Read RULES OF The Automatic Data Processing (ADP) BOARD and conduct of its members: text version

Disposition of Obsolete Equipment Plan

Disposition of Obsolete Equipment Plan

Disposition of Obsolete Equipment Plan

1.0 2.0 Disposition Policy Obsolete Equipment Disposition procedures 2.1 2.2 2.3 2.4 2.5 Agency Responsibility Records Retention Erasing the Hardware / Hard drive Procedures Automated Data Processing Board (ADP) Certification Sticker Customer Service Request (CSR) / Notification 2.5.1 2.5.2 2.5.3 2.6 2.7 2.8 2.9 2.10 3.0 Customer Service Request (CSR) Procedures Cuyahoga County Information Services Center (CCISC) Equipment Detail List Customer Service Request (CSR) Work Flow for Obsolete Equipment

Office of Procurement and Diversity (OPD) Agency Notification of the Board of County Commissioners (BOCC) Resolution Cuyahoga County Information Services Center (CCSIC) Facilities Department: Obsolete Equipment Procedures Physical Hard Drive Destruction Procedures Documentation of Obsolete Equipment

Rules and Regulations 3.1 3.2 Ohio Revised Code 307.12 The Final HIPAA Security Rule

4.0

The Disposition of Obsolete Equipment Reference Guide / Checklist

Appendix A Appendix B Appendix C Appendix D

Page 2 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

1.0

Disposition Policy Obsolete computer hardware owned by Cuyahoga County shall be disposed of in an appropriate and secure manner. Data stored on obsolete equipment shall be completely removed and rendered unretrievalble. The computer equipment may then be disposed of by being made available for use by County agencies requesting it, being added to the surplus equipment inventory or being destroyed (ORC, Section 307.12). The Board of County Commissioners, as owner of the equipment, shall dispose of the equipment by resolution. Obsolete Equipment Disposition Procedures 2.1 Agency Responsibility Each Cuyahoga County Agency shall erase all software (including operating system) and data and any electronic media from computer hardware / hard drive before it is made available for future use, added to surplus, discarded or destroyed. Records Retention Agencies will follow their existing Records Management function(s). Records Management-- what is kept, what is a legal "record," retention period, and pertinent laws, regulations and /or policies regarding record retention period, -- is a topic beyond the scope of this plan. Erasing the Hardware / Hard Drive Procedures Each agency shall use only Cuyahoga County authorized software and follow the software procedures for erasure as the method by which all hard drives and floppy disks shall be erased. Below is a list of the authorized software:

KillDisk

2.0

2.2

2.3

xxxxx xxxxx xxxxx 2.4 ADP Board Certification Sticker The individual performing the hard drive erasure procedure must have suitable IT technical expertise and will be responsible for verifying that the process of erasing the hard drive has been successfully completed. The IT technician will sign and date the ADP certification sticker and affix the sticker over the power connection of the computer housing the hard drive. By doing this we know (assume) that the machine has not been powered up since the drive was made void of any retrievable data using Cuyahoga County compliant software. (See Appendix A for Sticker) NOTE: For convenience a Certification Sticker template has been created, use the link to the County Intranet below to print the Certification Sticker: (The Certification Sticker may be created by the agency as long as the verbiage remains the same.)

http://10.4.1.21/public/adpboard/obsolete_equip/default.htm

Page 3 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

2.5

Customer Service Request (CSR) / Notification A Customer Service Request (CSR) must be sent to the Cuyahoga County Information Service Center (CCISC) when an agency no longer needs specific equipment. The agency will certify in writing on the CSR in the section marked Statement of Request, data from the computer hardware / hard drive is completely void of any retrievable data and submit the certification along with the request for pickup of equipment. 2.5.1 Customer Services Request, CSR (See Appendix B) Form Procedures: CSR / ODR Checkbox's: Check the CSR checkbox Index Code: Record your Index Code in the space provided on the form. This is your billing code assigned to your agency Approval Signature: An authorized CSR requestor must sign; the signature must be on file with the CCSIC Security Department. Any questions email the security department at; [email protected] Date Approved: The date the authorized requestor signed the CSR User Department: Name the Agency requesting the service Requestor Name: The person making the request or point of contact. Statement of Request: Specify the request in detail, include the name(s) and telephone number(s) for the IT technician(s) responsible (and alternate(s), if appropriate that performed the erasure of all software listed on the attached CCISC Equipment Detail List (including operating system) and data and any electronic media from computer hardware / hard drive. Include where the obsolete equipment will be stored for pick up Cuyahoga County Information Services Center (CCSIC) Equipment Detail List: (See appendix C) Form Procedures: This form is to be attached to the CSR. It is a detailed list of the obsolete equipment to be picked up. The form can be obtained from the Cuyahoga County Intranet / Forms. The list shall include the following information: (NOTE: CSR# and PO# field is for ISC USE ONLY) Item #: The numerical sequence of a sole piece of equipment Description: Classify what kind of equipment is listed, i.e. monitor Model #: Taken from the manufacturers label Serial Number: Taken from the manufacturers label CCSIC Tag #: Taken from the CCISC Bar Code sticker Removed Components(s): Itemize each and every component removed from equipment Customer Service Request (CSR) Work Flow for Obsolete Equipment The CSR completed form is to be submitted to your CCISC Account Manager. The CCISC Account Manager submits the CSR to CCISC CSR Administrator who then assigns a CSR number and adds information to the CSR databases to track workflow.

