HomeMy WebLinkAbout29-0526-26R STATE OF WASHINGTON
County of Jefferson
In the Matter of Adopting the Jefferson
County Artificial Intelligence Acceptable RESOLUTION NO. 2 9-0 5 2 6-2 6 R
Development and Use Policy
WHEREAS, generative artificial intelligence (AI)represents a significant leap forward in
technology, by generating novel text, images, and other content,which has the capacity to
transform the way Jefferson County conducts business and serves the public; and,
WHEREAS, generative AI can enhance human potential and creativity but must be
deployed and regulated carefully to mitigate and guard against a new generation of risks, harms,
and perpetuation of existing inequities; and,
WHEREAS, Jefferson County is committed to accuracy, reliability, and ethical outcomes
when adopting generative AI technology, and serving all of those who reside, work, and do
business in Jefferson County in a transparent, engaged, and equitable way; and,
WHEREAS, Jefferson County seeks to realize the potential benefits of generative AI
through the deployment of generative AI tools that improve the equitable and timely delivery of
services, while balancing the benefits and risks of these new technologies; and,
WHEREAS,a generative AI policy is necessary to govern the development, deployment,
management and use of generative AI use in Jefferson County government affairs in a thoughtful
manner that upholds the public trust, ensures safety and security, and promotes ethical standards;
NOW, THEREFORE, THE BOARD OF COUNTY COMMISSIONERS OF
JEFFERSON COUNTY,WASHINGTON, HEREBY RESOLVE AS FOLLOWS:
Section 1. Whereas Clauses are Findings of Fact. The Jefferson County Board of Commissioners
hereby adopts the above "Whereas"clauses as Findings of Fact.
Section 2. Purpose. The purpose of this resolution is to adopt the Jefferson County Artificial
Intelligence Acceptable Development and Use Policy (AI Policy).
Section 3. Adoption of the Jefferson County Artificial Intelligence Acceptable Development and
Use Policy. The AI Policy in Appendix A is hereby adopted.
Section 4. Repealing and Replacing Any Inconsistent Policy that Addresses the Topic of
this Policy. This Policy controls over any ordinance, other resolution or policy on the same
topic.
Section 5. Severability. If any section,subsection, sentence,clause,phrase or section of this Policy
or its application to any person or circumstance is held invalid, the remainder of this Policy or its
application to other persons or circumstances shall be fully valid and shall not be affected.
1
Section 7. Effective Date. The Policy becomes effective upon the date of adoption.
Section 8. SEPA Categorical Exemption. This policy is categorically exempt from the State
Environmental Policy Act under WAC 197-11-800 (19).
(SIGNATURES FOLLOW ON THE NEXT PAGE)
APPROVED and ADOPTED this ?-ic day of I , 2026.
JEFFERSO OUNTY BOARD OF
COM . I/ i 'S
,Ng'-
417 otti-rton, Chair
,, ,, »SOnrp,rt��<< ( 1 `
N
,,, ky ..COG'%
4F ,ISSI0 1,
SEAL: ' '.:o`s tiFc;. .. ei• senhour, Membe
M1 s % 1
. SEAL = 1j1 /i/
', • ;**,0 He. '� G udley-Nollette, Member
OF WASN**.'
i,a"g1ll 1111 .:�'''
KITES :
6 .0 6,047 S.2G 26
Care Gallaway,CM Date
Cler ,f the Board
Approved as to form only:
/4 y May 27,2026
Philip C. Hunsucker Date
Chief Civil Deputy Prosecuting Attorney
3
JEFFERSON
COUNTY
ARTIFICIAL
Version: May 26,
INTELLIGENCE
2026
ACCEPTABLE
DEVELOPMENT
AND USE POLICY
This AI Policy governs all uses of artificial
intelligence by or on behalf of Jefferson County,
Washington.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page ii of ii
TABLE OF CONTENTS
TABLE OF CONTENTS ii
(1) INTRODUCTION 1
(2) PURPOSES 1
(3) GUIDING PRINCIPLES AND VALUES 2
(4) DEFINITIONS 3
(5) APPLICABILITY OF THIS AI POLICY 7
(6) COMPLIANCE WITH EXISTING LAWS AND POLICIES 8
(7) PROHIBITED USES OF AN AI SYSTEM 8
(8) PUBLIC RECORDS ACT COMPLIANCE 10
(9) ARCHITECTURAL AND TECHNICAL STANDARDS 10
(10) ROLES AND RESPONSIBILITIES 11
(11) AI SYSTEM AND USE AND CASE APPROVAL PROCESS 13
(12) PROCEDURES 16
(13) CONSEQUENCES FOR NONCOMPLIANCE 18
(14) LIMITATIONS OF THIS AI POLICY 18
APPENDIX A: REFERENCES 20
APPENDIX B: RELEVANT COMPLIANCE REQUIREMENTS 22
APPENDIX C: 23
RECORDS PROTECTED FROM DISCLOSURE BY AN "OTHER STATUTE" THAT ARE
NOT TO BE USED IN AN AI SYSTEM 23
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 1 of 29
JEFFERSON COUNTY ARTIFICIAL INTELLIGENCE
ACCEPTABLE DEVELOPMENT AND USE POLICY
(1) INTRODUCTION
Artificial Intelligence (AI) technology is increasingly becoming an integral part of local
government operations, offering opportunities to enhance the efficiency and effectiveness
of public services. At the same time, the use of AI also presents ethical, legal, and social
challenges that require responsible management. This AI Policy provides a framework for
the effective and responsible use of AI systems within the County, to maximize the benefits
of these innovative tools while minimizing their potential risks to both the County and the
public.
(2)PURPOSES
The purposes of this AI Policy are to:
A. Ensure ethical and responsible development, deployment, and use of AI technology in the
County, ensuring they are in alignment with the principles of transparency, fairness,
accountability, and public trust.
B. Enable effective use of AI technology by providing clear guidance to the County personnel,
vendors, and other partners who work with AI systems.
C. Inform community members and other stakeholders about how the County is utilizing AI
technology and what measures it is taking to protect the public from potential adverse
consequences of these systems.
D. Promote responsible and ethical use of AI technology by defining the principles and values
that govern the application of this technology within the County.
E. Ensure the compliance of AI systems with all applicable federal, state, and local laws and
regulations as well as existing the County policies.
