Page 148

PY26 WHEAP Manual

147 Revised: August 2025 Appendix A | Agency Guidelines for Handling Sensitive Data General Contracted agencies shall ensure program employees, both internal and subcontracted, shall take reasonable efforts to protect and secure sensitive information. Sensitive data are any information of which the loss, misuse, unauthorized access to, or modification of could adversely affect the HE+ Program, contracted agencies, program employees, and/or customers. Sensitive data and information include, but are not limited to, SSNs and PII meaning information that can directly identify a specific individual, household member, or account-specific information.

For the purposes of the following policy, sensitive data has two tiers.

Tier One sensitive data includes: • SSNs by themselves or in combination with any PII (including date of birth, names, address, phone number, fuel account number and name, and income information) • The combination of date of birth and name without an SSN • WHEAP-related single party checks returned to the local agency

Tier Two sensitive data includes: PII elements that may be needed to complete effective business communications in support of the HE+ programs (name, address, phone number, fuel account information, and income information).

Agencies shall limit the use and exchange of sensitive data to the minimum required to conduct HE+ Program business effectively.

When using sensitive data individually or in quantity, contracted HE+ Program agencies, contractors, and participants shall take reasonable actions to ensure the protection of sensitive program data that are collected, displayed, transferred, stored, analyzed, or destroyed. This appendix identifies minimum requirements that shall be used for equipment, information collected, and methods of transferring sensitive information. Contracted agencies shall have documentation and planned procedures in place for the handling of sensitive data and be able to make them available upon request.

Non-Disclosure Agreement A contracted agency shall not disclose sensitive data to any persons other than those directors, officers, employees, and agents who have a business-related need to have access to such information for the limited purposes of the contract and who have been apprised of, and agree to maintain, the confidential nature of such information in accordance with the terms of the contract.

All staff that have HE+ System access will be prompted to agree to the Conflict of Interest/Non- Disclosure Agreement Form upon gaining access to the HE+ System. For staff that work with WHEAP, but do not have HE+ System access, agencies shall require staff members to sign a Conflict of Interest/Non-Disclosure Agreement. A copy of a Conflict of Interest/Non-Disclosure Form may be requested from the Division. This agreement is valid for the duration of employment with the agency. The contracted agency is responsible for the breach of the contract by any agency staff.