Personnel director: Concerns about state workers' personal data resolved

The head of Nevada's Personnel Department says concerns about the security of state worker payroll information have been resolved and dangers an outsider could get that data all but eliminated.

Todd Rich moved to change the rules after a former Department of Information Technology employee discovered there was no system for tracking the CDs after they were sent and no rules for either getting them back or destroying them.

Over the years, Rich said, more than 13,000 of the disks containing payroll information including Social Security numbers have been distributed. Rich said since the issue was raised in June, all but 470 of the CDs have been accounted for.

A number of employees expressed concern when the news of the missing disks was first reported, fearing they could become victims of identity theft.

"I think they had a right to be concerned," Rich said. "But we don't have any indication that anyone has stolen these disks nor has any agency told us they've had disks stolen."

Since that discovery, he said new security rules have been issued for handling and accounting for the disks. The rules require they be locked up when not actively in use and a log kept of anyone who accesses them.

They must be inventoried every six months. No duplication is permitted, and passwords are required for those people in any agency who are allowed access to the data.

When the disks are no longer needed, he said the rules require they be destroyed - most often by shredding them - and a record kept of that destruction.

The most important change, Rich said, is that the disks, which are used by agencies to reconcile payroll information each pay period, no longer contain any personal identification information. Employees are identified only by an assigned employee number, which is kept confidential except to those whose job it is to deal with payroll information.

As for those still missing disks, Rich said individual agencies are evaluating their specific situation, and if they and the Attorney General's Office believe there is some danger and that employees should be notified, they will do so. But he repeated there has been no evidence so far to indicate any of the disks fell into the wrong hands.

He said most likely, they were destroyed, but that, with no rules in place in the past, no one recorded that action.

• Contact reporter Geoff Dornan at gdornan@nevadaappeal.com or 687-8750.