F. Assign roles and responsibilities related to the County's use of AI systems.
G. Establish processes that encourage effective and responsible use of AI systems.
H. Define prohibited uses of AI systems.
I. Specify measures which may be taken in the event of failure to comply with these policies.
This AI Policy may be updated from time to time to account for changes in AI technology, laws
and regulations, uses of AI systems within the County, and other considerations.
In addition,the Central Services Director may publish an AI User Guide to provide more detailed
guidance on how the requirements of this AI Policy is to be implemented.Unless otherwise stated,
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 2 of 29
any such additional guidance should be considered an extension of this Al Policy and carry the
same requirements for compliance.
(3)GUIDING PRINCIPLES AND VALUES
The County's AI development, deployment, and use of artificial intelligence systems shall be
guided by the following guiding principles and values:
(a) We expect to retain appropriate human agency and oversight, allowing for
intervention to prevent harm.
(b) We expect to use internal and external security testing of systems before
public release for high-risk artificial intelligence systems.
(c) We expect to protect data privacy and security.
(d) We expect to promote appropriate transparency for consumers when they
interact with artificial intelligence systems or products created by artificial
intelligence.
(e) We expect to ensure accountability, considering oversight, impact
assessment, auditability, and due diligence mechanisms.
(f) We expect to make AI accessible to all residents, including those with
disabilities or limited access.
(g) We expect to govern the deployment and maintenance of AI systems with
human oversight ensuring adherence to relevant laws and regulations and by
defining roles and responsibilities.
(h) We expect to implement measures to detect and mitigate biases in order to prevent
harm.
(i) We expect to continuously monitor and enhance AI systems based on feedback and
technological advancements.
(j) We expect proper management,quality,and stewardship of data used by AI systems.
(k) We expect the county will be one source of digital literacy among residents to
help them understand and engage with AI systems.
(1) We expect AI systems to be reliable, meet their objectives, and deliver
precise and dependable outcomes in their deployment contexts;
(m) We expect AI decisions to be understandable to those affected.
(n) We expect AI systems to prevent discrimination and bias, ensuring fair treatment for
all residents.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 3 of 29
(o) We expect AI systems should be developed and deployed with a human-
centered approach that evaluates their impact on the public.
(p) We expect technological innovation to be embraced responsibly while minimizing
environmental impacts.
(q) We expect AI systems to comply with all relevant laws and regulations.
(r) We expect privacy concerning personal data to be protected, while satisfying the
requirements of the Washington Public Records Act, chapter 42.56 RCW.
(s) We expect AI systems to comply with data protection laws.
(t) We expect AI systems not to cause harm and to prioritize the safety of
residents.
(u) We expect AI systems to be secure against unauthorized access and ensure consistent
performance.
(v) We expect the use of AI systems to be proactively communicated to the
public, ensuring that AI systems, their data sources, operational models, and
governing policies are understandable and documented.
(w) We expect Staff to be empowered to use AI in their roles through education, training,
and collaborations that promote participation and opportunity.
These guiding principles and values are the inspiration for this AI Policy,and AI users are expected
to incorporate these same motivations in the implementation of this AI Policy. While the ideal
course of action may not be obvious or practical in every circumstance, this AI Policy is designed
to offer guidance to help AI users responsively navigate the use of AI systems.
(4)DEFINITIONS
(a)"Artificial Intelligence"(or"Al")means a machine-based system that can, for
a given set of human-defined objectives, make predictions, recommendations
or decisions influencing real or virtual environments. Artificial intelligence
systems use machine and human-based inputs to:
(i) Perceive real and virtual environments;
(ii) Abstract such perceptions into models through analysis in an automated
manner; and,
(iii) Use a model to formulate options for information or action.
(b) "AI best practices" means the best practices described in National Cyber
Security Centre, Best Practices for Securing Data Used to Train& Operate
AI systems, Ver. 1.0 (May 2025).
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 4 of 29
(c) "AI model" means a set of programmed instructions that processes data to
perform tasks, make decisions, or solve problems within an AI system.
(d) "AI Policy" means this Jefferson County Artificial Intelligence
Acceptable Development and Use Policy.
(e) "AI System" means any machine-based system that, for any explicit or
implicit objective, infers from the inputs the system receives how to
generate outputs, including content, decisions, predictions, or
recommendations, that can influence physical or virtual environments and
includes any tool, software, process, workflow, or other system which is
based on AI or which uses an Al tool.
(f) "AI Tool" means a piece of software which provides AI functionality and
can be applied to a specific use case.
(g) "AI Use Case" means specific task or purpose for which an Al tool is used
or under consideration.
(h) "AI User" means any person using, developing, purchasing, configuring,
or maintaining any AI used by or for the County on its behalf, including
contractors, consultants, elected officials, employees, and volunteers.
(i) "AI User Guide" means a document which supplements an AI Policy with
more detailed guidance on how to implement this AI Policy.
(j) "Bias"means systematic tendencies that can exist within AI systems, often
stemming from flawed data, algorithms, or design processes, that may lead
to discriminatory or inaccurate outcomes affecting certain groups or
persons.
(k) "Central Services" means the County Central Services Department.
(1) "Central Services Director" means the person holding the title of Director
of Central Services or a delegee that has been delegated in writing.
(m) "Chatbot" means a computer program that simulates human conversation
through text or voice interactions.
(n) "Consequential decision" means a decision that has a material legal or
similarly significant effect on, or the cost of:
(i) Hiring or retention of a contractor, employee, vendor or volunteer;
(ii) Any budget decision;
(iii) The provision of any essential government service;
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 5 of 29
(iv) Health care (as defined in this AI Policy);
(v) Risk management, including but not limited to obtaining coverage for
any risks by an insurance company or a self-insurance program; or,
(vi) The provision of legal services.
(o) "County" means the County, Washington.
(p) "County Approved AI system" means an AI system approved for use by
AI users as specified in section 7.a.
(q) "County Information Systems" means all county information systems,
including but not limited to computers or servers owned or operated by the
County. For the avoidance of doubt, county operated systems include
information systems owned by another person that contain data, information,
programs or systems owned or controlled by the County such as cloud-based
information systems.
(r) "Data" means any digital representation of information, knowledge, facts,
concepts, data programs or instructions that are being prepared or have
been prepared in a formalized manner and are intended for use in a data
network, data program, data services, or data system.
