ENTERPRISE INCOME VERIFICATION (EIV) SECURITY/USER POLICY. Our Business is You. Purpose:

Transcription

1 Our Business is Yu ENTERPRISE INCOME VERIFICATION (EIV) SECURITY/USER POLICY Purpse: The purpse f this plicy is t prvide instructin and infrmatin t staff, auditrs, cnsultants, cntractrs and tenants n the acceptable use, dispsitin and strage f data btained thrugh EIV (Enterprise Incme Verificatin System). The purpse f EIV is t assist HUD, Cntract Administratrs, wners and their agents in streamlining the incme verificatin prcess and t help in minimizing the need fr 3 rd party verificatin. It is Kier Prperty Management and Real Estate LLC s (KPM) plicy t use EIV as a third-party surce t verify incme and the accuracy f rents n all tenants upn recertificatin n all prperties with Sectin 8 subsidy prgrams. Safeguarding EIV Data The infrmatin prcessed by any EIV system can include wage and incme data abut private individuals, as well as identifying infrmatin such as Scial Security Number, Address, and Emplyment infrmatin. This plicy describes methds t cmply with HUD s required EIV safeguards. Technical safeguards 1. Reduce the risk f a security vilatin related t the EIV system's sftware, netwrk, r applicatins. 2. Identify and authenticate all users seeking t use the EIV system data. 3. Deter and detect attempts t access the system withut authrizatin. 4. Mnitr the user activity n the EIV system. Administrative safeguards 1. Ensure that access rights, rles, and respnsibilities are apprpriately and adequately assigned. 2. Prtect cpies f sensitive data and destry system-related recrds t prevent recnstructin f the cntents. 3. Ensure authrized releases f tenant infrmatin cnsent frms are included in all family files, befre accessing and using data. 4. Maintain, cmmunicate, and enfrce standard perating prcedures related t securing EIV data. 5. Train staff n security measures and awareness, preventing the unauthrized accessibility and use f data. Physical safeguards 1. Establish barriers between unauthrized persns and dcuments r cmputer media cntaining private data. 2. Clearly identify restricted areas by use f prminently psted signs r ther indicatrs. 3. Develp a list f authrized users wh can access restricted areas-e.g., cntractrs, maintenance, and janitrial/cleaning staff. 4. Prevent undetected entry int prtected areas and/r dcuments. 5. Ntify Crdinatrs/Security Administratrs f system breaches and penetratin by unauthrized users. The EIV Crdinatr will have the respnsibility f ensuring cmpliance with the security plicies and prcedures utlined in this dcument. These respnsibilities include: Maintaining and enfrcing the security prcedures Keeping recrds and mnitring security issues Cmmunicating security infrmatin and requirements t apprpriate persnnel including crdinating and cnducting security awareness training sessins Cnducting review f all User ID s issued t determine if the users still have a valid need t access EIV data and taking necessary steps t ensure that access rights are revked r mdified as apprpriate Reprting any evidence f unauthrized access r knwn security breaches and taking immediate actin t address the impact f the breach including but nt limited t prmpt ntificatin t HUD. The EIV Crdinatr will reprt such incidents t apprpriate parties including the Cntract Administratr r HUD. Kier Prperty Management and Real Estate LLC Revised 10/04/2017 Page 1 f 6 KPM-P111

2 Limiting Access t EIV Data User accunts fr the EIV system will be prvided n a need-t-knw basis, with apprpriate apprval and authrizatin. Regarding prperties with Tax Credit r 515 layering; neither the EIV printut nr the dcumentatin f EIV data will be prvided t any Tax Credit r 515 auditrs since EIV may nt be used t verify infrmatin fr tenants participating in thse prgrams. Alternative verificatin dcuments must be used t verify incme fr Tax Credits r 515 prgrams. T avid unauthrized access t EIV reprts and dcumentatin f EIV data, KPM maintains separate tenant file flders fr each prgram type. Security Awareness Training Security awareness training is required t safeguard the security f the EIV System and data. Users and ptential users will be made aware f the imprtance f respecting the privacy f data, fllwing established prcedures t maintain privacy and security, and ntifying management in the event f a security r privacy vilatin. Befre granting access t the EIV infrmatin, each persn must be trained in EIV Security plicies and prcedures. Additinally, all emplyees having access t EIV Data will be briefed at least annually n the security plicy and prcedures that require their awareness and cmpliance. Infrmatin abut user access and training will be maintained in the prperty EIV file. EIV System Crdinatrs Befre accessing