Secure and Controlled Printing

What this covers

Secure and controlled printing is print production for documents whose content is restricted by law, contract, or court order. The pages themselves are often unremarkable: a notice, a letter, a roster. What makes the work different is the data behind them: criminal justice information, protected health information, federal tax information, or personnel and investigative records. The controls that govern that data in the system of record do not stop at the printer.

The work arrives as an extract or a print stream from an agency system: a court or jail management system, a records management system, a behavioral health record, or a tax system. Composition, proofing, printing, finishing, and insertion then happen in a controlled environment, with the data, the stock, the waste, and the spoilage accounted for from receipt to delivery or destruction.

Buyers are the departments holding restricted records: sheriff's offices, police departments, courts and probation, child support services, public health and behavioral health, human services, and human resources. Central print shops and purchasing offices often buy on their behalf, so the security terms belong in the contract, not a later negotiation.

Typical activities

• Classification and scoping. Establish which categories each job carries, because the category sets the rules. A job mixing restricted and unrestricted records follows the stricter rule unless the data is separated first.
• Personnel screening and facility controls. Fingerprint-based background checks, signed confidentiality statements, access lists reviewed on a schedule, visitor control, and physical access logging for the production area.
• Segregated production. Restricted jobs run in access-controlled space, on queues and storage not shared with general commercial work, with device restrictions and no uncontrolled removable media.
• Controlled transfer and retention. Encryption in transit and at rest, named endpoints and recipients rather than shared mailboxes, a defined retention window for the extract, and documented deletion after acceptance.
• Proofing. Proofs reviewed by authorized agency staff, with synthetic or redacted records used for layout approval where live data is not needed, and proof copies returned or destroyed.
• Chain of custody. Numbered job tickets, batch or piece-level accounting, reconciliation of input records to printed pieces to delivered pieces, and signed transfers at each handoff.
• Waste, spoilage, and media. Misprints, setup sheets, overruns, and obsolete stock counted rather than recycled loose, then destroyed by shredding, pulping, or incineration. Print servers, imaging drives, and returned media sanitized before reuse.
• Audit trail and incident handling. Retained access, production, and destruction logs, a named contact, and a notification path with timelines if a piece is misdirected or a batch unaccounted for.

What you receive

• A data handling plan stating each job's classification, how data moves, where it rests, who may touch it, and how it is retained and destroyed.
• Executed agreements matched to the data: a business associate agreement for protected health information, a security addendum for personnel handling criminal justice information, and the terms federal tax information requires.
• A proof set and approval record showing which version was approved, by whom, and when.
• Chain of custody and reconciliation records for each run: input counts, produced counts, spoilage counts, delivered counts, and signatures at each transfer.
• Certificates of destruction for waste, spoilage, obsolete stock, and source data, stating method, date, and quantity.
• An audit file of access logs, screening attestations, the incident log, and a description of the controls in place, in a form an auditor will accept.

Considerations for public agencies

The obligation follows the record, not the format. A printed criminal history is still criminal justice information, and a mailed benefits notice is still protected health information. The CJIS Security Policy, IRS Publication 1075, and the HIPAA rules are revised periodically, so confirm current requirements against the official source and with counsel.

Put the controls in the solicitation, not the award. Screening standards, segregated production, destruction method, audit and inspection rights, notification timelines, and flow-down to subcontractors belong in the specification. General print and cooperative contracts often lack these terms, and a low unit price is no saving if the work must be amended after an audit finding.

Retention and disclosure cut both ways. The printed piece is often not the record; the extract and the composed file may be. Align vendor retention with the agency's approved schedule: deleting at once can destroy what the schedule requires, and holding data indefinitely creates exposure. Records a contractor holds for the agency may also fall under public records law, and the agency decides what is exempt.

Many of these mailings have dates fixed by statute. Tax bills, delinquency and lien notices, hearing and due process notices, and benefit notices are not negotiable. Screening, agreement execution, and proof cycles take time, so place them in the schedule ahead of the statutory date.

Alternate formats need their own controlled path. Effective communication obligations under the ADA and state law may require large print, braille, translation, or an electronic alternative on request. Each is another handling path for the same restricted data, so settle in advance who produces it and under what controls.

Working with HQT on this

HQT works on the part between the system of record and the page: classifying the data, writing the handling and destruction requirements, and building the reconciliation and audit records that make a job defensible. An engagement usually starts with one job the agency already runs, a review of the obligations attached to its data, and a written scope covering controls and acceptance.

Frequently asked questions