Conneticut State Compliance

Conneticut public records law

The Connecticut Freedom of Information Act is a series of laws designed to guarantee that the public has access to public records of governmental bodies in Connecticut. The law was first enacted in 1975.

“Public records or files” means any recorded data or information relating to the conduct of the public’s business prepared, owned, used, received or retained by a public agency, or to which a public agency is entitled to receive a copy by law or contract under section 1-218, whether such data or information be handwritten, typed, tape-recorded, printed, photostated, photographed or recorded by any other method” (Chapter 14, section 1-200).

Conn.Gen.Stat._1-200 et seq

Sanctions for Noncompliance

The FOIC has the authority to impose civil penalties of not less than twenty dollars and not more than one thousand dollars against any custodian or other official upon a denial of a right under FOIA “without reasonable grounds.” Conn. Gen. Stat. §1-206(b)(2). See Nastro v. FOIC, 2008 Conn. Super. LEXIS 1892 (2008) (affirming imposition of civil penalty).

Any person who willfully, knowingly and with intent to do so, destroys, mutilates or otherwise disposes of any public record without the approval required under FOIA or unless pursuant to chapter 47 or 871, or who alters any public record, shall be guilty of a class A misdemeanor and each such occurrence shall constitute a separate offense. Conn. Gen. Stat. §1-240(a).

In Burton v. FOIC, 161 Conn. App. 654, certify. Denied 321 Conn. 901 (2016), the Appellate Court held that a complainant before the FOIC did not have standing to appeal the FOIC’s refusal to impose a civil penalty because the complainant was not aggrieved by that determination.

Any member of any public agency who fails to comply with an order of the Freedom of Information Commission shall be guilty of a class B misdemeanor and each occurrence of failure to comply with such order shall constitute a separate offense. Conn. Gen. Stat. §1-240(b).

A public agency may also bring an action in Connecticut Superior Court against any person whose appeal to the FOIC was denied because the FOIC determined that the “appeal or the underlying request would perpetrate an injustice or would constitute an abuse of the commission’s administrative process.” Conn. Gen. Stat. §1-241. The court may issue an injunction prohibiting the person from bringing further appeals to the FOIC; if the person continues to appeal, he or she will be conclusively in contempt of the order and the agency may seek further relief from the court. Id. See also Hodge v. FOIC, 2008 Conn. Super. LEXIS 2906 (2008), for a discussion regarding procedures for imposition of a civil penalty.

Relevant articles & litigation

The cost of litigation

Since 2006, FOIA lawsuits have increased 57% and the cost of defending these lawsuits is millions of dollars.

With Evertel, we provide an efficient, proven, and effective manner to share FOIA documents to those requesting. Once your legal experts provide the policy, the executives auditing your agency’s platform can immediately release the approved documents in minutes, avoiding multi-year litigations and expensive legal costs.

Criminal Justice Information Services

CJIS Compliance

The Federal Bureau of Investigation’s CJIS Security Policy sets the minimum security requirements to provide an acceptable level of assurance to protect the full lifecycle of Criminal Justice Information. Agencies using cloud-based services are required to make informed decisions on whether or not the cloud provider can offer services that maintain compliance with the requirements of the CJIS Security Policy.

The CJIS Security Policy integrates presidential and FBI directives, federal laws, and the criminal justice community’s Advisory Policy Board decisions, along with guidance from the National Institute of Standards and Technology (NIST). The Policy is periodically updated to reflect evolving security requirements.

The CJIS Security Policy defines 13 areas that private contractors such as cloud service providers must evaluate to determine if their use of cloud services can be consistent with CJIS requirements. These areas correspond closely to NIST 800-53, which is also the basis for the Federal Risk and Authorization Management Program (FedRAMP) program.

The key agency requirements of CJIS compliance are summarized here:

Evertel and CJIS Policy
Evertel signs the CJIS Security Addendum in states with CJIS Information Agreements. These tell state law enforcement authorities responsible for compliance with CJIS Security Policy how Evertel’s cloud security controls help protect the full lifecycle of data and ensure appropriate background screening of operating personnel with access to CJI. Evertel continues to work with state governments to enter into CJIS Information Agreements.