EIV, the Secure Systems Crdinatr will btain a letter frm each prperty wner indicating that the wner gives permissin fr the Secure Systems Crdinatr t act as the EIV crdinatr. Once that permissin is btained, the Crdinatr will review the EIV training material prvided by HUD and cmplete the apprpriate Security Awareness Training and review the EIV Security/User Plicy. Upn cmpletin f these tasks, the EIV Crdinatr will submit, t HUD, the apprpriate Crdinatr Access Authrizatin Frms. Upn receipt f HUD apprval, the EIV Crdinatr will cmplete the EIV Crdinatr setup prcess. The assigned EIV System Crdinatr will make every effrt t fllw HUD as well as KPM plicy regarding EIV prcedures, t the extent all breaches upn discvery will be reprted and every effrt will be made t crrect any such breach. Hwever, the EIV crdinatr may nt be held respnsible fr any ne persn s actins. EIV Users Befre requesting EIV User access, apprpriate staff will review the EIV training material prvided by HUD and cmplete the apprpriate Security Awareness Training and review the EIV Security/User Plicy. Upn cmpletin f these tasks, the EIV User will submit, t the EIV Crdinatr, the apprpriate User Access Authrizatin Frm. If the EIV Crdinatr feels that the EIV User candidate des nt understand the security requirements, the EIV Crdinatr will nt cntinue with the EIV setup fr that user. Nte: Under n circumstances will the EIV Crdinatr prcess the User Access Authrizatin Frm unless the executed Security Awareness Training and the signed EIV Security/User Plicy are attached. Once the user request infrmatin is acceptably cmpleted, the EIV Crdinatr will cmplete the apprpriate steps t prvide EIV access t the user. In accrdance with HUD requirements, the user s need fr access will be reviewed n a bi-annual basis. At least nce a year, staff with EIV access will be required t: Participate in training that includes a review f the EIV Security/User Plicy, and Cmplete the EIV Security Awareness Training Kier Prperty Management (KPM) will restrict access t EIV data nly t persns whse duties r respnsibilities require access. EIV Crdinatrs will be required t request re-certificatin n an annual basis. EIV Crdinatrs are authrized t prvide access nly t thse individuals directly invlved in the tenant certificatin prcess and/r cmpliance mnitring. EIV Crdinatrs will carefully review initial and bi-annual requests fr access and certify nly thse users wh will need cntinued access. The EIV Crdinatr will maintain a recrd f users wh have apprved access t EIV data. Further, the EIV Crdinatr will revke (terminate) the access rights f thse users wh n lnger require such access r mdify the access rights if a change in the user s duties r respnsibilities indicates a change in the current level f privilege. All EIV questins and issues must be submitted t the EIV Crdinatr thrugh the User s supervisr. Kier Prperty Management and Real Estate LLC Revised 10/04/2017 Page 2 f 6 KPM-P111

3 Users will assure that a cpy f HUD-9887/9887-A has been signed by each member f the husehld age 18 years r lder and each family head, spuse r c-head, regardless f age. The HUD-9887/9887-A will be executed at mve-in, annual recertificatin and initial certificatin. If a husehld member turns 18 in the middle f a certificatin cycle, that husehld member must sign HUD-9887/9887-A within ten (10) calendar days after the date f their 18 th birthday. Site Management will be respnsible fr ntificatin t tenants regarding this requirement using apprpriate KPM recertificatin ntices. All HUD-9887 s will be placed in a tenant file and will be updated n an annual basis fr each adult husehld member, as needed. The HUD-9887 Fact Sheet will be prvided t all husehld members age 18 years r lder required t sign the frm. By signing this HUD-9887/9887-A, the applicant/tenant authrizes HUD and/r the wner/agent t btain and verify incme and unemplyment cmpensatin infrmatin frm varius surces, including, but nt limited t the IRS, the Department f Health and Human Services and the Scial Security Administratin, current and frmer emplyers and state agencies. User Names, Passwrds and Passwrd Changes Many systems require frequent changes in passwrds. Secure Systems/ EIV passwrds will be changed in accrdance with HUD Secure Systems requirements. Users will nt share user names r passwrds with any ther emplyee r with anyne utside the rganizatin. EIV access granted t an emplyee r authrized user will be revked when access is n lnger required r prir t terminatin f that emplyee r user t ensure data safety. Terminatin f EIV Access and un-assigning prperty access thrugh Prperty Assignment Maintenance is required. The EIV file will be dcumented t indicate when user access was terminated by the EIV Crdinatr. Dcumentatin