Page 150

PY26 WHEAP Manual

149 Revised: August 2025 4. Disposal of the media shall require wiping electronic media with at least a seven-pass overwrite of the entire medium, degaussing (sanitation based on magnetism), or complete physical destruction of the medium.

General Electronic File Creation and Storage Tier One sensitive data shall not be used to name files or folders. Faxing or transmitting original or copies of SSN cards, driver’s licenses, identification cards, or any Tier One data is prohibited.

Shared Network Drive Files containing Tier One and Tier Two sensitive data stored on a network drive shall be stored in a secured folder limited to staff that require access to the data.

File Transfer Protocol (FTP) Sites Tier One and Tier Two Sensitive data on FTP sites shall require the following standards: 1. Files require a password to open. 2. The password shall not be stored in the file name, file properties, or other related information files about the file (a.k.a. metadata). 3. Password is to be provided to the end user via phone, email, or other separate method of communication. 4. Sensitive data shall not be stored on an FTP site as a long-term or permanent solution.

Email Agencies shall not email Tier One sensitive data. Agencies may, at their discretion, permit applicants to submit HE+ Applications by email. Agencies allowing email applications shall first encourage application via phone, online, in person, or mail as an alternative to email. Agencies shall be clearly advised that they should not include SSNs on emailed applications, advising the applicant that they will be contacted by the agency for this information. Upon receipt of application materials from applicants or household members by email, the application shall be entered using the date sent as the date of application. The application shall remain “Pending” until all information has been verified. Customer signatures received on a Certification Page received by email, even if name is typed in the signature field, are valid signatures. All other applicable WHEAP eligibility policy requirements remain in effect.

Instant Messaging (Texting, Social Media, Direct Messages, etc.) Agencies shall not send Tier One sensitive data externally via instant messaging platforms. Agencies may, at their discretion, conduct outreach to customers via instant messaging or various social media networks. Agencies shall not include SSNs in any external correspondence.

Hard Copies Storing hard copies: Tier One sensitive data that are printed or physically displayed on media shall: 1. Be stored in a locked access location (key code door, key fob, combination lock, etc.). 2. Meet programmatic requirements for record retention requirements. See specific program policies for requirements.