Page 39

EAP Policy Manual FFY24 Chapter 1 Service Provider Selection and Responsibilities Page 7 of the information shall be limited to that necessary for the administration and management of the program. The information may not be released except as permitted by the MGDPA. Records Maintenance EAP records must be maintained for at least six years after the program year has ended, per Minn. Stat. § 16C.05, subd. 5. Service Provider’s retention policies should not exceed six years after the program year has ended to protect the data privacy of applicants. Should Commerce or HHS require a Service Provider keep records for a longer period of time, written notice will be sent to the Service Provider stating the time period. Record and Data Security The Service Provider must execute a plan for maintaining the security of private data maintained locally and for access to eHEAT. Refer to Chapter 11 - Data Practices and Records for minimal requirements for the protection of locally maintained data. Control Activities – Fiscal Service Providers should design and implement appropriate internal Fiscal control policies and activities to processing fiscal transactions, reporting and oversight. Fiscal control activities include: Fiscal Transactions Service Providers must use generally accepted fiscal practices including authorized personnel having program specific knowledge. Practices should have: • Proper segregation of duty. • Auditable processes. • Good communication between program and fiscal staff. • Authorization and utilization of the EAP weekly allocation process. Communication and Information Service Provider’s should communicate the internal control policies and procedures to all staff and stakeholders, so they understand what is expected of them and the scope of their freedom to act in relation to program participants and partners. Required communication ranges from ensuring proper phone service to outreach and collaboration.