(s) "Generative AI" means an AI system capable of generating text, images,
video, or other media in response to prompts.
(t) "Health care provider" means a person who is licensed, certified,
registered, or otherwise authorized by the law of this state to provide health
care in the ordinary course of business or practice of a profession.
(u) "Health care" means any care, service, or procedure provided by a health
care provider:
(i) To diagnose, treat, or maintain a patient's physical or mental condition;
or,
(ii)That affects the structure or any function of the human body.
(v)"Health care information" means all information about health care that is
protected from disclosure by the Health Insurance Portability and
Accountability Act of 1996 (HIPAA) Privacy Rule, 45 C.F.R. Parts 160 and
164, Chapter 70.02 RCW (Medical Records—Health Care Information
Access and Disclosure) or RCW 42.56.360 (Health care exemption from
disclosure of records under the Washington Public Records Act).
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 6 of 29
(w) "High-risk AI system" means any AI system that, when deployed, makes,
or is a substantial factor in making, a consequential decision. "High-risk
AI system" does not include an AI system if:
(i) The AI system is intended to:
(A) Perform a narrow procedural task;
(B) Detect decision-making patterns or deviations from prior
decision-making patterns and is not intended to replace or
influence a previously completed human assessment without
sufficient human review;
(ii) The AI system uses the following technologies, unless the
technologies, when deployed, make, or are a substantial factor in
making, a consequential decision:
(A) Anti-fraud technology that does not use facial recognition
technology;
(B) Anti-malware;
(C) Anti-virus;
(D) AI-enabled video games;
(E) Calculators;
(F) Cybersecurity;
(G) Databases;
(H) Data storage;
(I) Firewall;
(J) Internet domain registration;
(K) Internet website loading;
(L) Networking;
(M) Spam- filtering;
(N) Robocall-filtering;
(0) Spell-checking;
(P) Spreadsheets;
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 7 of 29
(Q) Web caching;
(R) Web hosting or any similar technology; or,
(S) Technology that communicates with consumers in natural language for the
purpose of providing users with information, making referrals or
recommendations, and answering questions and is subject to County policy
that prohibits generating content that is discriminatory or harmful.
(x) "IT" means the Jefferson County Information Technologies Department, a
division of Central Services.
(y) "Public Record" has the same meaning as in RCW 42.56.010(3).
(z) "Risk management" means coordinated activities to direct and control an
organization with regard to risk.
(aa) "Section" means a section of this AI Policy, unless there is clear language in
this AI Policy that a section of this AI Policy does not apply.
(bb)"Substantial factor" means a factor that:
(A) Assists in making a consequential decision;
(B) Is capable of altering the outcome of a consequential decision; and,
(C) Is generated by an AI system.
"Substantial factor" includes any use of an AI system to generate any content,
decision,prediction, or recommendation concerning consequential decision.
(cc) "Writing" has the same meaning as in RCW 42.56.010(4).
(5)APPLICABILITY OF THIS AI POLICY
(a) This AI Policy governs the development, procurement or use of any AI Systems (as
defined in this AI Policy) on any County Information System or for input of results
from an external AI System into County Information Systems.
(b) All County boards, commissions, committees, departments, and task forces
shall comply with this AI Policy.
(c) This AI Policy applies to:
(i) Agents, contractors, elected officials, employees, officers, vendors and
volunteers of the County who use or input data into County Information
Systems; and,
(ii) All AI users (as defined in this AI Policy).
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 8 of 29
(d)This AI Policy does not apply to any AI system which:
(i) Has been evaluated and determined in writing by the Central Services
Director to be safe for unrestricted usage;
(ii) Has AI features included in applications maintained by Central Services,
which are not part of the AI feature's core functionality or involve the use
of sensitive data; and,
(iii) That does not use or input data into County Information Systems.
(6)COMPLIANCE WITH EXISTING LAWS AND POLICIES
Development and use of AI systems shall comply with:
(a) All applicable federal, state, and local laws and regulations; and,
(b) All County policies, including but not limited to:
(i) Jefferson County Social Media Policy (Resolution No. 14-20, March 16,
2020).
(ii) Jefferson County Public Records Act Compliance Policy (Resolution No. 10-22,
February 28,2022).
(iii)Open Public Meeting Act Guidelines for Jefferson County Boards,
Commissions & Committees (Resolution No. 50-22, October 24, 2022).
(iv)Jefferson County Personnel Administration Manual (Resolution No. 19-0407-
25R, April 7, 2025).
(7)PROHIBITED USES OF AN AI SYSTEM
(a) The following AI systems are approved for use by the persons subject to this
AI Policy listed in sections 5 and 6, subject to the limitations in this section 7:
(i) Microsoft's Enterprise AI system called Co-Pilot(which is part of the Microsoft
365 suite of programs) is the preferred AI system to be used for generative AI that
is approved for use by AI users (as defined in this policy).
(ii) The Central Services Director shall maintain a list of AI systems that are
approved, being tested by the Central Services Department, or are
prohibited. AI users may only use AI systems that are authorized or are
being tested by the Central Services Department. The Central Services
Director shall publish the list on the County's web site.
(b)Use of an AI system on a County-owned computer, server or system that is not
on the list of AI systems approved and made available on the County's web site
is prohibited.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 9 of 29
(c)Use of an AI system on a County-owned computer, server or system that is on
the list of AI systems being tested for possible authorized use pursuant to
section (11) is authorized until testing is complete. Once testing is complete,
the Central Services Director shall determine whether such system shall be
added to either the list of AI systems that are approved or the list of AI systems
that are not approved.
(d)Use of any high-risk AI system(as defined in this AI Policy)requires enhanced
review and specific written approval before it can be added to the list of
approved AI Systems in section 7(a)(i).
(e)Use of an AI system on a County-owned computer, server or system to create
any deepfake, which is an image created by using machine learning to capture
and encode unique biometric characteristics of targets to combine the subject's
unique characteristics with the acquired knowledge of general human
expression in order to then synthesize the target's facial features, voice,
mannerisms, etc. is prohibited.
(f) Entry any of the following data into an AI system is prohibited:
(i) Personal financial information for any individual. This includes credit card
number, bank account number, PIN numbers, and any other financial
information.
(ii) Authentication information. Inputting any passwords, login credentials, or
other authentication information into an AI system is prohibited.
