Anchorage Daily News

Q. In the last six months, our nine-member accounting department lost three payroll clerks. All worked here for less than a year, including one who was here for two weeks.

This makes me incredibly nervous as all three employees had access to all employee records. All it would take is seconds for any of these former employees to have downloaded all our employee and company data onto a flash drive and used it for identity theft. What do other companies do to safeguard against this?

A. You raise an issue confronting every employer. As just one example, a Presbyterian Hospital/Weill Cornell Medical Center patient-admissions employee stole and sold nearly 50,000 patient files, exposing them to identify theft, after leaving hospital staff last spring.

All employers need to limit access to confidential employee and company information to those who can be trusted and who have a clear need to know. Before you give an accounting, IT or other human-resources employee, including any temporary employee, access to personnel or other confidential records, protect your company and its employees by conducting a full reference and background check.

When conducting these checks, make sure you comply with all legal requirements, including those established by the Fair Credit Reporting Act. Although you generally can conduct reference checks on any job candidate, before you conduct a full background check on an applicant you generally need a signed waiver consenting to the check.

When conducting reference checks, remember you can search out individuals not listed by the applicant, particularly if your candidate avoids listing supervisors from recent positions.

When conducting background checks, use your applicant's Social Security number, rather than his or her name because some individuals change names through marriage and others intentionally change names to evade casual searches.

Next, cautiously decide those who can access employee and other confidential information. For example, while your payroll clerk needs to have access to employee time sheets, she doesn't need access to employee medical records, which should be kept in a locked file and accessed only by your most senior human resources official.

After the reference and background searches and before you give any employee access to confidential information, require that each employee sign a statement binding the employee to discretion when handling sensitive employee or company information. An effective agreement requires that each employee uses information solely for company-intended purposes and to neither use nor transfer confidential information during or after employment.

To avoid unintended losses, limit Internet access and flash drive use to employees who've passed through a probationary period and ask your IT department to monitor any documents sent offsite to Yahoo, hot mail or similar accounts and to secure all data bases and data storage.

Next, develop a consistently applied password termination procedure that ensures that employees leaving your company immediately forfeit access to proprietary company information. Because the loss of confidential employee and company information threatens all employees and because co-workers often see security breaches sliding beneath management's radar, help your employees understand why security breaches matter to them and give them easy, confidential methods for reporting suspicious activity.

Your safeguards won't be complete, however, until you fix your accounting department's revolving door. This fix might require that you overhaul your company's hiring practices or your accounting department manager's supervisory practices, or that you address toxic situations within your department, whether excessive workload or co-worker friction. Although you asked about identity theft, I worry about your department as a whole. You can't maintain productivity when your employees turn over every five months.

Lynne Curry is a local management trainer, consultant and syndicated columnist. Her advice and opinion column appears Mondays. Questions for her column may be faxed to her at 258-2157 or mailed to her c/o Anchorage Daily News, P.O. Box 149001, Anchorage 99514-9001. Her e-mail address is lynne@thegrowthcompany.net.

ADVERTISEMENT