Page 231

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 15 • Making data available for viewing by data subject at the office during office hours immediately, if possible, but no later than 10 business days after the request. • Sending a copy of the data to the data subject by certified and restricted delivery mail; e-mailing the encrypted data to the data subject’s e-mail address, or arranging for the data subject to pick it up. 8. Throughout the process, document the release of data. • For phone requests, maintain a log or put a note in the household file. • Prepare a dated list of data the requester sees or receives. • Get viewer’s signature on a dated list of data the requester sees or picks up. • Collect copies of the certified mail receipt, record of delivery and signature confirmation and file with the dated list of mailed data. • Maintain file of e-mail and included data. Informed Consent Release Requests for Information to a Third Party Following are the steps to respond appropriately upon receipt of a signed Informed Consent to Release Private Data. 1. The first step in responding to a request for information is to: • Document date of request. • Verify the request is for private data. • Confirm availability of data. 2. Confirm the request is for release of private data to a third party. 3. Confirm the Informed Consent to Release Private Data is complete and signed by the data subject. 4. Verify the identity of data subject/requestor. Acceptable confirmations of identify include: • A notarized signature. • Picture identification presented at the time of the request. 5. Respond appropriately to the request by: • Preparing and redacting data, as necessary. Only private data about the requestor may be released to the third party. The application itself may need to be redacted if it contains private data about others. In this case, to redact means to remove or black-out private data to ensure release of only data consented to by the data subject. • Fulfilling the request immediately, if possible, but no later than 10 business days by certified mail, pickup or e-mail.