LOS ANGELES COUNTY
DEPARTMENT OF MENTAL HEALTH
  Policy 1200.07 Use of Department Portable Electronic Devices
 
  PROCEDURES
  1. Cancellation of Portable Electronic Device/Termination from Service or Transfer
     
    1. Upon a workforce member’s termination from County service or transfer to another department, the workforce member must return the assigned Portable Electronic Device (PED) to the DMH Chief Information Office Bureau (CIOB). (DMH Policy 560.01)
       
    2. If a workforce member is transferring to another DMH organizational unit (interdepartmental transfer) and the new job duties and responsibilities require continued use of a previously assigned PED, the workforce member may ask to keep the same device with approval from the previous and new supervisors.  This request and approval process is done online through the Service Catalog.
       
    3. The workforce member to whom the device is assigned should return PEDs to their immediate supervisor.  The assignee must release this County property by unlocking their iPhone with their passcode so that the device can be issued and used by a new DMH requestor. (DMH Policy 560.01)
       
    4. If the workforce member to whom a PED has been issued retires, transfers to another department, terminates employment, is placed on an extended leave, or plans to be away from work, DMH managers are responsible for ensuring that property assigned to workforce members under their authority are returned to CIOB when the absence exceeds 30 days or the employee is no longer authorized to have the equipment.
       
      1. CIOB shall take appropriate action by either suspending access to the device and/or cancelling services pertaining to the device.
         
      2. CIOB shall reinstate the service and reactivate the device as appropriate upon the workforce member’s return to work with a new request based on the individuals most recent justified business need.
         
    5. When a DMH workforce member plans to terminate employment with the Department or is transferring to another County department, all County issued properties MUST be returned to the appropriate DMH bureau/division/program custodian in order to release the liability that the workforce member assumed upon receiving the assets. (DMH Policy 560.01)
       
  2. Lost, Stolen, or Damaged PEDs
     
    1. If a Department-issued PED is lost or stolen:
       
      1. The workforce member must immediately notify the DMH Help Desk at (213) 351-1335 and provide a detailed statement describing the accident or incident (when, where, what, who, how).  CIOB shall initiate necessary data security measures to mitigate introduced risks by notifying the service carrier for service interruption and administer a device remote wipe to temporarily interrupt service and avoid any potential data compromise.
         
      2. The workforce member must notify his/her management immediately, who then must complete an Accident/Incident Investigative Report (AIIR) via Service Catalog no later than 24 hours from the event.  If the incident is a result of violence or a violent act, a Security Incident Report (SIR) must be completed. (DMH Policy 109.01)
         
      3. Upon completion, the AIIR or SIR shall be automatically forwarded to the responsible parties such as DMH Information Security, DMH Privacy, County Office of Security Management (OSM) (if result of violence), and Procurement units, which upon receipt, shall take appropriate action. (DMH Policy 552.01)
         
      4. The workforce member must file a police report within 30 days of the incident.  The report shall be emailed to the DMH Help Desk at helpdesk@dmh.lacounty.gov and attached to the AIIR or SIR.
         
      5. If carelessness or negligence is determined to be the cause, the workforce member may be held financially responsible for the lost or stolen device. 
         
      6. If the required police report is not provided within 30 days of the incident, the workforce member shall automatically be considered responsible for reimbursing the Department for the loss, theft, or damage to County property. 
         
    2. If a Department-issued PED is damaged:
       
      1. Workforce member must immediately notify the DMH Help Desk and provide a statement describing details about the accident or incident (when, where, what, who, how).  Depending on the extent of damage, the DMH Help Desk may need to notify the service carrier to temporarily interrupt service.
         
      2. Workforce member must notify his/her management immediately, who then must complete an AIIR via Service Catalog if the reason for damage is non-violent, or a SIR if the incident occurred because of violence.
         
      3. Upon completion, the AIIR or SIR shall automatically be forwarded to the responsible parties, such as DMH Information Security Office, DMH Privacy group, County OSM, and Procurement units, which upon receipt, shall take appropriate action to mitigate any potential risk.
         
