Develop a protocol for sharing information confidentially

[scott-stockwell]

Prototype

• The current prototype version sends a password-protected pdf to the user with their forms, which should provide protection for the information in that email.

• At the clinics, we can pre-set the password and then hand out slips of paper to the clients when they enter that they can take home and have in order to unlock their forms. At each clinic, we would change the password

• Other notification emails can be turned off, eliminating the risk of any information ending up in our inboxes unprotected

• Anyone with access to the jotform tables (us, plus the attorneys we invite to help with looking up and entering client criminal information) will be able to see this info, but risks here can be mitigated by instituting a user access management plan where we regularly remove access to any partners who are no longer actively engaged.

• Confirm whether this represents adequate protections

Full App

• - Identify the criteria for the information to be restricted
• - Identify how that information will be stored and shared
• - Provide education to the team about the system for confidential information

[wdcrumpler-kcdd]

Update
Added additional information detailing the current protections used in the prototype, and thoughts about next steps:

• The current prototype version sends a password-protected pdf to the user with their forms, which should provide protection for the information in that email.
• At the clinics, we can pre-set the password and then hand out slips of paper to the clients when they enter that they can take home and have in order to unlock their forms. At each clinic, we would change the password
• Other notification emails can be turned off, eliminating the risk of any information ending up in our inboxes unprotected
• Anyone with access to the jotform tables (us, plus the attorneys we invite to help with looking up and entering client criminal information) will be able to see this info, but risks here can be mitigated by instituting a user access management plan where we regularly remove access to any partners who are no longer actively engaged.

[nwallis-10]

Security Protocol.docx

Recommended security protocol as of 5/9/2022