Definitions
- An employee/independent contractor/vendor for purposes of this policy is defined as follows:
- An employee is anyone employed by the Grand Rapids Public Schools, whether full or part-time.
- An independent contractor/vendor is an individual, or an owner or employee of an entity that has a contract with Grand Rapids Public Schools ("GRPS"), for the purpose of providing services including but not limited to, food, custodial, transportation, counseling, professional development, training, coaching, or tutoring, mentoring, administrative or instructional services to students or related and auxiliary services to special education students; or
- The term "employee/independent contractor/vendor" does not apply to individuals 19 years of age or less who are enrolled as a general education student in GRPS or who are 26 years of age or less and are enrolled in special education programs or services in GRPS. However, before such individual is assigned to regularly and continuously work either directly or under contract, GRPS shall perform a criminal history check on that person using the department of state police's internet criminal history access tool ("ICHAT"). If the (ICHAT search reveals that the individual has been convicted of a listed offense that individual shall not be assigned to work either directly or under contract with GRPS.
- If the (ICHAT search reveals that the individual has been convicted of a felony other than a listed offense, the individual shall not be assigned to work either directly or under contract with GRPS unless the Superintendent and the Board of Education approve the work assignment in writing.
- "School property" means a building, facility, structure or real property owned, leased or otherwise controlled by GRPS, including a building, facility, structure or real property that is no longer in use on a permanent, continuous basis but is still used to (1) impart educational instruction or (2) for use of students not more than 19 years of age for sports or other recreational activities.
- "Regularly and Continuously Assigned" means: The assignment requires the individual to be in the school or on school property at least once per week or two or more times per month for 60 days or more.
- Notwithstanding the above definitions, any employee/independent contractor/vendor who has direct one-on-one contact with students must undergo the criminal background checks (fingerprints and ICHAT).
Required Criminal Background Checks
- If, as a result of the criminal background checks, or if GRPS learns through an authoritative source, that an employee/independent contractor/ vendor has been convicted of a listed offense, then that individual shall not be allowed to work either directly or under a contract with GRPS.
- If the individual has been convicted of a felony other than a listed offense, the individual shall not be allowed to work either directly or under a contract with GRPS unless the Superintendent and the Board of Education specifically approve the work assignment in writing.
- Listed offenses are those defined in MCL 28,722 and include the following:
- MCL 750.145a - Accosting, enticing or soliciting child (less than 16 years of age) for immoral purposes.
- MCL 750.145b - Accosting, enticing or soliciting child (less than 16 years of age) for immoral purposes - second or subsequent offenses.
- MCL 750.145c - Child (a person less than 18 years of age who has not been legally emancipated) sexually abusive activity or material, including possession of child sexually abusive material.
- MCL 750.158 - Crime against nature (i.e., sodomy and bestiality) if the victim is an individual less than 18 years of age.
- A third or subsequent violation of any combination of the following:
- (A) MCL 750.167(1) - Indecent or obscene conduct in a public place;
- (B) MCL 750.335a - Indecent exposure;
- (C) A local ordinance of a municipality substantially corresponding to a section described in (A) or (B), supra.
- Except for juvenile disposition or adjudication, a violation of:
- (A) MCL 750.338 - Gross indecency between males; fellatio or masturbation;
- (B) MCL 750.338a - Gross indecency between females; oral sex;
- (C) MCL 750.338b - Gross indecency between male and female persons; If the victim is an individual less than 18 years of age.
- MCL 750.349 - Kidnapping, if victim is an individual less than 18 years of age.
- MCL 750.350 - Kidnapping; child under 14 years of age with intent to detain or conceal form child's parent/guardian.
- MCL 750.448 - Soliciting or accosting by a person 16 years of age or older, if victim is an individual less than 18 years of age.
- MCL 750.455 - Pandering.
- MCL 750.420b - First degree criminal sexual conduct.
- MCL 750.520c - Second degree criminal sexual conduct.
- MCL 750.520d - Third degree criminal sexual conduct.
- MCL 750.520e - Fourth degree criminal sexual conduct.
- MCL 750.520g - Assault with intent to commit criminal sexual conduct.
- Any other violation of a law of the state or a local ordinance of a municipality that by its nature constitutes a sexual offense against an individual who is less than 18 years of age.
- MCL 750.10a - Offense by sexually delinquent person (i.e., "any person whose sexual behavior is characterized by repetitive or compulsive acts which indicate a disregard of consequences or the recognized rights of others, or by the use of force upon another person in attempting sexual relations of either a heterosexual or homosexual nature, or by the commission of sexual aggressions against children under the age of 16").