(iii) Personally Identifying Information. Inputting any personally identifying
information into an AI system is prohibited. Personally identifying
information includes name, address, phone number, email address, social
security number, passport number, driver's license number, and any other
information that can reasonably be used to identify an person.
(iv) Health care information (as defined in this AI Policy).
(v) Sensitive or confidential information. This includes any information that
could be used or disclosed to harm the County or its employees or
volunteers, or residents such as information about political affiliations,
religious beliefs, membership in a protected class, criminal history, or
information related to the County information system.
(vi) Any information exempted from disclosure by the Public Records Act,
chapter 42.56 RCW or some other federal or state statute, including but
not limited to:
(A) Attorney-client privileged records relating to representation of the
County by its attorneys. The attorney-client privileged records are
protect communications and advice between an attorney and their
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 10 of 29
client. RCW 5.60.060(2)(a) constitutes an "other statute' exemption
under RCW 42.56.070(1)
(B) Attorney work product records. Attorney work product records are:
"Records that are relevant to a controversy to which an agency is a
party but which records would not be available to another party under
the rules of pretrial discovery for causes pending in the superior courts
are exempt from disclosure under [the Public Records Act]." RCW
42.56.290.
(C) Autopsy records. Autopsy and post mortem reports and records are
confidential and exempt from examination by the public. RCW
68.50.105(1).
(D) Records related to juvenile offenses. RCW 13.50.050(1), (3).
(E) Records of a person confined in jail. RCW 70.48.100(2).
(F) Personal information in files maintained for County employees,
appointees, or elected officials of any public agency to the extent that
disclosure would violate their right to privacy. RCW 42.56.230(3).
(G) Specific intelligence information. Secret information, information
about an enemy, or conclusions drawn from such information or that
would disclose particular methods or procedures for gathering or
evaluating intelligence information. RCW 42.56.240(1).
(H) Specific investigative records. Information on active ongoing law
enforcement investigations. RCW 42.56.240(1).
(I) Records protected by an "other statute which exempts or prohibits
disclosure of specific information or records." RCW 42.56.070(1).
A list of"other statutes" is attached as Appendix D.
(8) PUBLIC RECORDS ACT COMPLIANCE
Any product created by any AI system necessarily will be a "public record," as defined in RCW
42.56.010(3). All public records shall be managed in compliance with chapter 40.14 RCW
(Preservation And Destruction of Public Records), chapter 42.56 RCW(Public Records Act), and
the County's most recent version of the Jefferson County Public Records Act Compliance Policy.
(9)ARCHITECTURAL AND TECHNICAL STANDARDS
The architectural and technical standards associated with the enterprise use of AI systems shall be
maintained by IT.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 11 of 29
(10) ROLES AND RESPONSIBILITIES
The following persons and groups are responsible for the duties involved in implementing this
AI Policy, as described below:
(a)Central Services Director.
The Central Services Director shall be responsible for:
(i) Providing a public report at least annually to the Board of County Commissioners on
County AI usage.
(ii) Developing this AI Policy and additional guidance.
(iii) Coordinating AI initiatives across departments and teams.
(iv) Overseeing compliance with laws, regulations and County policies.
(v) Providing guidance to AI users across the organization.
(vi) Convening and overseeing the AI Review Committee.
(vii) Leading the AI review process.
(viii)Directing technology resources, policies, projects, and services.
(ix) Reviewing the AI Review Committee recommendations on oversight and
guidance on AI initiatives within the County.
(x) Facilitating collaboration between teams and departments for successful
implementation of this AI Policy.
(xi) Overseeing enterprise security infrastructure and cybersecurity
operations.
(xii) Maintaining security policies, procedures, standards, and guidelines.
(xiii)Monitoring compliance with security policies and related requirements.
(xiv)Ensuring accurate data sensitivity classification and protections.
(xv) Advising on compliance on AI usage.
(xvi)Identifying legal issues and risks related to AI usage.
(xvii) Investigating alleged violations of this AI Policy and recommend
corrective actions.
(b)AI Review Committee
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 12 of 29
The Board of County Commissioners shall establish an AI Review Committee with
department representatives which shall be make recommendations to the Central Services
Director on oversight and guidance on AI initiatives within the County.
The AI Review Committee shall review and consider updates to this AI Policy, along with
the Central Services Director, at least annually to reflect technological advancements and
evolving community needs.
The AI Review Committee shall be responsible for making recommendations to the Central
Services Director on the following topics:
(i) AI systems being considered for use by the County.
(ii) Ethical concerns and conflicts.
(iii) Policy and guidance updates.
(c) County Administrator
The County Administrator shall be responsible for:
(i) Approving proposed changes to this AI Policy.
(ii) Making a final determination whether to allow AI use cases which involve
substantial risks of harm or other negative consequences.
(iii) Enforcing corrective action for violations of this AI Policy.
(d)Electeds and Department Heads
Electeds and department heads or a delegee shall be responsible for:
(i) Ensuring employee, contractor and vendor compliance with this AI
Policy.
(ii) Integrating AI systems into department operations that comply with this
AI Policy.
(iii) Facilitating training for staff on this AI Policy and AI best practices (as defined in
this AI Policy).
Unless otherwise specified, the specific officials listed above may delegate to one or more
persons to act on their behalf with respect to this AI Policy, and in such cases those
designees are understood to inherit the same authorities and obligations as the named
officials.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 13 of 29
(e)AI Users
(i) All AI users are responsible for complying with the requirements of this AI
Policy.
(ii) All AI users have the responsibility to verify the accuracy of any
information acquired through the use of AI systems before using that
information in any final, published, or production documents.
(11) AI SYSTEM AND USE AND CASE APPROVAL PROCESS
(a) AI Systems Review Process
The Central Services Director shall establish a process under which all AI systems and AI
Use Cases are subject to thorough testing to determine their compliance with this AI Policy
prior to their implementation. The testing process shall:
(i) Confirm compliance with the specific requirements and prohibitions established
under this AI Policy;
(ii) Consider the relative benefits and risks of each system or use case and determine
whether or not approval is reasonable and aligned with the values and principles
in this AI Policy;
(iii) Specify the intended use cases of those systems and whether or not other use cases
require additional review;
(iv) Document the results of each review using a standard template, which results
shall be retained for either the full lifespan of the AI system or use case or the
retention period required under law for similar documents (whichever is
longer).
