Page 218

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 2 Collection, Maintenance and Dissemination of Private Data Collection, storage, use and release of the information must be limited to what is necessary for the administration and management of the program. The information may not be released except as permitted by the MGDPA. Minn. Stat. § 216C.266 states, “Data on individuals collected, maintained, or created because an individual applies for benefits or services provided by the Energy Assistance and Weatherization programs is private data on individuals and must not be disseminated except pursuant to section 13.05, subdivisions 3 and 4.” Information about a data subject may only be released to a third party if the data subject consents to the release or disclosure of the information by submitting a signed Informed Consent to Release Private Data. E-Mail Data Privacy To maintain data privacy on e-mails: • Use only household numbers for identification when possible, including any reference in the subject line or attachments. • Use secure e-mail practices when private household data is included. • Use secure e-mail practices to send new energy vendor information containing Tax IDs or Social Security Numbers. • Remind energy vendors to use only household numbers when communicating via e-mail about a customer. Contact Commerce for help if an energy vendor does not cooperate with data privacy requirements, as required by the energy vendor agreement. Social Security Number for LIHEAP and WAP Applications Social Security Numbers (SSNs) are used in the administration of EAP and WAP and to ensure that only eligible applicants and their household members receive allowable benefits. Federal law allows states to require applicants to disclose their SSN to prevent, detect, and correct fraud and abuse. (See Chapter 3 - Program Eligibility Requirements for details on the U.S. HHS Information Memorandum (IM) Transmittal No. LIHEAP-IM-2010-6 documenting this change.) SSNs are classified as private data under Minn. Stat. § 13.355 and must not be disclosed to anyone other than the person to whom the SSN applies, unless the person consents to its release or disclosure.