      4. If a Department-issued PED is damaged:
         
        1. Workforce member must immediately notify the DMH Help Desk and provide a statement describing details about the accident or incident (when, where, what, who, how).  Depending on the extent of damage, the DMH Help Desk may need to notify the service carrier to temporarily interrupt service.
        2. Workforce member must notify his/her management immediately, who then must complete an AIIR via Service Catalog if the reason for damage is non-violent, or a SIR (including a police report) if the incident occurred because of violence.
           
      5. If the required police report is not provided within 30 days of the incident, the workforce member shall automatically be considered responsible for reimbursing the Department for damage to the PED.
         
      6. If carelessness or negligence is determined to be the cause, the workforce member may be financially responsible for the partial cost of the device.
         
      7. CIOB is responsible for determining if a workforce member is responsible to pay for replacement or repair costs.  The replacement value or repair costs of a lost/stolen/damaged PED shall be determined when CIOB is notified of the loss or theft, or has examined the damaged device.  CIOB shall consider the age, condition, and remaining useful life of the subject equipment in determining the replacement value.
         
      8. CIOB shall notify the workforce member of the amount to be reimbursed to the Department for the lost, stolen, or damaged PED.  A copy of the notice indicating the amount due shall be sent to the DMH Financial Services.
         
      9. Reimbursement must be made by check or money order payable to the Los Angeles County Department of Mental Health and submitted to the DMH Financial Services.
         
      10. Upon reimbursement to DMH, DMH Financial Services shall issue a receipt.  The workforce member shall retain this receipt for property clearance and/or to obtain a replacement PED.  The CIOB shall not replace a PED without a receipt issued by DMH Financial Services as proof of reimbursement.
         
  3. Disposal of PEDs:
     
    1. All PEDs containing ePHI must be disposed properly (DMH Policy 554.01).  CIOB must ensure that all devices that are capable of storing information including, but not limited to, ePHI, are appropriately wiped clean before discarded.
       
    2. DMH-approved data destruction method is dependent on the type of media.  Paper, film, CD, DVD, and other hard copy media shall be shredded or destroyed so that the PHI cannot be read or reconstructed.  Electronic (i.e. “soft copy”) media shall be cleared, purged, or destroyed so that data previously stored in it cannot be retrieved, consistent with National Institute of Standards and Technology (NIST) Special Publication 800-88 Revision1, Guidelines for Media Sanitation.  In the event a PED must be disposed, workforce members must contact DMH Help Desk for instructions.
       
  4. Requests for Assignment of PED
     
    1. Requests for a PED must be submitted to CIOB through the online Service Catalog.
       
    2. A request for a PED must identify how one of the justifications provided in Policy Section 1.a. applies to the workforce member for whom the PED is being requested.
       
    3. Authorizing signatures are required per the Service Catalog form.  All details on the form must be completed for the review process and an approver’s consideration.
       
    4. In order for CIOB to process the release of the requested type of PED, the workforce member must sign the respective DMH PED Usage Agreement:
       
      1. Laptop or Notebook Usage Agreement
         
      2. Cellular Phone, Smart Phone, or Pager Application Agreement
         
      3. USB Storage Drive Usage Agreement
         
      4. CD/DVD Burner Usage Agreement
         
      5. Audio/Video Recorder-Digital Camera/Camcorder Usage Agreement
         
      6. Hotspot/Air Card Usage Agreement
         
    5. Managers issued PEDs for assignment within their respective areas for shared use must maintain documentation for all such assignments as described below:
       
    6. Safekeeping responsibilities and prevention from unauthorized access is the sole responsibility of the responsible manager.
       
    7. Manager must keep track of all the devices under their control and document device handovers at all times.
       
    8. At a minimum, documentation shall include the name of the manager, name of the workforce member, PED identification number, asset label, and dates assigned and returned.  Unassigned PEDs must be stored in a locked cabinet, office, drawers, or racks to prevent unauthorized access.
       
    9. Managers shall also establish a process for ensuring that the device is clean from any data at the time of return or issuance of the PED.
       
    10. DMH management and supervisors may be required to provide a recertification of the workforce member whose role might have changed.  However, the device and access might still be needed to conduct business in ongoing terms.