Revised May 12, 2004

2.5.2

2.5.3

Page 4 of 17

Disposition of Obsolete Equipment Plan

The ISC CSR Administrator distributes the following CSR copies: Yellow copy to the ISC Facilities Control Manager to schedule pick up. Pink copy is returned to the Agency authorized signer for verification Copies go to the ISC Business Department for inventory and maintenance updating and processing. Copies to the ISC Account Manager for follow up. The Business Department notifies the Office of Procurement and Diversity (OPD) with all the necessary Information pertaining to the equipment to be assigned to surplus. 2.6 Office of Procurement and Diversity (OPD) The Office of Procurement and Diversity (OPD) will secure a Resolution from the Board of County Commissioners for the transfer of the equipment to surplus. Commissioners for the requesting agency seeking approval and method to dispose of listed equipment. Agency Notification of the Board of County Commissioners (BOCC) Resolution Upon receiving the disposal method notification of the obsolete equipment by BOCC Resolution, the agency will contact the Facilities Manager at the Cuyahoga County Information Service Center and/or other affected agencies and departments of the equipment in the disposition phase. Cuyahoga County Information Services Center (CCISC) Facilities Department: Obsolete Equipment Procedures The facilities manager will arrange for the equipment pick up and transfers the equipment to a central receiving area in the Sterling Building located at 1255 Euclid Avenue. The stockroom clerk(s) will receive the equipment from a copy of the Equipment Detail List. The business office accountant and inventory personnel are notified that the equipment is ready for disposition and the proper inventory reductions are made. The business department personnel upon completion of the inventory reductions notify the facilities manager, the facilities manager then notifies the stockroom clerk(s) to begin the disposal process. RET3 Job Corp may then be contacted to pick up the equipment. Physical Hard Drive Destruction Procedures: Hard drives shall be destroyed when they are defective or cannot be economically repaired or sanitized for reuse or as ordered by BOCC resolution. As an added security measure, when practical, operable hard drives no longer deemed economically viable should be made void of any retrievable data as outlined throughout Section 2.0. Physical destruction must be accomplished to an extent that precludes any possible further use of the hard drive.

2.7

2.8

2.9

Page 5 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

The equipment / tools that are needed to begin the process include: Appropriate safety equipment, safety goggles, etc. Wrench Hammer Knife Screw Driver

Make certain all equipment is disconnected (unplugged) from all electrical connections. Remove the hard drive from the chasses or cabinet (cover). Remove any steel shielding materials, mounting brackets, and cut any electrical connection to the hard drive unit. Subject the hard rive to physical force (e.g., pounding with a hammer) that will disfigure, bend, mangle, or otherwise mutilate the hard drive so that it cannot be reinserted into a functioning computer. Sufficient force should be used directly on top of the hard drive unit to cause shock / damage to the disk surfaces. In addition, any connectors that interface into the computer must be mangled, bent, or otherwise damaged to the point that the hard drive could not be re-connected without significant rework. All Cuyahoga County computer equipment no longer deemed economically viable shall be disposed of in accordance with all applicable environmental rules and regulations. NOTE: Destruction of the hard drive is not currently guaranteed by resolution or by a contractual agreement with a recycling / destruction facility. 2.10 Documentation of Obsolete Equipment Each Agency and the CCISC business department will maintain a separate copy of the CSR, CCSIC Equipment Detail List and any and all other meaningful documentation or recordings for a minimum of five years. 3.0 Rules and Regulations 3.1 Ohio Revised Code 307.12 § 307.12. Disposition of unneeded, obsolete or unfit personal property.

