Page 221

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 5 • Implement policies establishing security and business need requirements for the transportation of private data on laptops, electronic storage media, paper, etc. For example, require encryption of electronic data on laptops, mobile devices, and flash drives; require strong passwords on laptops and mobile devices. • Wireless networks must be secure and require strong passwords. • Ensure that duplicate, secure records back up electronic records maintained by the Service Provider. Duplicate eHEAT records are maintained by the state of Minnesota. • Ensure that duplicate, secure records back up financial data records. • Ensure that statistical reports, annual reports, or other data compiled, produced or published by the Service Provider or any representative of the Service Provider do not reveal or connect any applicant's private data to any public information. Records Accessibility Retain records in an accessible form, as described below. Records retained on electronic media must remain accessible after any changes in computer hardware or software: • A household must be able to access and use information in their file as allowed by the MGDPA (see “Requesting Release of Information to the Data Subject” later in this chapter). • The Service Provider must be able to access and use records for reporting requirements. • State or federal staff must be able to access and use records for monitoring or audits. Record Retention Requirements EAP records must be maintained for at least six years after the program year has ended, per Minn. Stat. § 16C.05, subd. 5. Service Provider’s retention policies should not exceed six years after the program year has ended to protect the data privacy of applicants. Should Commerce or HHS require a Service Provider keep records for a longer period of time, written notice will be sent to the Service Provider stating the time period. Requirements allow flexibility in the way Service Providers retain these records. Retain records related to: Contracts. • The complete household files. • Administrative action on an application such as records of complaints or administrative hearings, and/or Service Provider actions to resolve issues. • Procurement records detailing the history of procurement with all energy program funds.