f terminatin will be maintained by the EIV Crdinatr in a terminatin file. Cmputer System Security Requirements All cmputer systems and cmputers will have passwrd restricted access. The wner/agent will als use Antivirus sftware t limit data destructin r unintended transmissin via virus, wrms, Trjan hrses r ther malicius means. Remte access by ther cmputers ther than thse specifically authrized is prhibited. Authrized users f EIV data shall nt leave wrk statins unattended when EIV data is displayed n their cmputer screens where unauthrized users may view it. A cmputer will nt be left unattended while the user is lgged in t Secure Systems. If an authrized user is viewing EIV data and an unauthrized user appraches the wrk area, the authrized user will lessen the chance f inadvertent disclsure f EIV data by minimizing r clsing ut the screen n which the EIV data is being displayed. Physical Security Requirements Users will retrieve cmputer printuts as sn as they are generated s that EIV data is nt left unattended in printers r fax machines where unauthrized users may access them. EIV data will be handled in such a manner that it des nt becme misplaced r available t unauthrized persnnel. All Sectin 8 subsidy prgram prperties are required t have lcking file cabinets at the n-site ffice t stre EIV data. Site ffices are pen during psted ffice hurs and lcked all ther hurs. The main ffice is pen during ffice hurs (8:00 a.m. t 5:00 p.m.) and lcked all ther hurs. Each ffice at the main ffice has a lcking dr. An alarm system is als in peratin at the main ffice frm 5:00 p.m. t 8:00 a.m. The tenant files in the main ffice are stred in lcking file cabinets and kept in restricted areas with access fr emplyees nly. Previus tenant files are lcated in a secured strage facility that requires an access cde t enter the facility and keyed access t enter the strage unit. Emplyee access t the strage facility is limited and mnitred. EIV Printuts Reprts available thrugh EIV will nt be printed t a shared printer unless the EIV user plans t immediately retrieve the data. It is preferred that all EIV printuts are sent t the user s desk printer where ever pssible. EIV printuts and dcumentatin f EIV Data will be stred in the tenant file. This entire file will be made available t authrized persns including apprpriate staff r cntractrs (i.e. Service Bureaus, cntractrs perfrming file reviews, etc.) fr the wner/agent, HUD staff, Cntract Administratin staff and the Office f the Inspectr General. If ther persns are tasked with reviewing the file, such as financial auditrs cmplying with the Cnslidated Audit Guide, the auditrs will be required t sign the EIV rules f behavir. EIV Recrd Retentin Kier Prperty Management and Real Estate LLC Revised 10/04/2017 Page 3 f 6 KPM-P111

4 The recrd retentin perid fr EIV dcuments will be term f tenancy plus three (3) years. After the three (3) year perid, all EIV dcuments will be shredded/burned. If a tenant requests a cpy f their wn EIV printut, a cpy will be prvided upn receiving a written request frm, r authrized by said tenant. The authrized user prviding the cpy will nte that the printut is a cpy prvided t the tenant upn request. This nte will include the fllwing: This is nt an riginal, this is a cpy prvided t: On, 20 By (name will be printed) Initials The apprpriate staff will make a nte in the file any time a cpy f the EIV data is btained by authrized persns and taken ff site. This includes cpies prvided t the applicant/tenant, ther internal staff, HUD, CA r OIG staff. Under n circumstances will the EIV infrmatin be prvided t anyne ther than thse nted in this paragraph. Electrnic Infrmatin frm EIV Under n circumstances shuld anyne save r scan EIV infrmatin t retain an electrnic cpy. In rder t ensure cmpliance with HUD s security requirements, EIV infrmatin shuld nly be prduced in hard cpy and maintained in accrdance with the recrdkeeping requirements utlined by HUD. Alternative In sme cases, all f which will require prir written apprval frm the EIV Crdinatr, there may be a need t send r stre EIV infrmatin electrnically. If there is need t stre the infrmatin n a hard drive, a specific flder will be created. The flder will be passwrd prtected t prevent unauthrized access. Infrmatin in the flder will be purged peridically t cmply with HUD s EIV file retentin plicies. If EIV infrmatin is inadvertently cpied t prtable media (CD, DVD, tape, etc.) that prtable media will be destryed apprpriately upn cmpletin f the intended use. Reprting Imprper Disclsures Recgnitin, reprting, and disciplinary actin in respnse t security vilatins are crucial t successfully maintaining the security and privacy f the EIV system. These security vilatins may include the disclsure f private data