Page 6 of 17 Revised May 12, 2004

Disposition of Obsolete Equipment Plan

(A) Except as otherwise provided in divisions (B), (C), and (E) of this section, when the board of county commissioners finds, by resolution, that the county has personal property, including motor vehicles acquired for the use of county officers and departments, and road machinery, equipment, tools, or supplies, which is not needed for public use, or is obsolete or unfit for the use for which it was acquired, and when the fair market value of the property to be sold under this division is, in the opinion of the board, in excess of two thousand five hundred dollars, the board may do either of the following: (1) Sell the property at public auction or by sealed bid to the highest bidder. Notice of the time, place, and manner of the sale shall be published in a newspaper of general circulation in the county at least ten days prior to the sale, and a typewritten or printed notice of the time, place, and manner of the sale shall be posted at least ten days before the sale in the offices of the county auditor and the board of county commissioners. If a board conducts a sale of property by sealed bid, the form of the bid shall be as prescribed by the board, and each bid shall contain the name of the person submitting it. Bids received shall be opened and tabulated at the time stated in the notice. The property shall be sold to the highest bidder, except that the board may reject all bids and hold another sale, by public auction or sealed bid, in the manner prescribed by this section. (2) Donate any motor vehicle that does not exceed four thousand five hundred dollars in value to a nonprofit organization exempt from federal income taxation pursuant to 26 U.S.C. 501(a) and (c)(3) for the purpose of meeting the transportation needs of participants in the Ohio works first program established under Chapter 5107. of the Revised Code and participants in the prevention, retention, and contingency program established under Chapter 5108. of the Revised Code. (B) When the board of county commissioners finds, by resolution, that the county has personal property, including motor vehicles acquired for the use of county officers and departments, and road machinery, equipment, tools, or supplies, which is not needed for public use, or is obsolete or unfit for the use for which it was acquired, and when the fair market value of the property to be sold under this division is, in the opinion of the board, two thousand five hundred dollars or less, the board may sell the property by private sale, without advertisement or public notification. Notwithstanding anything to the contrary in division (A) or (C) of this section and regardless of the property's value, the board may sell or donate county personal property, including motor vehicles, to the federal government, the state, or any political subdivision of the state without advertisement or public notification. (C) Notwithstanding anything to the contrary in division (A), (B), or (E) of this section and regardless of the property's value, the board of county commissioners may sell personal property, including motor vehicles acquired for the use of county officers and departments, and road machinery, equipment, tools, or supplies, which is not needed for public use, or is obsolete or unfit for the use for which it was acquired, by internet auction. The board shall adopt, during each calendar year, a resolution expressing its intent to sell that property by internet auction. The resolution shall include a description of how the auctions will be conducted and shall specify the number of days for bidding on the property, which shall be no less than fifteen days, including Saturdays, Sundays, and legal holidays. The resolution shall indicate whether the county will conduct the auction or the board will contract with a

Page 7 of 17 Revised May 12, 2004

Disposition of Obsolete Equipment Plan

representative to conduct the auction and shall establish the general terms and conditions of sale. If a representative is known when the resolution is adopted, the resolution shall provide contact information such as the representative's name, address, and telephone number. After adoption of the resolution, the board shall publish, in a newspaper of general circulation in the county, notice of its intent to sell unneeded, obsolete, or unfit county personal property by internet auction. The notice shall include a summary of the information provided in the resolution and shall be published at least twice. The second and any subsequent notice shall be published not less than ten nor more than twenty days after the previous notice. A similar notice also shall be posted continually throughout the calendar year in a conspicuous place in the offices of the county auditor and the board of county commissioners, and, if the county maintains a website on the internet, the notice shall be posted continually throughout the calendar year at that website. When property is to be sold by internet auction, the board or its representative may establish a minimum price that will be accepted for specific items and may establish any other terms and conditions for the particular sale, including requirements for pick-up or delivery, method of payment, and sales tax. This type of information shall be provided on the internet at the time of the auction and may be provided before that time upon request after the terms and conditions have been determined by the board or its representative. (D) When a county officer or department head determines that county-owned personal property under the jurisdiction of the officer or department head, including motor vehicles, road machinery, equipment, tools, or supplies, is not of immediate need, the county officer or department head may notify the board of county commissioners, and the board may lease that personal property to any municipal corporation, township, or other political subdivision of the state. The lease shall require the county to be reimbursed under terms, conditions, and fees established by the board, or under contracts executed by the board. (E) If the board of county commissioners finds, by resolution, that the county has vehicles, equipment, or machinery which is not needed, or is unfit for public use, and the board desires to sell the vehicles, equipment, or machinery to the person or firm from which it proposes to purchase other vehicles, equipment, or machinery, the board may offer to sell the vehicles, equipment, or machinery to that person or firm, and to have the selling price credited to the person or firm against the purchase price of other vehicles, equipment, or machinery. (F) If the board of county commissioners advertises for bids for the sale of new vehicles, equipment, or machinery to the county, it may include in the same advertisement a notice of the willingness of the board to accept bids for the purchase of county-owned vehicles, equipment, or machinery which is obsolete or not needed for public use, and to have the amount of those bids subtracted from the selling price of the other vehicles, equipment, or machinery as a means of determining the lowest responsible bidder. (G) If a board of county commissioners determines that county personal property is not needed for public use, or is obsolete or unfit for the use for which it was acquired, and that the property has no value, the board may discard or salvage that property.

