Page 151

150

PY26 WHEAP Manual

Revised: August 2025 3. Be disposed of through complete destruction of the material, including shredding the media or burning the materials.

Tier Two sensitive data that are printed or physically displayed on media shall: 1. Be stored in a restricted access location. 2. Meet programmatic requirements for record retention requirements. See specific program policies for requirements. 3. Be disposed of through complete destruction of the material, including shredding the media or burning the materials.

Hard copies in transit: When transporting hard copies of Tier One and Tier Two sensitive data, the data shall be stored in a location secured by a durable physical barrier requiring a code or key, such as a locking metal file case or lock box. A log shall be maintained of all files being transported from the point of origin to the point of receipt. The log shall not be transported in the same location as the hard copies of sensitive data.

Quality Assurance Contracted agencies shall have procedures established to ensure: 1. Employees are made aware of the policy requirements annually. The agency is responsible for ensuring signers of Conflict of Interest/Non-Disclosure Forms have a full and complete understanding of the HE+ Policies for Handling Sensitive Data. 2. Technology and devices are within the standards set forth by the Policies for Handling Sensitive Data. 3. When scanning (making an electronic copy of) documents for storage, the original hard copy or source data are to be maintained until the scanned document imagery is secured. Original hard copies and source data are to be handled and destroyed in accordance with applicable document retention guidelines. Original hard copies are not required to be retained once scanned into the HE+ System. 4. Documentation is written and maintained for plan of action regarding incident management and data handling. Employees are to immediately notify their supervisor if it is suspected that sensitive data may have been compromised in any way (i.e., loss, theft, unattended media including, but not limited to, personal electronic device(s), desktop computers, and laptops). Incident information to be recorded and retained: a. Date and time of incident b. Location of incident c. Description of what happened to expose the data d. List of potential impacted identities shall be made available upon request in a password-secured document e. Plan of prevention and correction f. Incident information will be password protected in a secured folder on the network drive and restricted to the necessary authorized individuals g. DEHCR shall be notified of any incidents and corrective actions