Page 95

93

All staff with access to the statewide database must be issued their own login credentials. These login credentials must reflect their own legal name and be associated with that individual’s agency-issued e-mail address. Agencies shall not utilize generic login accounts for all staff in a certain location, department, etc. Staff shall not share their login credentials or password with any third party. Agency supervisors must actively maintain the list of active users, and promptly deactivate the accounts of any staff members who leave agency employment or no longer require access to the statewide database. Records Retention LSPs are required to maintain all records relative to the client’s application during the effective period of each grant agreement and for a period of three (3) years from the date the LSP submits to IHCDA its final close out form, or one (1) year from the resolution of any outstanding administrative, program, or audit question, or legal action; whichever is later. LSPs shall protect all electronic and hardcopy documentation containing confidential client information. LSPs shall properly dispose of any electronic or hard copy documentation containing confidential client information after the required retention period. A proper disposal of this information is one that is reasonable and appropriate to prevent any unauthorized access to confidential client information. Approved disposal methods include: • Burn, pulverize, or shred papers containing confidential client information so that the information cannot be read or reconstructed. • Destroy or erase electronic files or media containing confidential client information so that the information cannot be read or reconstructed. • Hire a document destruction contractor to dispose of confidential client information. 12.11 Program Integrity All LSPs must have a robust plan for ensuring program integrity as part of their Internal Operations and Controls. This plan must address noncompliance, fraud, waste, and abuse of federal funds perpetrated by applicants or by staff, contractors, volunteers, or board members. The policies, processes, and procedures for addressing and investigating applicant noncompliance or fraud must be separate from those for staff, contractor, volunteer, or board member fraud, waste, or abuse – i.e., LSPs must have at least two distinct sets of policies, processes, and procedures. They may have more if they choose to break out separate policies and procedures for staff members, volunteers, contractors, and/or board members. Noncompliance, Fraud, Waste, and Abuse Noncompliance refers to the failure of an applicant to adhere to application instructions or requirements. Noncompliance can be intentional or unintentional. In general, noncompliance may be engaged in by applicants.