Page 8 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

(H) As used in this section, "internet" means the international computer network of both federal and nonfederal interoperable packet switched data networks, including the graphical subnetwork called the world wide web. 3.2 The Final HIPAA Security Rule Device and Media Controls (164.310 (d) (1)) We proposed that covered entities have media controls in the form of formal, documented policies and procedures that govern the receipt and removal of hardware and/or software (for example, diskettes and tapes) into and out of facility. Implementation features would have included "Access control, ""Accountability" (tracking mechanism), "Data backup," "Data storage and "Disposal." In this final rule, we adopt most of these provisions as addressable implementation specifications and add a specification for media re-use. We change the name from "Media controls" to "Device and media controls" to more clearly reflect that this standard concerns hardware as well as electronic media. The proposed "Access control" implementation feature has been removed, as it addressed as part of other standards (see section III.C.12c of this preamble). http://www.cms.hhs.gov/regulations/hipaa/cms0003-5/0049f-econ-ofr-2-12-03.pdf 4.0 The Deposition of Obsolete Equipment Reference Guide - Checklist An easy to use reference guide / checklist has been created for your use to insure everything has been completed per plan, policy and procedure outlined herein. (see Appendix D)

Page 9 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

Appendix A

Page 10 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

The software and data have been removed from this computer according to the Cuyahoga County Disposition of Obsolete Equipment Plan: Erased the Hardware and/or Hard drive / Cuyahoga County compliant software Physical Hard Drive Destruction

_______________________________________________ PRINT NAME ______________________________________________ IT SIGNATURE ________________________ E/mail / PHONE ________________________ DATE

Page 11 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

Appendix B

Page 12 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

Page 13 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

Appendix C

Page 14 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

Cuyahoga County Information Services Center Equipment Detail List ISC Use Only

CSR #_____________________ PO #______________________ Page ___of__

ITEM#

DESCRIPTION

MODEL#

SERIAL#

CCISC TAG#

REMOVED COMPONENTS

Page 15 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

Appendix D

Page 16 of 17

Revised May 12, 2004

Disposition of Obsolete Equipment Plan

Disposition of Obsolete Equipment Plan Reference Guide / Checklist

This list is to serve as a quick reference guide for the Policy and Procedures manual. ISC Use Only

CSR #________________ PO #-_________________

Review the Disposition of Obsolete Equipment Plan, Policy and Procedures. It can be found at http://10.4.1.21/public/adpboard/obsolete_equip/default.htm Before you erase any data from your equipment, inquire and adhere to any records retention rules and regulations your agency complies with. See Section 2.2. Erasure of all Hardware / Hard drives is covered in Section 2.3. You must use and purchase county certified software in order to be compliant. For example: KillDisk is a certified software product. Affix the ADP Board Certification Sticker over the power connection. See Section 2.4. for the exact verbiage needed. You can print your own interactive stickers by going to this website or create your own. Signatures are required on every sticker. Complete the Customer Service Request (CSR) / Notification Form. See Section 2.5. This form is used by the CCISC to verify and track the disposal of equipment. Complete and attach the CCISC Equipment Detail List Form to the CSR. See Section 2.5.2. Send your completed CSR and Equipment List to your CCISC Account Manager See Section 2.5.3. or call CCISC Customer Help line at 216-443-8007. Upon receiving the Disposal Method Notification, the agency will contact the CCISC Facilities department. The facilities manager will arrange for pick and transfer the equipment to a central area at the CCISC location for proper disposition and inventory reduction. This is a BOCC resolution. See Sections 2.7, and 2.9. Hard Drives or any storage medium must be physically destroyed if they are defective or cannot be economically repaired. See section 2.9 for further instructions. You are required to maintain a copy of the CSR, the detail equipment list, and any other meaningful documentation of this disposal for a minimum of five years. See section 2.10. Additional notes:

Page 17 of 17

Revised May 12, 2004

Information

RULES OF The Automatic Data Processing (ADP) BOARD and conduct of its members:

17 pages

Find more like this

Report File (DMCA)

Our content is added by our users. We aim to remove reported files within 1 working day. Please use this link to notify us:

Report this file as copyright or inappropriate

949819


You might also be interested in

BETA
RULES OF The Automatic Data Processing (ADP) BOARD and conduct of its members: