Page 224

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 8 The energy vendor must obtain an Informed Consent for Release of Data signed by the household before requesting EAP household data for any other use or program. Additional information is available in Chapter 2 - Application and Application Processing. Sharing Private Data for Delivery of ERR Services Understanding data practices requires knowledge of the roles and responsibilities of managing access to data to ensure compliance with legal requirements. Sharing private data with WAP staff and contractors providing ERR services for EAP households requires both EAP and WAP programs to be responsible for protecting private data. Although EAP and WAP are separate programs, the linkage of those programs creates common data security challenges. The following provide context for understanding data privacy: The MGDPA states that private data includes “the data collected, created, received, maintained or disseminated by any government entity.” • ERR participants (auditors, inspectors, heating contractors, etc.) must be informed of data privacy requirements and provided with only the household data needed to deliver services and do their jobs • Both EAP and WAP eHEAT users may export household data from eHEAT only for specific business uses. • eHEAT system security is designed for the local eHEAT Administrator(s) to assign authorized users to perform only the tasks and processes necessary to deliver services and perform assigned duties. Roles and Responsibilities Service Providers must ensure electronic and physical records of private data can only be accessed by staff assigned to use the data. Limiting staff access to only data necessary for their job assignments is accomplished partly by limiting their eHEAT features. Service Provider must have any staff member using eHEAT complete and sign the eHEAT User Security Agreement to ensure their understanding of data practices. The Service Provider Security Administrator is responsible to manage Service Provider users and must sign an eHEAT Administrator Security Agreement annually as part of the Grant Contract process. If a new Service Provider Security Adminitrator is assigned mid-year, their signed eHEAT Administrator Security Agreement is emailed to Commerce at eap.mail@state.mn.us. Managing eHEAT Access Service Providers are required to have processes in place to manage eHEAT access to ensure only current, authorized users have eHEAT access. Users must only have access to eHEAT features necessary for their work assignments.