Agenda - 04-21-2009 - 4n - Laserfiche WebLink

Browse Search

2 • Use the risk assessment to select measures (red flags) that may be used to detect attempts to create fraudulent accounts. • Identify procedures for employees to prevent the establishment of false accounts and procedures for employees to implement if existing accounts are being manipulated. • Obtain program approval of the program by the BOCC or senior designated management by May 1, 2009. • Train appropriate employees on the policies and procedures in the program. • Provide an annual report to the BOCC or designated senior management. The annual report should provide any material matters related to the effectiveness of the programs policies and procedures, the oversight and effectiveness of any third party billing and account establishment entities, a summary of any identity theft incidents and the response to those incidents, and recommendations for any substantial changes to the program, if any. In February 2009, department covered by the Red Flags Rule reviewed their accounts to determine whether or not they were covered by Red Flags Rule. A task force, made up of covered departments, the staff attorney and Information Technology Department, was formed to assess the risk and develop a policy that detected, mitigated and prevented identity theft. The task force conducted an initial risk assessment of covered accounts and found there was some risk of identity theft. The task force then identified red flags that could be used to detect attempts to create fraudulent accounts and identified procedures to prevent and mitigate incidents of identity theft. The proposed policy also provides for training of staff and an annual review of the policy by an Identity Theft Prevention Task Force. A draft policy was reviewed by the County Manager, the County Attorney and staff covered by the Red Flags Rules. The attached recommended Identity Theft Prevention Program Policy complies with the Red Flags Rule. Some North Carolina Counties have enacted ordinances to comply with the FACTA's Red Flags Rule. FACTA, and its implementing regulations, are federal not state requirements. Since Counties in North Carolina have no inherent legislative power and possess only those powers conferred upon them by the General Assembly, staff is recommending the Red Flags Rules be implemented through an Identity Theft Prevention Program Policy instead of an ordinance. FINANCIAL IMPACT: There is no current financial impact. However, there may be some financial impact in the future. RECOMMENDATION(S): The Manager recommends the Board adopt the Identity Theft Prevention Program Policy. z See Five C's, Inc. v. Pasquotank, 672 S.E.2d 737, 740 (2009)