(b) Determination of High Risk Potential Negative Impacts
(i) The Central Services Director shall create a standard for determining whether
or not a particular AI system or AI use case has a high risk of potential negative
impacts to any relevant person, group, or organization.
(ii) A high-risk determination, that AI system or use case shall be presented to the
full AI Review Committee for approval.
(iii) Lower-risk AI systems and use cases may be approved by the Central Services
Director at their discretion.
(iv) The Central Services Director shall revisit all previously-approved AI systems
and use cases at least annually, or sooner in the event of substantial
modifications (such as a major software upgrade or change in scope), and
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 14 of 29
confirm in writing to the County Administrator the continued compliance and
reasonableness of the AI system or use case.
(c)Monitoring, Evaluation, and Accountability
(i) The Central Services Director shall be responsible for implementing AI
systems to monitor AI system performance, effectiveness, and policy
compliance. The data collected from these AI systems shall be periodically
reviewed to evaluate the effectiveness of AI systems and their impacts on the
community.
(ii) The Central Services Director shall establish procedures and protocols for
responding to failures of AI systems and violations of this AI Policy, including
corrective actions with regard to both the AI systems themselves and the
persons and organizations involved.
(iii) Upon the recommendation of the Central Services Director, , or County
Administrator, independent audits shall be conducted to review AI systems for
compliance with policies and ethical standards. Findings from audits and
evaluations shall be used to refine AI policies, improve AI system functionalities,
and determine any additional training or accountability requirements.
(d)Data Management, Privacy, and Retention
All AI systems shall comply with applicable data protection laws, regulations, and
policies to safeguard data protected by this AI Policy.
(e) Mitigation of Bias and Human Oversight
All AI users shall be responsible for taking steps to mitigate potential biases (including but
not limited to biases related to protected characteristics such as race, gender, sexual
orientation, national origin, disability, or language) in AI systems they interact with, in
accordance with training and recommendations provided by the Central Services
Director.
(f) Transparency and Explainability
Upon the consideration or introduction of a new AI system which is likely to have
major public impact, the Central Services Director shall ensure that key information
is provided to affected groups and other stakeholders in a timely manner. Such
information shall be provided in multiple formats or languages if necessary, consistent
with the County's practice in communicating
To the greatest extent possible, AI systems should provide clear and understandable
explanations for their decisions and outputs, particularly in cases where erroneous
results may create a risk of substantial negative impacts.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 15 of 29
(g)Training
(i) All users shall be provided with regular training on AI technologies,
ethical considerations, and compliance requirements to ensure
knowledgeable and responsible use of AI systems, as recommended by the
Central Services Director.
(ii) The Central Services Director shall develop specific training requirements and
content for users granted access to high-risk AI systems and associated data,
focusing on compliance with this AI Policy and other associated laws,
regulations, policies, and AI best practices.
(iii) These trainings shall be updated on a regular basis to ensure their accuracy and
relevance, and users' continued access to high-risk AI systems and data shall
be contingent upon completion of additional required trainings determined by
the Central Services Director.
(h)Vendors and Third Parties
(i) All vendors and other third parties who provide or interact with AI systems shall
be required to comply with this and all other applicable policies, and this
compliance shall be explicitly included in all relevant contracts and similar
agreements.
(ii) All technology vendors shall be required to disclose whether and how AI is used
in their products and services, and what mechanisms they provide to allow for
auditing these AI systems. These disclosures shall be provided using a standard
form developed and maintained by the Central Services Director and required in
all technology procurements.
(iii) Vendors shall be evaluated based on their commitment to responsible AI
development and their history of adherence to ethical standards, and preference
in procurement decisions shall be given to vendors which can effectively
provide transparency into their AI systems and practices to both the County
and the public.
(i) Labeling of AI-generated Content
All content generated by AI systems and presented to the public shall be clearly labeled as
such. This shall include all text, audio, image, and video content, as well as interactive AI
systems such as chatbots and automated decision-making tools.
All persons involved in disseminating content generated by an AI system on behalf of the
County shall be responsible for ensuring the accuracy of such content and its appropriate
labeling.
The Central Services Director or designee shall establish standard mechanisms for the County
personnel and members of the public to report violations of this labeling requirement.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 16 of 29
(12) PROCEDURES
(a)Attribution
(i) The use of AI systems and the resulting product(s) shall be attributed,
referenced, and cited in any electronic or paper material produced and
published by anyone subject to this AI Policy.
(ii) Attribution should include a description of the source application, how it
was used, how the material was edited, by whom, and the date. For
example:
"Microsoft Co-Pilot was used to generate the charts and data referenced above. The
content was reviewed and edited before being published by Sam Smith, Jefferson
County Public Works Department, on 04/15/2026."
(b)Intellectual Property
Content produced by AI systems may implicate intellectual property rights and likely will
include copyrighted material. AI systems shall be "trained"using Data(text, images, etc.)
that has been sourced from the internet without regard for copyright or licensing terms. It
is extremely difficult to determine what content was used to train an AI system, and
difficult to verify whether AI-generated content is wholly original or only a slight
stylization of existing copyrighted material. Nevertheless, County AI users are required to
perform due diligence to ensure that no copyrighted material is published by the County
without proper attribution or without obtaining proper rights.
(c)Validation Required
(i) Complex algorithms of AI systems exponentially increase risk when
incomplete or inaccurate data is involved. AI systems shall be validated
and regularly assessed to ensure completeness and accuracy. Results from
decisions, code, or research supported by AI systems should consistently
align with those of a human subject matter expert.
(ii) AI users shall verify the accuracy of any information acquired through the
use of AI systems before using that information in any final, published, or
production documents. If AI users are uncertain about the accuracy of the
obtained information, they should consult their supervisor or seek advice
from a IT.
(iii) AI users shall independently verify any quotes or references generated by
AI systems. AI users shall not assume that a quote or reference is accurate,
or real. AI systems rarely act as if they are uncertain,making false answers
difficult to spot. AI systems can generate:
(A) Fabricated content, sometimes called "hallucinations." This is a
phenomenon where an AI system, particularly those using large
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 17 of 29
language models, generates false, inaccurate, or illogical
information while presenting it in a confident, authoritative, and
convincing manner. Fabricated content occurs when an AI system
creates synthetic data, fabricates facts, or invents nonexistent
sources. An AI system may invent fake academic papers, legal
cases, scientific studies, or personal facts.