- An attempt or conspiracy to commit an offense described in (1) through 17).
- An offense substantially similar to an offense described in (1) through (17) under a law of the United States, any state, or any country or any tribal or military law.
Duty to Report
- Any employee/independent contractor/vendor who has one-on-one contact with students or who is regularly and continuously working either directly or under a contract in a GRPS school or school facility, who is charged with a crime listed in Section 1535a(1), MCL 380.1535a(1) or Section 1539b(1), MCL 380.1539b(1) of the Revised School Code, or a substantially similar law of another state, political subdivision of this state or another sate or of the United States, must do the following within three (3) business days of being arraigned for such a crime:
- Report the charge in writing to the Superintendent and the GRPS Human Resources Department, and
- On a form supplied by the State Department of Education report the charge to the State Department of Education.
- Any employee/independent contractor/vendor who has one-on-one contract with students or who is regularly and continuously working under a contract in a GRPS school or school facility who enters a plea of guilty or no contest to or is subject of a finding of guilt by a judge or jury of any crime described in Section 1535a(1), MCL 380.1535a(1) or Section 1539b(1), MCL 380.1539b(1) must immediately:
- Disclose to the court on a form provided by the State Court Administrative Office that he or she is regularly and continuously working either directly or under a contract with GRPS in a school or school facility, and
- Provide a copy of such form (a) to the prosecuting attorney in charge of the case, (b) to the State Superintendent of Public Instruction and (c) to the Superintendent of GRPS and to the GRPS Human Resources Department.
- Crimes in Section 1535a(1), MCL 380.1535a(1) and Section 1539b(1), MCL 380.1539b(1) for which an individual must make a report when they are charged or convicted of such crime include the following:
- Any felony.
- Any of the following misdemeanors:
- (a) Criminal sexual conduct in the fourth degree or an attempt to commit criminal sexual conduct in the fourth degree.
- (b) Child abuse in the third or fourth degree or an attempt to commit child abuse in the third or fourth degree.
- (c) A misdemeanor involving cruelty, torture, or indecent exposure involving a child.
- (d) MCL 333.7410 - Delivery or distribution to minors, students near school property; distribution of marijuana.
- (e) MCL 750.115 - Breaking and entering or entering without breaking without permission.
- (f) MCL 750.141 a - Consumption or possession of alcohol by minors or controlled substances at social gatherings.
- (g) MCL 750.145a - Accosting, enticing or soliciting child or immoral purposes.
- (h) MCL 750.359 - Removal or damage to any property belonging to, connected with, or used in construction of vacant building or structure.
- (i) MCL 750.81 -Assault and assault and battery including domestic assault.
- (j) MCL 750.81 a - Assault and infliction of serious injury.
- (k) MCL 7501.145d - Internet crime against a minor.
- (I) MCL 750.335a - Indecent exposure.
- (m) MCL 436.1701 - Prohibited sale of liquor to minors.
- (n) Any misdemeanor that is a listed offense.
- Any violation of a substantially similar law of another state, of a political subdivision of this state or another state, or of the United States.
- A person who violates the above reporting requirements for criminal charges and/or convictions will be prohibited from working either directly or under a contract with GRPS.
- Reports of Criminal Charges and Convictions from Employees/ Independent Contractor/Vendor:
- Reports of criminal charges will be evaluated on an individual basis. However, GRPS reserves the right to terminate the assignment of any employee/independent contractor/vendor who has been arraigned for criminal charges that must be reported under this section.
- GRPS will terminate the assignment of any employee/ independent contractor/vendor convicted of a listed offense or of a felony other than a listed offence. All other criminal convictions will be evaluated on an individual basis. However, the GRPS reserves the right to terminate the assignment of any employee/independent contractor/vendor who is required to report a criminal conviction.
- Upon receipt of a written request from an employee/independent contractor/vendor and documentation verifying that the employee/independent contractor/vendor has not been convicted of a crime after the completion of judicial proceedings resulting from reported criminal charges, GRPS shall delete any criminal report concerning the individual from its records.
CRIMINAL HISTORY RECORD INFORMATION (CHRI)
Pursuant to state and federal law, the Grand Rapids Public Schools is considered a Noncriminal Justice Agency (NCJA) and is an Authorized Recipient (AR), wherein certain authorized personnel can request and receive fingerprint-based Criminal History Record (CHRI) checks. Authorization for ARs to receive CHRI is for the purpose of employment, licensing, and in some instances contracting or volunteering with the District. Therefore, in order to ensure compliance with the most current version of the Federal Bureau of Investigation Criminal Justice Information Services (CJIS) Security Policy, and GRPS’ policies, procedures and processes, this rule and the associated procedures created to comply with Policy 5175 shall be followed. If there is a conflict between Policy 5175, this rule or state and federal law or the most current version of the FBI CJIS Security Policy, the most stringent rule shall apply. Detailed procedures for implementing Policy 5175 and this rule shall be maintained in the Public Safety and Security and Human Resources Departments.
