Frequently Asked Questions (FAQs)

• What is a privacy/information security incident? 
• How do I report a privacy/information security incident? 
• What if the incident involves my supervisor? 
• What happens once I submit an incident? 
• What are the benefits of an incident program? 

1. What is a privacy/information security incident?

An incident is an event that threatens the confidentiality, integrity, or availability of DHS information or systems. Some examples of reportable incidents: sending a confidential file to the wrong person; a lost or stolen computer; not securing an e-mail containing confidential information. For more, visit our incident examples web page.

2. How do I report a privacy/information security incident?

If you believe there has been a privacy or security incident you should report it to the Information Security Office (ISO). You should also discuss the incident with your manager or supervisor as soon as possible. Review the procedure to report a privacy or information security incident: http://www.oregon.gov/DHS/admin/infosec/incdnt_resp.shtml.

• Privacy Program phone:  503-945-5780  email: dhs.privacyhelp@state.or.us
  
• Security Program phone: 503-945-6812  email: dhsinfo.security@state.or.us
  
  Note: For loss or theft of electronic equipment, also contact the DHS Service Desk, 503-945-5623.

3. What if the incident involves my supervisor and I'm not comfortable discussing it with him/her?

You may report the incident directly to the Information Security Office if you are uncomfortable discussing it with your supervisor.

4. What happens once I submit an incident?

Once you submit an incident, it is documented and reviewed regarding the impact to the department and/or clients. You will be contacted by the ISO Incident Coordinator to review the incident. After gathering the facts, the incident coordinator will work with the appropriate parties to determine the scope of the incident and whether any privacy or security requirements have been violated. If so, a course of action will be identified to minimize the risk to the affected parties.

Back to top

5. What is the purpose of an incident program?

• To minimize the loss, theft, or destruction of information
• To provide a consistent process for gathering information
• To help staff and partners recover quickly and efficiently from incidents
• To facilitate compliance with federal and state laws and regulations

Back to top