Page 220

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 4 Documents that must be in the household’s hard copy (paper) file or easily identified and accessed electronic file include: • A copy of correspondence with or regarding the applicant not documented by eHEAT. • Documentation of research and responses to a question, complaint or appeal. • A signed signature page from the application (or, rarely, a copy). • The application. • Documentation of income. • Income calculations not completed in eHEAT. • Case notes if they are not kept on eHEAT. • Pertinent program forms, such as ERR documentation. eHEAT will document the following for each household by household identification number: • Application information, including income calculations. • Completed household application summary. • Home energy information collected from energy vendors. • Case notes. • Payments. All EAP records about an individual or household are private data. Hard and electronic copies of the application and the application summary on eHEAT are private data. Security of Records As a recipient and custodian of applicants’ private data, Service Providers must develop local procedures that keep household records secure. Many of these procedures are required in the Local Plan. Service Providers’ procedures must: • Only allow access to private data to those who are authorized by law or by written permission from the applicant (see “Informed Consent for Release of Information” below). • Ensure eHEAT administrator transitions are handled in a timely manner according to the procedures outlined in Chapter 12 - Communication, Information and Reports. • Use strong passwords to gain access to all electronic documents containing private data. • Ensure that e-mails do not contain private information, or, if they must, have an acceptable process for encrypting them. Note: Household numbers are not private information. Names and addresses and other identifying information are private.