Page 230

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 14 • When federal or state laws permit data dissemination after the Privacy Notice has been given. Revocation of Release Form The individual may revoke the consent to release private data at any time by writing to the local Service Provider or Commerce, whichever received the original Informed Consent. The revocation goes into effect on the date it is received by the local Service Provider or Commerce. It will not affect information released prior to receipt of the revocation. Handling Data Requests Local Service Providers must take special care to appropriately respond to requests for information and Informed Consent forms. Requests for Information by Data Subjects Following are the steps to respond appropriately to a request for information from a data subject. 1. The first step in responding to a request for information is to: • Document date of request. • Verify the request is for private data. • Confirm availability of data. 2. Next, confirm the request is for release of data to the data subject. • Verify identity of data subject/requestor. Acceptable confirmations of identity include: • Birth date and last four digits of the requestor’s social security number (for phone requests). • A notarized signature. • Picture identification presented at the time of the request. 3. Respond appropriately to the request by: • Preparing and redacting data, as necessary. Only private data about the requestor may be released to the requestor. The application itself may need to be redacted if it contains private data about others. In this case, to redact means to remove or black-out private data to ensure release of only data consented to by the data subject. • Fulfilling the request within 10 business days.