocol (activate the Security Incident Team ) v. Report suspected Identity Theft ( Red Flags )

47 Information Management & Me 10. Know where to seek help Contact the University Privacy Officer: Rachel Krinsky Rudnick (860) Contact the Information Security Office: Jason Pufahl (860)

48 Office of Audit, Compliance & Ethics Various Topics

49 Reporting Requirements under the NEW Policy Against Discrimination, Harassment and Related Interpersonal Violence

50 Sexual Violence, Intimate Partner Violence, Stalking Criminal Acts Violations of University Policy

51 Reporting Obligations - Sexual Assault, Intimate Partner Violence And Stalking WHEN & TO WHOM YOU MUST REPORT If you witness any sexual assault, intimate partner violence, stalking, first call 911, then report to ODE as soon as possible If you receive a report of a sexual assault, intimate partner violence or stalking, you must report this information as soon as possible to: The Office of Diversity and Equity ( ) YOUR REPORT SHOULD INCLUDE: Date, time and location of the incident Details known to you regarding the incident Date the incident was reported to you Identity of the victim and perpetrator (if disclosed) Your identity and contact information

52 Protection of Minors

53 Child Abuse and Neglect Reporting All University Employees are Mandated Reporters Child abuse occurs when a child under the age of 18 has had physical injury inflicted upon him or her other than by accidental means, has injuries at variance with history given of them, or is in a condition resulting in maltreatment, such as, but not limited to, malnutrition, sexual molestation or exploitation, deprivation of necessities, emotional maltreatment or cruel punishment Child neglect occurs when a child under the age of 18 has been abandoned, is being denied proper care and attention physically, emotionally, or morally, or is being permitted to live under conditions, circumstances or associations injurious to his well-being

54 Child Abuse and Neglect Reporting For further guidance: The Department of Children and Families 24 hour hotline REMINDER: Any employee who has witnessed or received a report of a sexual assault must comply with the University policy by reporting to ODE, regardless of the age of the victim. Many employees also have a duty to call the UConn Police

55 Best Practices: Examples of Standards of Conduct for those working with Minors Background Checks Criminal background checks of all those involved in the program or activity Appropriate Communication Prohibition concerning engaging minors via telephone, internet, or social media unless justified by the program or activity Consent / Waivers Written consent of parent or legal guardian before permitting minor to engage in overnight activities Training Training for all those involved in the program or activity Pick-up / Drop-off Procedures for the pick-up and dropoff of program participants Privacy / Boundaries Procedures for areas where minors are likely to be showering, bathing, sleeping or dressing Supervision Procedures to ensure adequate levels of supervision at all times and that no minor be left alone with less than 2 authorized adults Transportation Procedures to ensure that minors are not transported in the personal vehicles of authorized adults unless required by program or activity and no less than two responsible adults are present in the vehicle at all times

56 Best Practices: Residential Programs Involving Minors Fundamental protocols for overnight programs: Curfews Substance-free housing and facilities Separate accommodations for adults and participants Control access to program participants Close and careful Residential supervision by those who have received training on how to receive disclosures, provide resources and support, and how to report appropriately and immediately following any incidents or disclosures (to supervisors, UCPD, ODE and DCF)

57 Minor Protection Coordinator For further guidance: Omar Andujar Minor Protection Coordinator Office of Audit, Compliance & Ethics Telephone: (860)

58 Access and Accommodations ADA

59 What is the ADA? The Americans with Disabilities Act of 1990 (ADA) is a federal law that forbids disability-based discrimination in employment (including job applicants) and postsecondary educational programs

60 UConn s Commitment to Access and Accommodations The University is committed to: Providing reasonable accommodations for qualified persons with disabilities Ensuring that people with disabilities have the same access to programs, opportunities, and activities Eliminating existing barriers that limit full access for persons with disabilities Achieving the full participation and integration of people with disabilities into the University

61 Policy on Providing Information in Alternative Formats Intended to address the needs of individuals requiring access to University materials in alternate formats Interactive process with each person making a request for accommodations and reviews requests on a case-by-case basis Providing alternative formats is a departmental and/or program responsibility

62 Non-Discrimination Policy Statements for Publications, Printed Material and Electronic Media All official University publications, regardless of format, should contain the appropriate nondiscrimination statement

63 Meeting and Event Resources Events and Meetings: Accessibility Checklist for University Events Sample Accessible Event/Meeting Notice

64 Faculty Resources and Instructional Strategies Center for Excellence in Teaching and Learning (CETL) - Course content

65 ATTESTATION I have received annual compliance training, which included an overview of the University of Connecticut Code of Conduct and University Guide to the State Code of Ethics. I have been informed how to ask questions of or to report concerns to the Compliance Office. I understand that University policy prohibits retaliation against any individual asking questions or reporting concerns to the appropriate authority. I understand that violations of the Code of Conduct or the University Guide to the State Code of Ethics may result in disciplinary measures or sanctions by the University and/or Office of State Ethics as appropriate.