View Evertel CJIS compliance matrix
Information Exchange Agreements

If you’re sharing CJIS-protect data with another organization, you must have a written agreement between the organizations that you will both comply with CJIS security standards.

Security Awareness Training

Any employees handling CJIS data must have security training within the first six months of being assigned to their role and additional training every other year in the future.

Incident Response

You must have safeguards in place to detect and contain any data breaches. You also need data recovery measures in place. Any data breach must be reported to the appropriate authorities.

Auditing and Accountability

You should implement audit controls to monitor who is accessing data, when they are accessing it, and for what purpose they are accessing it. This information should be logged for any future audits.

Access Control

Under CJIS policy area 5, you must have the ability to control who can access your data. This can include controlling who can access, upload, download, transfer, and delete secure data. It also impacts your login management systems, remote access controls, and more.

Physical Protection

The physical location for stored CJIS data must be secured at all times, preventing access from unauthorized persons.

System and Communications Protection and Information Integrity

Not only should your data be protected, but your organization’s systems and communications should also be protected, as well. This policy section outlines the steps you must take to protect your systems, like encryption, network security, data breach detection measures, and more.

Formal Audits

If you use and manage CJIS data, you are subject to audits a minimum every three years by either the CJIS Audit Unit (CAU) or the CJIS Systems Agency (CSA) for your state.

Personnel Security

Everyone associated with your organization – from employees to contractors and subcontractors – must submit to security screenings and national fingerprint-based record checks.

Mobile Devices

Even your employees’ mobile devices (like smartphones and tablets) are subject to CJIS oversight. You must establish usage restrictions, and authorize, monitor, and control access to your systems via these devices.

Health Insurance Portability and Accountability Act

HIPAA Compliance

It is important to note upfront that HIPAA compliance requirements are primarily focused on health providers. Having said that, government agencies, and in particular 1st Responders, are typically transmitting HIPAA data daily and in non-compliant fashions. In today’s litigious world, it makes sense to comply with HIPAA requirements and remove or minimize the risk.

What's the risk?

HIPAA violations are expensive. The penalties for noncompliance are based on the level of negligence and can range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year for violations of an identical provision. Violations can also carry criminal charges that can result in jail time.

Fines increase with the number of patients and the amount of neglect. The lowest fines start with a breach where you didn’t know and, by exercising reasonable diligence, would not have known that you violated a provision. At the other end of the spectrum are fines levied where a breach is due to negligence and not corrected in 30 days. In legalese, this is known as mens rea (state of mind). So fines increase in severity from no mens rea (didn’t know) to assumed mens rea (willful neglect).

The fines and charges are broken down into 2 major categories: Reasonable Cause and Willful Neglect. Reasonable Cause ranges from $100 to $50,000 per incident and does not involve any jail time. Willful Neglect ranges from $10,000 to $50,000 for each incident and can result in criminal charges.

Unencrypted data

While encryption is an addressable (rather than required) specification, it does not mean optional. The vast majority of data breaches are due to stolen or lost data that was unencrypted. When in doubt, you should implement the addressable implementation specifications of the Security Rule. Most of them are best practices.

Employee error

Breaches can occur when employees lose unencrypted portable devices, mistakenly send PHI to vendors who post that information online and disclose personally identifiable, sensitive information on social networks.

These are all examples from actual cases. Employee training and adherence to security policies and procedures are extremely important.

Data stored on devices

Almost half of all data breaches are the result of theft. When laptops, smartphones, etc. are unencrypted the risk of a breach increases considerably. With Evertel, your data is safely stored off-premise; so that a lost or stolen mobile phone or laptop has no data on it and hence and no PHI is compromised.

Relevant articles & litigation


Ready to protect your agency
from compliance lawsuits?

What’s the cost of not taking the steps necessary to ensure your Department’s communications are complaint?

No obligation 30-day free trial