(B) Factual Errors: Stating incorrect facts, such as "Einstein won two
Nobel Prizes."
(C) Image Distortions: AI systems can create anatomically incorrect
figures (e.g., too many fingers).
Verification shall include cross-referencing sources included in the AI output, or
independently verifying dates, names and events in peer reviewed or authoritative
published literature on the internet or printed material.
(d)Decision Making
County departments shall utilize AI systems to enhance efficiency and effectiveness. AI
systems can be used for idea generation and as one source of information when researching
a topic. AI systems products shall be human reviewed and edited before usage in any final,
published, or production documents. This is particularly important when the content is
public facing. AI users shall be responsible for their use of AI systems and the application
of any content or product in work tasks generated by AI systems.
(e)Equity and Inclusion
(i) While AI systems can reduce workloads, support capacity, and increase
accessibility,the generated content reflects the cultural,economic,and social biases
of the source materials used for training. The algorithms applied can be a source of
bias as well. Applying principles from the equity and empowerment lens, AI users
should thoroughly review any content generated by AI systems to ensure that any
instances of bias, or potentially offensive or harmful material, is changed or
removed.
(ii) When it comes to the adoption of AI systems, the County's goal is to eliminate
digital disparities and ensure that persons who belong to a protected class and those
impacted by language or other accessibility barriers have equal access to and
benefit from the County programs, activities,benefits,and services. To uphold this
commitment,the County applies the equity and empowerment lens to address race,
color, national origin, disability, religion, age, gender, sexual orientation, gender
identity and expression, marital status, veteran status, source of income, or any
other basis prohibited by federal, state, or local law.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 18 of 29
(f) Final Requirements
(i) Under no circumstances is a County employee authorized to engage in any activity
that is illegal under local, state, federal, or local law while utilizing County-owned
resources, including County Information Systems.
(ii) County employees shall comply with all applicable County policies and are
required to read and understand them. Responsibilities for protecting County
information protected by an exemption in the Public Records Act do not end at the
termination of employment.
(13) CONSEQUENCES FOR NONCOMPLIANCE
(a)Department heads shall ensure compliance with this AI Policy and are
accountable for any AI systems deployed by their department.
(b)Violations of this AI Policy shall be grounds for disciplinary action under the
current version of the County's standards of conduct policy in Appendix C of
to the Jefferson County Personnel Administration Manual, up to and including
termination of employment; and enforcement action which shall include civil
or criminal penalties.
(14) LIMITATIONS OF THIS AI POLICY1
(a) Nothing in this AI Policy restricts the County or any other person's ability
to:
(i) Comply with federal, state, or municipal laws, ordinances, or
regulations;
(ii) Comply with a civil, criminal, or regulatory inquiry, investigation,
subpoena, or summons by a federal, a state, a municipal, or other
governmental authority;
(iii) Cooperate with a law enforcement agency concerning conduct or
activity that the developer, deployer, or other person reasonably and in
good faith believes may violate federal, state, or municipal laws,
ordinances, or regulations;
(iv) Investigate, establish, exercise, prepare for, or defend legal claims;
(v) Take immediate steps to protect an interest that is essential for the life
or physical safety of a consumer or another person;
(vi) By any means other than the use of facial recognition technology,
prevent, detect, protect against, or respond to security incidents,
Adapted from the Colorado Al Act,Colo.Rev.Stat. §6-1-1705(2026).
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 19 of 29
identity theft, fraud, harassment, malicious or deceptive activities, or
illegal activity; investigate, report, or prosecute the persons
responsible for any such action; or preserve the integrity or security of
AI systems; or,
(vii) Assist any other person with any of the obligations imposed under this
AI Policy.
(b) Nothing in this AI Policy restricts the Central Services Department from
conducting research, testing, and development activities regarding an AI
system or AI model, other than testing conducted under real-world conditions,
before an AI system or AI model is deployed or put into service by the
County;
(c)Nothing in this AI Policy imposes any obligation on any person that adversely
affects their rights or freedoms, including the rights to freedom of speech or
freedom of the press that are guaranteed in:
(i) The first amendment to the United States constitution; or,
(ii) Section Article I, Section 5 of the Washington constitution.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 20 of 29
APPENDIX A: REFERENCES
Reference To sic Citation
Federal Law
National Artificial Intelligence Initiative Shaping AI 15 U.S.C. section
Act of 2020 (P.L. 116-283) development and use in 9401 et. seq.
the United States
Health Insurance Portability and Protection of heath 45 C.F.R. Parts 160
Accountability Act of 1996 (HIPAA) information and 164_.
Privac Rule
Washington Law
Protection of the Right to Privacy Protection of privacy Chapter 9.73 RCW
Preservation and Destruction of Public Rules for preservation Chapter 40.14 RCW
Records and destruction of
public records
Washington Public Records Act Promote open Chapter 42.56
government RCW
Health care exemption from disclosure of Protection of heath RCW 42.56.360.
records under the Washington Public information
Records Act
Medical Records—Health Care Protection of heath Chapter 70.02 RCW.
Information Access and Disclosure Law information
SHB 1205 (2025) Reenacts and amends See the URL in the
RCW 9A.60.0 10 and footnote below.2
9A.60.045 and makes it
a crime to knowingly
distribute a forged
digital likeness of
another person to
defraud, harass,
threaten, or intimidate
another, or for an
unlawful .0 .ose
Other References and Standards
National Cyber Security Centre, Best Best Practices for See the URL in the
Practices for Securing Data Used to development and use of footnote below.3
Train& Operate AI systems, (Ver. 1.0 AI systems
May 2025)
National Institute of Standards and Standards for use of AI See the URL in the
Technology, Artificial Intelligence Risk systems footnote below.4
2 https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bills/Session%20Laws/House/1205-S.SL.pdf,Accessed April
11,2026.
https://media.defense.gov/2025/May/22/2003720601/-1/-1/0/CSI AI DATA SECURITY.PDF, Accessed April
12,2026.
