Page 225

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 9 Off-Boarding Process Service Providers are required to immediately deactivate eHEAT administrators and users when needed. Service Providers must have off-boarding (staff leaving employment) procedures in place, for example an off-boarding check-list. Ensure the off-boarding process includes deactivating eHEAT access along with access to other data systems containing private EAP data. eHEAT Access Check The Service Provider eHEAT Security Administrator should conduct routine eHEAT access checks to ensure only the appropriate users are active in eHEAT. There are two user statuses in eHEAT: • Active: user has access to eHEAT. • Deactivated: user does not have current eHEAT access due to inactivity for over 60 days or because they were deactivated by an eHEAT Administrator. User needs to be reactivated by an eHEAT Administrator to regain access. eHEAT continues to list every user that had eHEAT access. The Service Provider eHEAT Security Administrator’s authorization includes: • Creating new users for the Service Provider • Editing existing users as duties change • Resetting password for the users as needed • Immediately deactivating eHEAT administrators and users: • Upon permanently leaving a position requiring eHEAT access. • Upon administrative leave or suspension. • When no longer employed by the Service Provider or program. • If on other leave, laid off, on an extended vacation, or reassigned to non-EAP duties for 30 days or longer. • Re-enabling users when they return to work. • Creating new user groups that combine functions in eHEAT for staff positions. • Ensuring the private data provided by eHEAT features to workers is appropriate for their job and responsibilities. • Editing existing user groups as new features are assigned or no longer performed. • Deleting existing user groups. The MGDPA requires access to household private data be limited to those who need the data to do their jobs. The MGDPA, under Minn. Stat. §13.055, subd.1. (d) states: “’Unauthorized person’ means any person who accesses government data without a work assignment that reasonably requires access, or regardless of the person's work assignment, for a purpose not