City Council:
AN ORDINANCE ADOPTING THE CITY OF
MOUNT VERNON POLICY FOR SAFEGUARDING
PERSONALLY IDENTIFIABLE INFORMATION (PII)
IN COMPLIANCE WITH THE NEW YORK STATE
SHIELD ACT, HIPAA, THE NEW YORK PERSONAL
PRIVACY PROTECTION LAW, AND OTHER
APPLICABLE PRIVACY LAWS
Whereas, in correspondence dated July 9, 2026, the Commissioner of the Department of Management Services requested that the City Council adopt the City of Mount Vernon Policy for Safeguarding Personally Identifiable Information (PII) to establish uniform administrative, technical, and physical safeguards for the protection of confidential and sensitive information maintained by the City; and
Whereas, the City of Mount Vernon collects, processes, stores, transmits, and maintains personally identifiable information relating to residents, employees, contractors, vendors, volunteers, and visitors while providing municipal services and carrying out governmental functions; and
Whereas, the New York State Stop Hacks and Improve Electronic Data Security (SHIELD) Act requires public entities and organizations that own or license private information of New York residents to implement reasonable administrative, technical, and physical safeguards to protect such information from unauthorized access, disclosure, alteration, or destruction; and
Whereas, the proposed Policy is further designed to comply with the Health Insurance Portability and Accountability Act (HIPAA), the New York Personal Privacy Protection Law, applicable provisions of the New York Freedom of Information Law (FOIL), and other applicable federal and state privacy and information security laws; and
Whereas, the proposed Policy complements the City’s existing Computer System Security Breach Notification Policy adopted pursuant to Section 208 of the New York State Technology Law by establishing preventative safeguards intended to reduce the likelihood of unauthorized access or security incidents before they occur; and
Whereas, the proposed Policy establishes comprehensive standards governing the identification, classification, collection, use, storage, transmission, access, retention, and disposal of Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (Sensitive PII), including information protected under HIPAA; and
Whereas, the Policy adopts the GovEx Open Data Privacy Framework to classify information as Open, Sensitive, or Restricted, thereby providing City employees with consistent guidance for the proper handling and protection of City information assets; and
Whereas, the Policy requires appropriate administrative, technical, and physical safeguards including, but not limited to, encryption of sensitive information, multi-factor authentication, secure file storage utilizing approved City platforms, locked physical storage, least-privilege access controls, role-based access controls administered through Microsoft 365 and Microsoft Entra ID, quarterly user access reviews, privileged account management, audit logging, monitoring, and secure records management practices; and
Whereas, the Policy establishes standardized procedures applicable to all City departments, elected officials, officers, employees, contractors, consultants, interns, volunteers, and any other individuals authorized to access City information systems containing Personally Identifiable Information; and
Whereas, the City Council finds that adopting a comprehensive Policy for Safeguarding Personally Identifiable Information is necessary to protect individuals’ privacy, reduce the risk of identity theft and unauthorized disclosure of confidential information, strengthen cybersecurity practices, promote accountability, and ensure compliance with applicable federal and state privacy laws.
NOW, THEREFORE, BE IT ORDAINED BY THE CITY COUNCIL OF THE CITY OF MOUNT VERNON, NEW YORK, AS FOLLOWS:
Section 1. Adoption of Policy. The City Council hereby adopts the City of Mount Vernon Policy for Safeguarding Personally Identifiable Information (PII), attached hereto and incorporated herein by reference as though fully set forth, as the official policy governing the protection, handling, storage, transmission, retention, and disposal of Personally Identifiable Information maintained by the City of Mount Vernon.
Section 2. Purpose. The purpose of this Policy is to establish uniform administrative, technical, and physical safeguards that protect Personally Identifiable Information from unauthorized access, disclosure, misuse, alteration, destruction, or loss while ensuring compliance with the New York State SHIELD Act, HIPAA, the New York Personal Privacy Protection Law, the Freedom of Information Law, and other applicable federal and state laws.
Section 3. Scope and Applicability. This Policy shall apply to all City departments, boards, commissions, agencies, elected officials, officers, employees, contractors, consultants, interns, volunteers, temporary personnel, and any other individuals or entities authorized to access, process, maintain, or transmit Personally Identifiable Information on behalf of the City.
Section 4. Minimum Information Security Standards. The Department of Management Services shall administer and enforce the Policy, including the implementation and maintenance of reasonable administrative, technical, and physical safeguards, including but not limited to:
A. Data Classification
• Classification of City information as Open, Sensitive, or Restricted utilizing the GovEx Open Data Privacy Framework.
B. Access Controls
• Implementation of least-privilege and role-based access controls (RBAC);
• Quarterly user access reviews and recertification;
• Joiner-Mover-Leaver access management procedures coordinated with the Department of Human Resources.
C. Technical Safeguards
• Encryption of sensitive information where appropriate;
• Multi-factor authentication for authorized systems;
• Secure storage utilizing approved City technologies, including Microsoft SharePoint and OneDrive;
• Administrative account protections, including separation of duties, inventory management, and enhanced monitoring.
D. Physical Safeguards
• Secure physical storage of records containing Personally Identifiable Information;
• Protection against unauthorized physical access.
E. Monitoring and Auditing
• Maintenance of audit logs for systems storing Personally Identifiable Information;
• Periodic monitoring and review of system activity to identify unauthorized access or anomalous behavior.
Section 5. Administration. The Commissioner of the Department of Management Services, or the Commissioner’s designee, shall be responsible for administering, implementing, monitoring, updating, and enforcing this Policy and may establish administrative procedures, standards, and technical controls necessary to carry out its provisions.
Section 6. Departmental Compliance. All City departments shall comply with the requirements of the Policy and shall cooperate with the Department of Management Services in implementing safeguards, conducting periodic access reviews, completing required training, and responding to audits or compliance assessments.
Section 7. Relationship to Existing Policies. Nothing contained herein shall supersede the City’s Computer System Security Breach Notification Policy adopted pursuant to Section 208 of the New York State Technology Law. Rather, this Policy shall supplement that policy by establishing preventative safeguards designed to reduce the likelihood of data breaches and unauthorized disclosures before they occur.
Section 8. Authority to Revise Administrative Procedures. The Commissioner of the Department of Management Services is authorized to make administrative updates, technical revisions, and procedural modifications to the Policy as necessary to remain consistent with evolving cybersecurity standards, technological developments, and changes in applicable federal or state law, provided such revisions do not materially alter the intent or substance of the Policy adopted by the City Council.
Section 9. Severability. If any section, subsection, sentence, clause, phrase, or provision of this Ordinance or the Policy adopted hereby is adjudged invalid by a court of competent jurisdiction, such judgment shall not affect the validity of the remaining portions, which shall continue in full force and effect.
Section 10 Repealer. All ordinances, local laws, resolutions, policies, or parts thereof inconsistent with the provisions of this Ordinance are hereby repealed to the extent of such inconsistency.
Section 11. Effective Date. This Ordinance shall take effect immediately upon its adoption by the City Council and filing in accordance with the Municipal Home Rule Law and the Charter of the City of Mount Vernon.