4 https://doi.org/10.6028/NIST.AI.100-1,Accessed April 11,2026.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 21 of 29
Reference l opic ('nation
Management Framework (Al RMF 1.0
2023)
Washington State Artificial Intelligence ESSB 5838 (2024) See the URL in the
Task Force's Interim Report(December established the footnote below.5
1, 2025) Washington State
Artificial Intelligence
Task Force to evaluate
AI development, use
and risks
Mark H. Francis and Ashwini Jarrala, Washington State See the URL in the
Legal Practitioner's Guide to AI & Artificial Intelligence footnote below.6
Hallucinations(February 16, 2026) Task Force companion
report
Colorado's AI Act(March 26, 2026) Regulation of AI Colo. Rev. Stat. § 6-
1-1701 et. seq. See
the URL in the
footnote below.
5https://agportal-s3 bucket.s3.us-west-2.amazonaws.com/AI%20Task%20Force/WA%20AI%20Task%20Force%20-
%20Literature%20Review%20of%20AI%20Risks%20and%200pportunities.pdf?Versionld=2I mmRG ns5c I ZqxE
tRqJtYuwtg7eC9q,Accessed April 1,2026.
6 https://nationalcenterforstatecourts.app.box.com/v/Legal-practitioner-guide-AI,Accessed April 1,2026.
'https://practicalcompl iance.thomsonreuters.com/Browse/Home/Jurisdiction s/U n itedStates/Colorado/ColoradoStatut
es?guid=NBB934F3017C E 11 EF9141 A71 BA98479C6&originationContext=documenttoc&transitionType=Default
&contextData=(sc.Default)&firstPage=true,Accessed April 15,2026.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 22 of 29
APPENDIX B: RELEVANT COMPLIANCE REQUIREMENTS
This appendix provides references to applicable key regulations and standards. This appendix does
not replace the authoritative source and is only a reference to assist with further research. Please
use the Compliance Standard and Section No. to further research the entirety of the regulation,
framework or standard from the authoritative source.
Compliance Location Description
Standard
HIPAA 45 CFR 164,Subpart C Security Standards for the Protection
of Electronic Protected Health
Information.
45 CFR 164.316 Policies and procedures and
documentation requirements.
PCI DSS v3.2 12.2 at page 295 Acceptable Uses of the Technology.
(Jun. 2024)
NIST CSF 2.0 Information Protection Processes and
Procedures.
(Feb. 2024)
NIST 800-536, AI system Use Notification.
Revision 5 AC-8 at page 40
(Sep. 2020)
Various sections Policies and Procedures.
PL-4 at page 197 Rules of Behavior.
PS-6 at page 226 Access Agreements.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 23 of 29
APPENDIX C:
RECORDS PROTECTED FROM DISCLOSURE BY AN "OTHER
STATUTE" THAT ARE NOT TO BE USED IN AN AI SYSTEM
[ATTACHED]
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 24 of 29
[This page intentionally left blank]
Page 25 of 29
APPENDIX C
List of Other Statutes Exempting Disclosure under the
Washington Public Records Act (Chapter 42.56 RCW)
RCW 42.56.070(2)requires an agency to:
publish and maintain a current list containing every law, other than those listed in the
PRA,that the agency believes exempts or prohibits disclosure of specific information or
records of the agency.An agency's failure to list an exemption shall not affect the
efficacy of any exemption.
Washington State Statutes
RCW 2.64.111 Judicial conduct commission investigations of judges and initial
proceedings
RCW 4.24.550 Information on sex offenders
RCW 4.24.641 and.611 Trade secrets and confidential research,development or
commercial information re products or business methods
RCW 5.60.060 Privileged communications
RCW 5.60.070;RC W Mediation records
7.07.070
RCW 7.68.140 Victims' compensation claims
RCW 7.69A.030(4) Name,address and photograph of child victim or child witness
RCW 7.69A.050 Child victims and witnesses of certain crimes—protection of
address
RCW 7.75.050 Records of Dispute Resolution Centers
RCW 9.02.100 Reproductive privacy
RCW 9.41.097(2) Mental health information re persons buying pistols or applying
for CPLs
RCW 9.41.129 Concealed pistol license applications
RCW 9.73.230 Name of confidential informants in written report on wire
tapping
RCW 9.51.050 Disclosing transaction of grand jury
RCW 9.51.060 Disclosure of grand jury deposition
RCW 9.73.090(1)(c) Prohibition on disclosure of law enforcement dash cam videos
until final disposition of litigation
RCW 9A.44.138 Offender registration information given to high school or
institution of higher education re an employee or student
RCW 9A.82.170 Financial institution records re criminal profiteering act
RCW 10.27.090 Grand jury testimony/evidence
RCW 10.27.160 Grand jury reports—release to public only by judicial order
RCW 10.52.100 Records identifying child victims of sexual assault
Information re victims, next of kin, or witnesses requesting notice
RCW 10.77.205 of release of person found not guilty of a sex,violent,or felony
harassment offense by reason of criminal insanity and the notice
itself
Page 26 of 29
RCW 10.77.210 Records of persons committed for criminal insanity
RCW 10.97.040 Criminal history information released must include disposition,
with some exceptions
RCW 10.97.050 Conviction and criminal history information
RCW 10.97.060 Deletion of certain criminal history record information,
conditions
RCW 10.97.070 Disclosure of identity of suspect to victim
RCW 10.97.080 Inspection of criminal record by subject
RCW 10.97.130 Information about victims of sexual assault under age eighteen
RCW 10.101.020(3) Information given by an accused regarding determination for
indigent defense
RCW 13.34.115 Court dependency proceedings
RCW 13.40.217 Juveniles adjudicated of sex offenses—release of information
RCW 13.50.010 Maintenance of and access to juvenile records
RCW 13.50.050 Juvenile offender records
RCW 13.50.100 Juvenile/children records not relating to offenses
RCW 13.60.020 Missing children or endangered person information
RC W 18.04.405 Confidentiality of information gained by CPA
RCW 18.19.060 Notification to clients by counselors
RCW 18.19.180 Confidential communications with counselors
RCW 19.215.020 Destruction of personal health and financial information
RCW 19.34.240(3) Private digital signature keys
RCW 19.215.030 Compliance with federal rules
RCW 26.04.175 Name and address of domestic violence victim in marriage
records
RCW 26.12.170 Reports of child abuse/neglect with courts
RCW 26.23.050 Child support orders
RCW 26.23.120 Child support records
RCW 26.26.041 Uniform Parentage Act—protection of participants
