Statewide Data Spine

Key Dates:

• State of West Virginia Departments of Health, Health Facilities, and Human Services Office of Shared Administration Office of Management Information Services (OMIS) Procedure # OP-35: OMIS Vendor/Contractor Employee Background Check Procedure Revised: , 2025 1.0 PURPOSE In accordance with W. Va. Code § 15-2D-3, the Director of the WV Division of Protective Services (DPS) requires all newly hired vendors, contractors, and sub-contractors whose employees are regularly employed on the grounds or in the buildings of the State Capitol complex {this includes all WV Departments of Health (DH), Health Facilities (DHF), Human Services (DoHS), and Office of Shared Administration (OSA) facilities}, or who have access to sensitive and/or confidential data, are required to submit to a fingerprint-based state and federal background check prior to receiving access to State data and/or systems. This document outlines the procedure all Office of Management Information Services (OMIS) contracted employees must follow when receiving fingerprint-based state and federal background checks, to ensure these investigations are conducted according to established federal and state requirements. 2.0 SCOPE This procedure applies to all OMIS vendor, contractor, and sub-contractor employees providing services to the State who access, or may potentially access, sensitive and/or confidential data {i.e., protected health information (PHI), personally identifiable information (PII), social security administration (SSA) data, federal tax information (FTI), and/or payment card information (PCI)}. 3.0 PROCEDURE 3.1 All OMIS vendors, contractors, and sub-contractors must adhere to the process set forth in Appendix “A” of this procedure, titled OMIS Vendor/Contractor Background Check and Fingerprinting Procedures . 3.2 Agencies will collaborate, as needed, with the contracting company and DPS to ensure the background check process is applied and administered uniformly, fairly, and without prejudice.: February 10
• State of West Virginia Departments of Health, Health Facilities, and Human Services Office of Shared Administration Office of Management Information Services (OMIS) Procedure # OP-35: OMIS Vendor/Contractor Employee Background Check Procedure Revised: , 2025 3.3 The contracting company will be responsible for all background investigation costs. Payment must be made at the time of the fingerprinting process (see Appendix A). 3.4 Background investigations at a minimum, will include the following: 3.4.1 A Federal Bureau of Investigation (FBI) national agency check allows DPS to check the applicant’s criminal history in all U.S. states and territories. 3.4.2 A check through local law enforcement in the location(s) the applicant has lived, worked, and/or attended school within the last five (5) years, and if applicable, the appropriate agency for any identified arrests. 3.4.3 Social Security validation, which ensures an applicant's social security number (SSN) is legitimate and finds all names, including aliases and variations, dates of birth and address history associated with the SSN. 3.4.4 Proof of citizenship/residency (i.e., USCIS Form I-9), to validate the applicant is a U.S. citizen or a foreign citizen with the necessary authorization to work in the U.S. (For more information see the following link: https://www.e-verify.gov .). 3.5 All fingerprint-based background checks must be favorably adjudicated prior to allowing the vendor or contractor to access sensitive and/or confidential data. 3.6 If the background check does not reveal any type of conviction or disqualifying offense, the DPS will notify the OMIS Compliance and Reporting unit and/or the agency point of contact, as well as the contracting company, that the applicant has passed the background check. In this case, the hiring process or employment status will not be impacted. 3.7 Results of unfavorable background checks will be returned to the DPS and treated as confidential. According to federal law, the DPS may only share unfavorable results with the applicant whose background check results in a rejection of: February 10
• State of West Virginia Departments of Health, Health Facilities, and Human Services Office of Shared Administration Office of Management Information Services (OMIS) Procedure # OP-35: OMIS Vendor/Contractor Employee Background Check Procedure Revised: , 2025 employment (i.e., adverse action). Applicants have the right to challenge the accuracy contained in the federal identification record in accordance with state and federal laws and guidelines (see Attachment “A”). 3.8 Variance/Appeal Process 3.8.1 If the pre-screening process reveals a negative finding, or if the DPS issues a notice of ineligibility, the applicant, or the employer on the applicant's behalf, may file a written request for a variance with the DH, DHF, DoHS and OSA no later than 30-days after the date of the notice. Agencies may grant a variance under the following conditions: (1) Mitigating circumstances surrounding the negative finding or disqualifying offense is provided. (2) DHHR finds that the individual will not pose a danger or threat to residents, members, and their property. 