DEFINITIONS
- Authorized Recipients – for purposes of this rule means a non-governmental agency authorized by federal statute, executive order, or state statute which has been approved by the United States Attorney General to receive CHRI for noncriminal justice purposes.
- Authorized User/Personnel – means an individual, or group of individuals, who have been appropriately vetted through a national fingerprint-based background check, where required, and have been granted access to CJI data, wherein access is only for the purpose of evaluation of an individual’s qualifications for employment or assignment.
USER AGREEMENT
The District shall complete and maintain a Noncriminal Justice Agency User Agreement for Release of Criminal History Record Information (RI-087) provided by the Michigan State Police (MSP). Agreements are in place to provide data ownership, individual roles, responsibilities, etc. The District shall complete and return a new user agreement in the event it has a legal name change, moves to a new physical address, or wish to add or remove fingerprint reason codes. The most current copy of the user agreement will be maintained on file at the District indefinitely.
LOCAL AGENCY SECURITY OFFICER (LASO)
The Superintendent shall designate and notify the MSP, Security & Access Section of the name of the Local Agency Security Officer by completing and returning a Noncriminal Justice Agency Local Agency Security Officer Appointment (CJIS-015). The Superintendent shall notify the MSP if the LASO changes.
The Executive Director of Public Safety and Security is designated the Local Agency Security Officer. The LASO shall be directly involved in evaluating an individual’s qualifications for employment or assignment and shall also be responsible for the following:
- Identifying who is using or accessing CHRI and/or systems with access to CHRI.
- Identifying and documenting any equipment connected to the state system.
- Ensuring personnel security screening procedures are being followed as stated in this policy.
- Confirming the approved and appropriate security measures are in place and working as expected.
- Supporting policy compliance and promptly informing the MSP Information Security Officer (ISO) of security incidents
When changes in the LASO appointment occur, the District shall complete and return a new LASO appointment form. The District shall keep on file indefinitely the most current copy of the LASO appointment form. All MSP fingerprint account changes are to be made by the LASO.
PERSONNEL SECURITY
Terminated Personnel
The LASO or authorized designee shall terminate access to CHRI immediately, which is within 24 hours of a notification that an individual’s has terminated. Human Resource personnel shall notify the LASO when an employee is terminated. Refer to detailed procedures.
Transferred Personnel
The LASO shall determine if access to CHRI is still required when an employee is transferred or reassigned to a new position. If it is not required, access shall be terminated with 24 hours of the determination. Refer to detailed procedures.
Failure to follow these rules may result in discipline up to and including dismissal as well as a referral to law enforcement.
MEDIA PROTECTION
Media storage & access
CHRI media is to be protected and secured at all times. Digital and physical CHRI media shall be securely stored within physically secured locations or controlled areas, and within a GRPS facility unless otherwise permitted. Access to such media is restricted to authorized personnel only and secured at all times when not in use or under the supervision of an authorized individual. Access to CHRI data is not allowed on personally owned equipment and software, such as personal computers, laptops and hand held devices. Refer to detailed procedures.
Physical CHRI media:
- Is to be stored within individual records when feasible or by itself when necessary.
- Is to be maintained within a lockable filling cabinet, drawer, closet, office, safe, vault, etc.
Digital CHRI media:
- Is to be secured through encryption as specified in the most current FBI CJIS Security Policy.
- Unless encrypted, digital storage media devices (such as discs, CDs, SDs, thumb drives, DVDs, etc.) are to be maintained within a lockable filling cabinet, drawer, closet, office, safe, vault, etc.
MEDIA TRANSPORT (DIGITAL AND/OR PHYSICAL)
Should the need arise to move CHRI media outside of the secured location or controlled area, GRPS shall establish and implement appropriate security controls to prevent compromise of the data while transporting. The transport of CHRI media will be conducted by authorized personnel. Refer to detailed procedures.
CHRI media includes:
- Physical CHRI media such as paper/hard copies.
- Digital CHRI media such as laptops; computer hard drives; and any removable, transportable digital memory media, such as magnetic tape or disk, optical disk, flash drives, external hard drives, or digital memory card(s).
