Page 228

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 12 Service Providers must also maintain documentation of all private data releases: • For phone requests, maintain a log or put a note in the file. • Get the viewer’s signature on a list of data viewed or picked up. • Maintain a list of data mailed and copies of the certified mail receipt, record of delivery and signature confirmation. The section “Handling Data Requests,” at the end of this chapter, contains specific, step-by-step procedures for releasing data to the data subject. A copy of the data must be provided within 10 business days of the request. The copy must be provided using the format (electronic or paper copy) requested, if the data is available in the requested format. For example, if the data subject requests a paper copy of data stored electronically, the data can easily be printed. If the data subject requests an electronic copy of data available only on paper, it cannot easily be transferred and may be made available on paper. Informed Consent for Release of Information Applicants sign the EAP application to authorize use of their private data to provide EAP services. Informed consent is necessary when data will be released to a “third party.” A third party is an individual or organization not included in the Privacy Notice in the Privacy Notice and Your Rights and Responsibilities document or in the Application Consent of the Energy Programs Application, Part 1, Authorized Representative, and Part 6, Consent and Signature. Informed consent is also necessary before the organization or Service Provider that collected or created the private data can use it for a purpose not included in the Privacy Notice or Application Consent. “Informed consent” means the data subject knows and understands the new uses of the data and the consequences of allowing the data requester to use the data in the new way(s). This requires the data subject to possess and exercise sufficient mental capacity to make an informed decision. Requesting Release of Information to a Third Party A data subject may request the release of private data about him or her to a third party using the Informed Consent to Release Private Data form (Informed Consent). The Informed Consent form is a written agreement signed by the data subject authorizing the holder of the data to release that data about him or her to a designated non-EAP entity. Informed Consent is needed so Commerce and Service Providers can verify what specific private data to release and what private data to protect. Commerce and Service Providers will release private data only as the signed Informed Consent authorizes.