3.8.2 Agencies will mail to the applicant and the contractor a written decision within 90-days of receipt of the request indicating whether a variance has been granted or denied. 3.8.3 If an applicant believes his or her State criminal history record information is incorrect or incomplete, he or she may challenge the accuracy of the record by contacting DPS for a personal review. If the discrepancies are at the charge or final disposition level, the applicant must address this with the court or arresting agency that submitted the record. 3.8.4 If an applicant believes his or her federal criminal history record information is incorrect or incomplete, he or she may appeal the accuracy of such information by contacting the Federal Bureau of Investigation (FBI) for instructions.: February 10
• State of West Virginia Departments of Health, Health Facilities, and Human Services Office of Shared Administration Office of Management Information Services (OMIS) Procedure # OP-35: OMIS Vendor/Contractor Employee Background Check Procedure Revised: , 2025 3.8.5 If any changes, corrections, or updates are made in the criminal history record information, the DPS will notify the Agency that the applicant has appealed the accuracy of the criminal history records and provide the updated results of the criminal history record information check. 3.8.6 If the DPS finds the applicant has intentionally falsified information or misrepresented him/herself in any way (e.g., applicant does not disclose a criminal conviction; fails to provide truthful, accurate, and complete information regarding a criminal conviction(s), etc.) the applicant may be disqualified from hire and/or prohibited from future employment with the State. 3.9 Provisional Employment 3.9.1 In accordance with §16-46-6 of West Virginia Senate Bill No. 88 , a contractor may work on a provisional basis for not more than sixty (60) days pending notification from the DPS regarding the results of the criminal background check only if: (1) The applicant is subject to direct on-site supervision, as specified in rule by the DoH, DHF, DHS and OSA Cabinet Secretaries, during the provisional period; and (2) In a signed statement the applicant must: (A) Affirm that he or she has not committed a disqualifying offense; (B) Acknowledge that a disqualifying offense reported in the required criminal history record information check shall constitute good cause for termination; and: February 10
• State of West Virginia Departments of Health, Health Facilities, and Human Services Office of Shared Administration Office of Management Information Services (OMIS) Procedure # OP-35: OMIS Vendor/Contractor Employee Background Check Procedure Revised: , 2025 (C) Acknowledge that the contractor may terminate the individual if a disqualifying offense is reported in the background investigation. (3) Provisional contractor employees who have requested a variance will not be required to sign such a statement. A covered contractor may continue to employ an individual if he or she applies for a variance of his or her fitness determination until the variance is resolved. 3.10 If the contracting company has conducted state and federal fingerprint-based background checks on its employees within three (3) years of the contract’s effective date, a list of authorized staff assigned to the project, as well as results of the checks, must be submitted to the OMIS Director of Compliance and Reporting for review and approval. 3.11 Agency contract managers will be responsible for initiating re-investigations for contractors and vendors every three (3) years from the date of their previous background investigations. Agencies have the right to re-screen individuals periodically, consistent with the criticality/sensitivity risk designation of the position. 4.0 ENFORCEMENT Violation of this procedure by external entities, including vendors, contractors, and/or consultants, may result in termination of the relationship and/or associated privileges. Violation may also result in civil and criminal penalties as determined by federal and state laws and regulations. 5.0 DEFINITIONS 5.1 Adverse Action - An action companies take based on the information in a background check report that negatively affects applicant's employment. An: February 10