DIGITAL MEDIA SANITIZATION AND DISPOSAL
Once digital CHRI media devices are determined no longer needed by the District, devices shall be sanitized and disposed of according to the most current FBI CJIS Security Policy. Due to the presence of temporary files (data remanence), devices where digital media was once stored, processed, and/or used for dissemination (fax, scanners, computers, laptops, etc.) shall be sanitized in a manner that gives assurance that the information cannot be recovered prior to disposal of or upon the reassigning or recycling of such devices. An "erase" feature (e.g., putting a document in a “trash can” icon) or deleting a file is not sufficient for sensitive information, because the information may still be recoverable. The District, through its information technology department will provide steps for the sanitization and disposal of devices where CHRI media was once stored, processed, and/or used. Refer to detailed procedures.
DISPOSAL OF PHYSICAL MEDIA (PHYSICAL COPIES)
Once paper copies is determined no longer needed, they shall be destroyed and disposed of according to the FBI CJIS Security Policy. Refer to detailed procedures.
PHYSICAL PROTECTION
PHYSICALLY SECURE LOCATION
The District will ensure both sufficient physical and personnel security controls exist for the protection of CHRI and associated information systems. Refer to detailed procedures. A physically secure location is a facility, an area, a room, or a group of rooms within a facility. The District will:
- Retain CHRI in secured areas within the Human Resources Department and only provide access to those employees within the department with a need to know.
- Keep a current list of personnel with authorized access to the physically secure location or use a method of credentials to keep track of authorized personnel.
- Position information system devices that display CHRI in such a way as to prevent unauthorized individuals from accessing and viewing CHRI.
- Ensure methods are in place to monitor, detect, and respond to information system incidents for individuals attaining physical access to secured areas.
- Validate all visitors before admittance to the physically secure locations, and visitors will be escorted and monitored at all times.
- Authorize and control information system-related items entering and exiting the physically secure location.
INCIDENT RESPONSE
The LASO shall establish operational incident handling procedures for instances of an information security breach. Information security incidents are major incidents that significantly endanger the security or integrity of CHRI. All individuals with direct or indirect access to CHRI shall be trained on how to handle an information security incident, and such training is to be included within the District’s Security Awareness Training. Procedures shall be in place to track and document information security incidents, whether physical or digital, on an ongoing basis. When an incident has been determined a breach involving CHRI, the LASO will report the security breach to the MSP ISO by use of the “Information Security Officer (ISO) Computer Security Incident Response Capability Reporting” form (CJIS-016). Refer to detailed procedures.
MOBILE DEVICE INCIDENT RESPONE
In order to reduce the risk of unauthorized access to stored or viewed CHRI on mobile devices including smartphones or tablets, in addition to the reporting requirements listed above for incident response, the additional enhanced incident reporting and handling procedures shall be applied. Refer to detailed procedures.
The District will document and indicate, for a lost or compromised device, how long the device has been lost. When a device is lost, the District will report if the owner believed the device was locked, believed it was unlocked, or could not validate the device locked state. When a total loss of a device (unrecoverable) occurs, the District will report if CHRI was stored on the device, the device was locked or unlocked, and if the District was capable of remote tracking or wiping of the device.
The District will report any compromise of a device when the intrusion occurs while still in the owner’s possession and will report any compromise of a device when the intrusion occurs while still in the owner’s possession outside of the United States. As the CJIS-016 is the required method used for the reporting of security incidents, including mobile devices, the District will use and retain completed forms on an ongoing basis in order to meet policy requirements for tracking.
SECONDARY DISSEMINATION
When permitted by law, and the District releases a CHRI response to another authorized recipient pursuant to authorized sharing provisions, a log of such release(s) shall be established, implemented, and kept current. Refer to detailed procedures. The log will be maintained indefinitely and be made available upon request to a MSP representative for audit purposes. Fields required for the log are:
- The date the record was shared.
- Record disseminated.
- Requesting agency.
- Requestor’s name.
- Method of sharing; either by U.S. Mail, landline fax, or within the Criminal History Record Internet Subscription Service (CHRISS). (No emailing unless encrypted).
- Agency personnel that shared the CHRI.
SECURITY AWARENESS TRAINING
The District will establish, implement, and administer basic Security Awareness Training (SAT) that meets the minimum standards provided within the most current version of the FBI CJIS Security Policy. The LASO will, every two years and starting from date of adopting agency SAT, review the FBI CJIS Security Policy to ensure agency implemented SAT meets the most current requirement(s). All individuals having access to CHRI, whether digital or physical, shall complete SAT provided by the agency within six (6) months of assignment and every two (2) years thereafter. The agency will also include any or all Information Technology (IT) personnel having access to digital systems used to process CHRI. The agency will document and keep current completed SAT records, past and current.