as well as attempts t access unauthrized data and sharing f User ID s and passwrds. Upn the discvery f a pssible imprper disclsure f EIV infrmatin r ther security vilatin by an emplyee r any ther persn, the individual making the bservatin r receiving the infrmatin will cntact the EIV Crdinatr immediately wh will dcument all imprper disclsures in writing prviding details including wh was invlved, what was disclsed, hw the disclsure ccurred, and where and when it ccurred. The EIV Crdinatr will immediately review the reprt f imprper disclsure and, if apprpriate, the EIV Crdinatr will remve EIV access. Imprper disclsure f any infrmatin is grunds fr immediate terminatin. All emplyees shuld carefully review the EIV Access Authrizatin Frm t understand the penalties fr imprper disclsure f EIV data. Dispsal f EIV Infrmatin EIV data will be destryed in a timely manner based n the infrmatin prvided in HUD s published EIV training materials, HUD ntices, r as prescribed by KPM s plicy and prcedures. KPM s plicy and prcedures will nt allw data retentin that is lnger than the time allwed in the published HUD materials. Use and Handling f EIV Reprts The fllwing EIV reprts are the nly reprts authrized t be used by KPM EIV Crdinatrs and Users. Any ther EIV Reprts listed in the EIV system are nt t be used by KPM EIV Crdinatrs and Users. These reprts will be maintained as specified belw after which said reprt will be shredded/burned. Kier Prperty Management and Real Estate LLC Revised 10/04/2017 Page 4 f 6 KPM-P111

5 All reprts are t be generated by Site Staff: Summary Reprt * (must be generated at Recertificatin Annual and Interim): This reprt prvides Identity Verificatin Status. Used t validate a tenant s SSN, t review and reslve discrepant r invalid persnal identifiers r tenants with a failed r deceased status. Print and retain as asterisk indicates belw NEW ADMISSIONS, including Initial Certificatins (IC): reprt must be generated and printed within 90 days after transmissin f the mve-in certificatin t TRACS. Incme Reprt * (must be generated at Recertificatin Annual and Interim): This reprt prvides emplyment and incme infrmatin reprted in the Natinal Database f New Hires (NDNH) and Scial Security Administratin (SSA) database fr each husehld member wh passes the SSA identity test. The reprt prvides a variety f infrmatin abut each husehld member, such as: TRACS Certificatin Infrmatin, Emplyment Infrmatin, Wages, Unemplyment Benefits, Scial Security Benefits, Dual Entitlement, Medicare Data, Supplemental Security Incme Benefits and SSA Disability Status. NOTE: Incme Reprt des nt include ther incme the husehld may receive such as welfare benefits, mst pensins, child supprt, etc. Print reprt and use as third party verificatin f tenant incme. Cnfirm with tenant EIV data is crrect Required dcumentatin t demnstrate EIV System Cmpliance: N Dispute f EIV Infrmatin: EIV Incme Reprt, current acceptable tenant-prvided dcumentatin, and, if necessary (as determined by the O/A), third party verificatin frm the surce. Disputed EIV Infrmatin: EIV Incme Reprt, with disputed written acrss the sectin being disputed and third party verificatin frm the surce fr the disputed infrmatin. Tenant-reprted incme nt verified thrugh the EIV System: EIV Incme Reprt, current acceptable tenant-prvided dcuments and/r third party verificatin frm the surce. NEW ADMISSIONS, including Initial Certificatins (IC): reprt must be generated and printed within 90 days after transmissin f the mve-in certificatin t TRACS t cnfirm/validate the incme reprted by the husehld. ZERO INCOME TENANT: Incme Reprt must be generated mnthly fr all tenants appearing n the N Incme Reprt t re-verify the status f tenants reprting zer incme. Print and retain with Zer Incme Certificatin Incme Discrepancy Reprt * (must be generated at Recertificatin Annual and Interim): Identifies husehlds where there is a difference f $2, r mre in the wage (under r ver reprted), unemplyment and SSA benefit infrmatin reprted in TRACS fr the perid f incme used fr discrepancy analysis. The reprts serves as a tl t alert O/As that there may be a discrepancy in the incme reprted by the tenant during the perid f incme used fr the discrepancy analysis. Reprt MUST be printed at the same time as the Incme Reprt. Retain as asterisk indicates belw. All discrepancies MUST be investigated t determine whether r nt they are valid. NOTE: O/A is nt expected t recncile dllar amunts t the penny when reslving discrepancies. Reslutin must be nted n printut. NEW ADMISSIONS, including Initial Certificatins (IC): reprt must be generated and printed within 90 days after transmissin f the mve-in certificatin t TRACS. Fllw discrepancy reslutin as stated abve. N Incme Reprt (generated mnthly): This