03 - HA ANNLPLAN - Laserfiche WebLink

Home Browse Search

Confidenfial Resident Files/Central Filing Room All EN data will be viewed for each adult- If printed to assist with a fraud investigation it will be destroyed after use by shredding to a size where strips are unreadable (Section 2.2 of HUD's. EIV Security Procedures Manual}. Policy prior to April 2008 allowed for EN to be printed and imaged. The main door to the imaging area will remain lacked and files not already imaged will be released only when the file clerk who oversees the area is present. Same files are not yet imaged. As necessary, staff may maintain a file at their workstation. However, tenant files containing EN may not be left unattended or open on the desktop when staff is away from their desk. Any tenant files containing EIV held at workstations must be properly stored in locked overhead bins or locked desk drawers when not in use. Once a transaction is completed, and if the EIV documents were printed to investigate fraud, they will be destroyed by shredding to a size where strips are unreadable {Section 2.2 of HUD's EIV Security Procedures Mahual}. Hard Copy Security Requirement When EIV is printed, staff will retrieve computer printouts as soon as they are generated so that EIV data is not left Lying unattended in printers where unauthorized users may access them. Hard Copy Security Violations SARA will handle EN data in such a manner that it does not become misplaced ar available to unauthorized personnel Any eonf dential resident file should he assumed to contain EN data. Therefore, the participant file cannot be viewed by any personnel that are not expressly authorized {examples of authorized staff: staff in charge of that file, the supervisor of the staff in charge of the file, or approved/authorized auditors} and who do not have both an Access Authorization Form/Rules of Behavior/User Agreement on file with the EIV Security Qfficer. Viewing the EIV information of a participant outside of a staffs caseload assignment is considered a security violation for both the staff viewing the EIV information and for the staff that left the infomaation unattended. Unless a supervisor has specifically authorized staff to view another staff s EN data, this is expressly prohibited. Disposal of EIV Information EIV Reports must be disposed of under the following circumstances: • EN report was incorrectly requested. Repurtin~ Improper Disclosures Recognition, reporting and disciplinary action in response to security violations are crucial to successfully maintaining the security and privacy of the EN system. 6 Exhibit 2