Page 227

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 11 • Data concerning public benefits received by household members within the last year from the Minnesota Department of Human Services and its agencies for determining eligibility for benefits. • Data concerning public benefits received by household members within the last year from the Social Security Administration for determining eligibility for benefits. • Verification of income from household members’ employers for determining eligibility for benefits. • Confirmation of household residency and heat source from the household’s landlord for determining eligibility for benefits and benefit amounts If the applicant names an Authorized Representative, the signed application also gives consent for Commerce and Service Provider program staff to provide and receive information from the Authorized Representative on behalf of the applicant. Services Providers must have procedures in place to ensure requests for information allowed by the application consent are well-documented and handled in a consistent manner. Best practice is for the local procedures to include a form for requesting information by letter or e-mail and a format for documenting a request by telephone. Security procedures for e-mails containing private information must be in place. Requesting Release of Information to the Data Subject Original application information is maintained by the Service Provider. A data subject may ask and be told whether a Service Provider has stored data about him or her, what data is stored and whether it is classified as public, private or confidential. EAP data on individuals is always private, see Minn. Stat. § 216C.266. Requests by the data subject to view or obtain a copy of his/her private data or a list of private data maintained about him/her should be directed to the local Service Provider. The data subject may request information about the status of the application over the telephone. The data subject may see or obtain a copy of accurate, current and complete data without any charge and, if desired, be informed of the meaning of the data. Viewing the data should happen during regular office hours. Viewing should occur immediately, if possible, but must happen within 10 business days of the request. The data subject need not provide a reason for requesting the data. The Service Provider may ask the reason in order to clarify the data the requestor wishes to see or obtain. Service Providers must take great care to ensure data is released only to the subject of the data. Efforts should include: • Confirming the identity of the data requester. • Mailing copies of data by certified and restricted delivery mail to the data subject at his/her address.