Information is protected and is collected, used, and disclosed according to a privacy and confidentiality policy.  

Evidence:

• Description of privacy and confidentiality practices and/or policy and protocol 
• Description of how board, staff, volunteers, and the public are informed of the privacy and confidentiality policy  
• Privacy and confidentiality document that board, staff, and volunteers sign 
• Description of recent privacy or confidentiality breaches and how they were managed, including responses, dates of the breaches, and when responses were issued