• State of West Virginia Departments of Health, Health Facilities, and Human Services Office of Shared Administration Office of Management Information Services (OMIS) Procedure # OP-35: OMIS Vendor/Contractor Employee Background Check Procedure Revised: , 2025 adverse action letter is a written notice required by federal law, delivered in hard copy or electronic form, that informs a job candidate he or she will not be hired for a particular position because of the findings in a background check. 5.2 Division of Protective Services (DPS) – Office within the West Virginia Department of Military Affairs and Public Safety created to provide for the safety and security of individuals who visit, conduct business or work at the Capitol Complex and other state facilities. 5.3 Employee – Individuals retained and authorized on a temporary or permanent basis by the State of West Virginia to perform a service. For the purposes of this policy, the term “employee” will include the following: contractors, subcontractors, volunteers, county health department staff, business associates, and any other persons who are determined to be subject to this procedure. This definition does not create any additional rights or duties. 5.4 Federal Tax Information (FTI) – According to the IRS Publication 1075, FTI is defined as any return or return information received from the IRS or secondary source, such as SSA, Federal Office of Child Support Enforcement or Bureau of Fiscal Service. FTI includes any information created by the recipient that is derived from return or return information. 5.5 Negative Finding – a finding in the prescreening that excludes an applicant from direct access personnel positions. 5.6 Office of Management Information Services (OMIS) – This office reports directly to the DoH, DHF, DHS and OSA Cabinet Secretaries and provides the leadership, innovation, and services needed to achieve efficient and effective technology solutions to meet the goals of the Departments. 5.7 Payment Card Industry Data Security Standard (PCI DSS) – A proprietary information security standard for organizations that handle branded credit cards from the major card schemes.: February 10
• State of West Virginia Departments of Health, Health Facilities, and Human Services Office of Shared Administration Office of Management Information Services (OMIS) Procedure # OP-35: OMIS Vendor/Contractor Employee Background Check Procedure Revised: , 2025 5.8 Personally Identifiable Information (PII) - All information that identifies, or can be used to identify, locate, or contact (or impersonate) a particular individual. Personally identifiable information is contained in both public and non-public records. Examples may include but are not limited to a specific individual’s: first name (or initial) and last name (current or former); geographical address, electronic address (including an e-mail address); telephone number or fax number dedicated to contacting the individual at their physical place of residence; social security number; credit and debit card numbers; financial records, including loan accounts and payment history; consumer report information; mother’s maiden name; biometric identifiers, including but not limited to, fingerprints; facial recognition and iris scans; driver identification number; full face image; birth date; birth or adoption certificate number; physical description; genetic information; medical, disability or employment records, including salary information; computer information, including information collected through an Internet cookie; criminal history, etc. When connected with one or more of the items of information specified above, PII includes any other information concerning an individual, that if disclosed, identifies or can be used to identify a specific individual physically or electronically. 5.9 Protected Health Information (PHI) - Individually identifiable health information that is received, created, maintained or transmitted by the organization, including demographic information, that identifies an individual, or provides a reasonable basis to believe the information can be used to identify an individual, and relates to: · Past, present or future physical or mental health or condition of an individual; · The provision of health care to an individual; and · The past, present, or future payment for the provision of health care to an individual.: February 10
• State of West Virginia Departments of Health, Health Facilities, and Human Services Office of Shared Administration Office of Management Information Services (OMIS) Procedure # OP-35: OMIS Vendor/Contractor Employee Background Check Procedure Revised: , 2025 Privacy and Security Rules do not protect the individually identifiable health information of persons who have been deceased for more than 50 years. 5.10 Vendor/Contractor – See 5.3, definition of Employee 6.0 REFERENCES/RELATED MATERIAL This procedure applies to all relevant federal and state statutes pertaining to the following: 6.1 Internal Revenue Service (IRS) Publication 1075 – Tax Information Security Guidelines for Federal, State, and Local Agencies; Safeguards for Protecting Federal Tax Returns and Return Information 6.2 West Virginia Human Rights Act ( WV Code Sec. 5-11-1 et seq . ) 6.3 WVOT PO1001 – Information Security Policy 6.4 OMIS Policy #0512 - Information Security Policy 6.5 OMIS Policy #0529 - OMIS Vendor/Contractor Employee Background Checks 6.6 Appendix “A” – OMIS Contractor Background Check and Fingerprinting Procedures 6.7 WV DH, DHF, DoHS and OSA New Contractor/Vendor Employee Checklist 7.0 REVISION HISTORY Version Number Date Revisions Version 1.0 04/26/2021 Original version: February 10