reprt is a tl used t identify tenants wh passed the identity match against SSA s recrds but n emplyment r incme infrmatin was received frm the match against either the SSA r NDNH recrds. Reprt als identifies husehlds wh are reprted as having n emplyment r incme n the mst current Generate and view reprt t identify tenants reprting zer incme; reprt des NOT need t be printed. New Hires Summary Reprt */** (must be generated mnthly): This reprt identifies tenants wh have started new jbs within the last six mnths. Tenants appearing n this reprt wh have nt already reprted the emplyment r incme being reflected must be cntacted by Site Management s that rent adjustments can be made in a timely manner. Generate reprt using All recertificatin mnth ptin; print reprt and nte n the reprt the utcme f the cntact with the tenant (e.g., J. Jnes IR effective ; J. Jnes sent 1 st Interim Recertificatin Ntice ; J. Jnes sent 2 nd Interim Recertificatin Ntice ; J. Jnes TM effective , etc.) Kier Prperty Management and Real Estate LLC Revised 10/04/2017 Page 5 f 6 KPM-P111

6 Retain as asterisk indicates belw. Existing Tenant Search *** (must be generated at the time the applicant is being prcessed fr admissin prir t apprval r denial f husing): This reprt shws if an applicant is currently being assisted at anther HUD site (Multifamily r Public Husing) s bth sites can crdinate Mve-Out and Mve-In dates fr accurate subsidy payments. Search each applicant and applicant husehld members as listed n husing applicatin; print results fr each husehld member. Retain as asterisk indicates belw. Multiple Subsidy Reprt */** (must be generated mnthly): This reprt identifies tenants wh may be receiving rental assistance at mre than ne lcatin. Reprt searches bth Multifamily and Public and Indian Husing. Perfrm search using all husehld members ptin; print results. Retain as asterisk indicates belw. Investigate and reslve all multiple subsidies. Reslutin must be nted n printut. Identity Verificatin Reprts */** (must be generated mnthly): There are tw reprts that can be accessed frm the Identity Verificatin Reprt link. O/As must use bth reprts mnthly t clear up any invalid, discrepant r missing infrmatin in the TRACS database that was nt identified and crrected at the time f recertificatin. Failed EIV Pre-Screening Reprt: This reprt identifies tenants wh fail the EIV pre-screening test because f invalid r missing persnal identifiers (SSN, last name r DOB). Tenants n this list will nt be sent t SSA fr identity match until the persnal identifier infrmatin is crrected in TRACS Print reprt and investigate invalid, discrepant r missing infrmatin (e.g., data entry errrs, etc.) Cntact tenant t reslve all ther invalid, discrepant r missing infrmatin. Reslutin must be nted n printut. Retain as asterisk indicates belw. Failed Verificatin Reprt: This reprt identifies husehld members wh failed the SSA identity test because their persnal identifiers (SSN, last name r DOB) d nt match SSA s recrds as well as identifies deceased husehld members. Print reprt and investigate the reasn they did nt pass (e.g., data entry errrs, etc.). Cntact tenant t reslve all ther reasns fr failure. Crrectins must be transmitted t TRACS. Reslutin must be nted n printut. Retain as asterisk indicates belw. Deceased Tenant Reprts */** (must be generated mnthly): This reprt identifies tenants that SSA has reprted as being deceased. Generate reprt using All recertificatin mnth ptin; print and reslve discrepancies. Nte reslutin n printut (e.g., J. Jnes MO effective , J. Jnes IR effective , J. Jnes TM effective , Cntacted Mr. Jnes n and verified he is still alive, advised J. Jnes t visit lcal SSA Office.) Retain as asterisk indicates belw. All discrepancies must be reslved within the timeframes required in HUD Ntice Enterprise Incme Verificatin (EIV) System, Attachment 6: Use f EIV Reprts. Fr mre infrmatin n O/A Reprt Use, File Dcumentatin and Retentin, see abve HUD Ntice. I have read and understand the EIV Security/User Requirements. I agree t abide by this plicy, use the EIV system as intended, and t reprt any imprper disclsure f infrmatin. Name (please print) Signature / / Date * If there is a discrepancy listed, the reprt must be printed n dark blue paper and be retained in the Tenant s File with supprting dcumentatin fr term f tenancy plus three (3) years. ** Regardless f the results, a cpy f the reprt must be printed n white paper and be retained in the Master File fr three (3) years. *** T be retained with the Applicatin fr three (3) years (if nt admitted) r in the Tenant s File fr term f tenancy plus three (3) years (if admitted). CC: Persnnel File; Prperty EIV Master File Kier Prperty Management and Real Estate LLC Revised 10/04/2017 Page 6 f 6 KPM-P111