RCW 26.26.450 Confidentiality of genetic testing
RCW 26.33.330 Sealed court adoption records
RCW 26.33.340 Agency adoption records
RCW 26.33.343 Access to adoption records by confidential intermediary
RCW 26.33.380 Adoption—identity of birth parents confidential
RCW 26.44.010 Privacy of reports on child abuse and neglect
RCW 26.44.031 Information related to reports of child abuse or neglect
RCW 26.44.125 Reports,reviews and hearings related to a review of abuse finding
RCW 27.53.070 Records identifying the location of archaeological sites
RCW 29A.08.720 Voter registration records—place of registration and any decision
not to register to vote confidential
RCW 29A.08.710 Voter registration records—certain information exempt
RCW 35.102.145 Municipal business and occupation tax— local ordinance can
protect return or tax information
Page 27 of 29
RCW 36.28A.060(8) Tactical and intelligence information provided to WASPC
Alternative public works-trade secrets or other proprietary
information submitted by bidder in connection with an
RCW 39.10.470(2) alternative public works transaction if data identified and reasons
stated in writing
RCW 39.10.470(3) Alternative public works—proposals submitted by design-build
finalists until notification of highest scoring finalist is made
RCW 42.23.070(4) Municipal officer disclosure of confidential information
prohibited
RCW 42.41.030(7) Identity of local government whistleblower
RCW 42.41.045 Non-disclosure of protected information (whistleblower)
RCW 43.43.762 Contents of statewide criminal street gang database
RCW 46.12.635 Vehicle registration
RCW 46.52.065 State toxicologist records relating to analyses of blood samples
RCW 46.52.080 Traffic accident reports—confidentiality
RCW 46.52.083 Traffic accident reports—available to interested parties
RCW 46.52.120 Traffic crimes and infractions—confidential use by police and
courts
RCW 46.52.130(2) Abstract of driving record— limited disclosure
RCW 48.62.101 Local government insurance/risk management liability reserve
funds established to settle claims
RCW 50.13.060 Access to employment security records by local government
agencies
RCW 50.13.100 Disclosure of confidential employment security records allowed if
identifying information deleted or with consent
RCW 51.28.070 Worker's compensation records confidential— limited disclosure
RCW 51.36.060 Physician information on injured workers
RCW 60.70.040 No duty to disclose record of common law lien
RCW 68.50.105 Autopsy reports—confidential—limited disclosure
RCW 68.50.320 Dental identification records—available to law enforcement
agencies
Ch.70.02 RCW Medical records—access and disclosure—entire chapter
(information from HC providers)
RCW 70.05.170 Child mortality reviews by local health departments
RCW 70.24.022 Public health agency information regarding sexually transmitted
disease investigations-confidential
RCW 70.24.024 Transcripts and records of hearings regarding sexually
transmitted diseases
RCW 70.28.020 Local health department TB records—confidential
RCW 70.41.200 Hospital quality improvement committee records and
accreditation reports
RCW 70.48.100 Jail records and booking photos
RCW 70.58.055 Birth certificates—certain information confidential
RCW 70.58.104 Vital records,research confidentiality safeguards
Page 28 of 29
RCW 70.94.205 Washington Clean Air Act—confidentiality of data.
RCW 70.96A.150 Registration and other records of alcohol and drug abuse
treatment programs
RCW 70.123.075 Client records of domestic violence programs
RCW 70.125.065 Records of community sexual assault program and underserved
populations provider in discovery
RCW 71.05.425 Notice of release or transfer of committed person after offense
dismissal
RCW 71.05.445 Release of mental health information to Dept. of Corrections
RCW 71.05.620 Access to court records related to mental health cases under
chapter 71.05 RCW
RCW 71.24.035(5)(g) Mental health information system—state, county and regional
support networks—confidentiality of client records
RCW 71.34.335 Mental health treatment of minors—records confidential
RCW 71 A.14.070 Records regarding developmental disability—confidentiality
RCW 72.09.345 Notice to public about sex offenders—department of corrections
access to information
RCW 72.09.585 Disclosure of inmate records to local agencies—confidentiality
RCW 73.04.030 Veterans discharge papers exemption (see related RCW
42.56.440)
RCW 74.04.060 Applicants and recipients of public assistance
RCW 74.04.520 Food stamp program confidentiality
RCW 74.13.075(5) Juvenile's status as a sexually aggressive youth and related info
RCW 74.13.280 Children in out-of-home placements - confidentiality
RCW 74.20.280 Child support enforcement—local agency cooperation,
information
RCW 74.34.095 Abuse of vulnerable adults-confidentiality of investigations and
reports
RCW 82.32.330 Disclosure of tax information
RCW 84.36.389 Confidential income data in property tax records held by assessor
RCW 84.40.020 Confidential income data supplied to assessor regarding real
property
Page 29 of 29
Selected Federal Confidentiality Statutes and Rules
18 USC§2721 -2725 DriverandLicense Plate Information
20 USC§ 1232g Family Education Rights and Privacy Act
23 USC§409 Evidenceofcertainaccidentreports
42 USC 290dd-2 Confidentiality of Substance Abuse Records
42 USC§405(c)(2)(C)(viii)(I) Limits onUse and Disclosure of Social Security Numbers.
42 USC 654(26) State Plans for Child Support
42 USC 671(a)(8) State Plans for Foster Care and Adoption Assistance
42 USC 1396a(7) State Plans for Medical Assistance
7CFR272.1(c) Food Stamp Applicants and Recipients
34 CFR 361.38 State Vocational Rehabilitation Services Programs
42 CFR Part 2(2.1 -2.67) Confidentiality of Alcohol and Drug Abuse Patient Records
42 CFR 431.300-307 Safeguarding Information on Applicants and Recipients of
Medical Assistance
42 CFR 483.420 Client Protections for Intermediate Care Facilities for the
Mentally Retarded
42 CFR 5106a Grants to States for Child Abuse and Neglect Prevention and
Treatment Programs
45 CFR 160-164 HIPPA Privacy Rule
46 CFR 40.321 USCG regulations regarding confidentiality
28 USC§534(b) Information from the FBI
5 USC§552(a) SSN #& Passport#
26 USC§6103(a) Taxpayer information
42 USC§12112(d)(3) Employee ADA accommodations
17 USC§102, 301, and 106(1) Federal Copyright Act