Page 27

ESA SNAP Policy Manual 11 Staff who violate ESA’s privacy policies or other applicable federal or state law are subject to adverse action in accordance with Chapter 16 of the District Personnel Manual and respective collective bargaining agreements. Staff must report any violations of ESA’s privacy policies and should contact the Policy Unit, which will refer the matter to the ESA Privacy Officer. Staff may make a report anonymously, and retaliation for reporting violations or cooperating with investigations is prohibited. 1.6.2 Informing the Applicant of Their Privacy Rights ESA must inform the customer about the protection of their personal information. 1.6.3 Protecting the Confidentiality of Customer Records All staff have a responsibility to protect the confidentiality of all customer information, including the information within the case record. Within each Service Center and in the Document Imaging Management System (DIMS), case records are stored in a secure, employees-only area or with restricted electronic access. Staff may not leave any customer information within public view. Security personnel at ESA ensure that unauthorized persons do not enter these areas without an escort. This requirement applies to all visitors, including federal auditors. 1.6.4 Disclosing Information to the Customer or Authorized Representative  A customer, or their authorized representative, may request to review their case record.  A customer’s representative must produce an authorization for release signed by the customer.  Requests from someone other than the customer or authorized representative will be referred to an administrator and granted to comply with authorities only in certain circumstances.  ESA may only disclose the minimum necessary information to meet the purpose of the disclosure or request. ESA will not disclose information that is peripheral, incidental or unrelated to the specific request or inquiry. Staff should contact the ESA Policy Unit for further guidance on whether releasing specific information is appropriate.  If the request is for fewer than 100 pages, ESA will make copies available for the cost of reproduction.  ESA will refer requests of more than 100 pages to the ESA Policy Unit.  ESA must record all disclosures in the case narrative. Staff will not disclose any customer information to an unidentified individual or an unauthorized person.  Before disclosing any such information to the customer, ESA must conclusively identify the customer by asking them to provide their correctly spelled name, date of birth, SSN and other information for identification purposes. If the request is in writing, staff must compare the customer’s electronic signatures from online applications and recertifications.  To disclose information to an authorized representative, ESA must conclusively identify the representative as an individual listed as an authorized representative on one of the following documents: − Most recent application or recertification form Return