Part II. Participating Agencies in the Vjjis
6VAC35-160-30. Designation as a participating agency.
A. The department, including its central administration, department-operated facilities, and state-operated court service units, is considered a single participating agency for purposes of this regulation.
B. Locally operated court services units and secure juvenile detention centers shall be participating agencies in the VJJIS.
C. Any other agency that is eligible to receive juvenile record information under § 16.1-300 of the Code of Virginia may apply to the department for status as a participating agency.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.
6VAC35-160-40. Signed memorandum of agreement and nondisclosure agreement required.
The department shall develop a memorandum of agreement and a nondisclosure agreement with each participating agency delineating the participating agency's access to and responsibility for information contained in the VJJIS.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.
6VAC35-160-50. Data submissions.
A. All participating agencies shall submit data and other information as required by department procedures to ensure that juvenile record information is complete, accurate, current, and consistent.
B. Administrators of participating agencies are responsible for ensuring that entries into the VJJIS are accurate, timely, and in a form prescribed by the department.
C. All information entered into the VJJIS shall become part of a juvenile's record and shall be subject to the confidentiality provisions of § 16.1-300 of the Code of Virginia.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.
6VAC35-160-60. Access provided to participating agencies.
A. In accordance with statutes, regulations, and procedures governing confidentiality of information and system security, the department may limit or expand the scope of access granted to participating agencies.
B. When individuals or participating agencies are providing treatment or rehabilitative services to a juvenile as part of an agreement with the department, their access to juvenile record information shall be limited to that portion of the information that is relevant to the provision of the treatment or service. Once access to an application is authorized, the authorized data user is still obligated to assess the appropriateness of each specific access on a need-to-know basis.
C. An individual's juvenile record information shall be made available only to participating agencies currently supervising or providing services to the juvenile and only upon presentation of the unique identifying number assigned to the juvenile. Once access to an application is authorized, the authorized data user remains obligated to assess the appropriateness of each specific access on a need-to-know basis.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.
6VAC35-160-70. Designation of authorized individuals.
A. Each participating agency shall determine what positions in the agency require regular access to juvenile record information as part of their job responsibilities and as documented in the employee work profile.
B. The department shall require a background check of any individual who will be given access to the VJJIS system through any participating agency. The department may deny access to any person based on the results of such background investigation or due to the person's violation of the provisions of this chapter or other security requirements established for the collection, storage, or dissemination of juvenile record information.
C. Only authorized individuals shall have direct access to juvenile record information.
D. Use of juvenile record information by an unauthorized individual, or for a purpose or activity other than one for which the person is authorized to receive juvenile record information, shall be considered an unauthorized dissemination.
E. Persons who are given access to juvenile record information shall be required to sign an information security agreement in accordance with department procedure stating that they will use and disseminate the information only in compliance with law and this chapter and that they understand that there are criminal and civil penalties for unauthorized dissemination.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.
6VAC35-160-80. Responsibility for compliance.
The administrator of each participating agency shall ensure that employees who have access to juvenile record information are made familiar with the substance of this regulation and are briefed on their responsibility to protect the confidentiality of juvenile record information. The administrator of each participating agency is also responsible for reviewing all procedures connected with the security of juvenile record information to ensure their relevance and continuing effectiveness.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004.
6VAC35-160-90. Security of physical records.
A. A participating agency that possesses physical records or files containing juvenile record information shall institute procedures to ensure the physical security of such juvenile record information from unauthorized access, disclosure, dissemination, theft, sabotage, fire, flood, wind, or other natural or man-made disasters.
B. Only authorized persons shall have access to areas where juvenile record information is collected, stored, processed, or disseminated. Locks, guards, or other appropriate means shall be used to control access.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.
6VAC35-160-100. Requirements when records are automated.
Participating agencies having automated juvenile record information files shall:
1. Designate a data owner to maintain and control authorized user accounts, system management, and the implementation of security measures;
2. Develop and implement a logical access procedure to prevent unauthorized access and dissemination; and
3. Develop procedures for discarding old computers to ensure that information contained on those computers is not available to unauthorized persons. All data must be completely erased or otherwise made unreadable in accordance with COV ITRM Standard SEC 514–04, Removal of Commonwealth Data from Electronic Media Standard.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.
6VAC35-160-110. Access controls for computer security.
A. Where juvenile record information is computerized, logical access controls shall be implemented to ensure that records can be queried, updated, or destroyed only from approved system user accounts. Industry standard levels of encryption shall be required to protect confidential juvenile record information moving through any network.
B. The logical access controls shall be known only to the employees of the participating agency who are responsible for control of the juvenile record information system or to individuals and agencies operating under a specific agreement with the participating agency to provide such security programs. The access controls shall be kept secure.
C. Computer operations, whether dedicated or shared, that support juvenile record information shall operate in accordance with procedures developed or approved by the department.
D. Juvenile record information shall be stored in such a manner that it cannot be modified, destroyed, accessed, changed, purged, or overlaid in any fashion except via an approved system user account.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.
6VAC35-160-120. Procedures to protect security of juvenile record information.
Participating agencies shall establish procedures to detect unauthorized access or attempted access of juvenile record information, either physically or electronically, as well as procedures to be followed when an attempt or unauthorized access is detected. Such procedures shall be part of the orientation of employees working in any office, room, space or area in which juvenile record information is regularly collected, processed, stored, or disseminated.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004.
6VAC35-160-130. Security of telecommunications.
A. The department may permit the use of a nondedicated means of data transmission to access juvenile record information when there are adequate and verifiable safeguards in place to restrict access to juvenile record information to authorized persons. Industry standard levels of encryption shall be required to protect all juvenile record information moving through any network.
B. Where remote access of juvenile record information is permitted, remote access devices must be secure. Remote access devices capable of receiving or transmitting juvenile record information shall be secured during periods of operation. When the remote access device is unattended, the device shall be made inoperable for purposes of accessing juvenile record information by implementing a screen saver lockout period after a maximum of 15 minutes of inactivity for devices as required by COV ITRM Standards SEC 501–09.1. In addition, appropriate identification of the remote access device operator shall be required.
C. The telecommunications connection used with the remote access device shall also be secured. Telecommunications connections shall be reasonably protected from possible tampering or tapping.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.
6VAC35-160-140. Timelines for data submission.
The Virginia Juvenile Justice Information System makes it possible to record most juvenile record information instantaneously. All transactions occurring in a participating agency that are not entered immediately into the juvenile justice information system through on-line submission shall be entered within timeframes established by department procedures.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004.
6VAC35-160-150. Correcting errors.
Participating agencies shall immediately notify the appropriate data owner upon discovering that incorrect information has been entered into the VJJIS. The data owner shall make arrangements to correct the information as soon as practicable in accordance with department procedures.
Statutory Authority
§§ 16.1-223 and 66-10 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 20, Issue 23, eff. August 25, 2004; amended, Virginia Register Volume 33, Issue 26, eff. September 20, 2017.