Page 94

92

12.10 Confidentiality and Security Identifying applicants or clients as EAP recipients in an open forum (i.e. sign in sheets) is a violation of an individual’s privacy and discloses confidential information. All files should be easily accessible to appropriate staff without compromising confidentiality. For example, cabinets containing EAP files should be locked. Computers must be password protected. Computers which LSP staff use to access client information should be locked when not in use. Computer passwords to client databases should be changed at least every 60 calendar days. The computer network and laptops should be protected with appropriate and up-to-date security software. Confidentiality must also extend to the internal procedures, processes, and outside contacts the LSP uses to administer EAP. LSP staff should never conduct conversations concerning EAP procedures in the presence of an applicant. Doing this may disclose internal procedures to the applicant. For example, LSP staff should not call a utility vendor to pledge payment while the applicant is listening. Applicant or client files are for internal use only and should not be shared with any other local, state, or federal program outside of your organization. The information, however, belongs to the applicants or clients and can be provided to them, if requested. The client may then share that information with any person or organization they choose. In addition, if the client wants the application discussed with an authorized representative, they must designate that authorized representative in writing. The client file must indicate that information was released to the applicant, client, or representative and include a copy of the designation in the file. The LSP must strike out all but the last four digits of the SSN, if the copy is retained in the eligibility file, the statewide database, or any time the LSP releases information. All client records are considered confidential and should be open only to authorized personnel. Such information cannot be shared with unauthorized individuals. Personal Identifying Information (PII) includes the following: • Name • Social Security Number • Birth date • Home phone number • Home address • Health information (note: no unredacted health records may be kept by LSPs) • Citizenship status • Disability status LSPs are required to maintain completed Employee Confidentiality Agreement records for all staff who have access to any personal clientele information and/or access to the statewide database.