Housing Help Sessions - Nan McKay & Associates

Housing Help Sessions - Nan McKay & Associates
©©Copyright
Copyright2009
2009Nan
2008
NanMcKay
McKay&&Associates
Associates
HousingHelp
Help
Sessions
Housing
Sessions
Name
EIV
Security
of session
/ EIV Update:
– date
March
of session
13, 2009
Earned Income
Disallowance
NMAHost:
Host:
NMA
TrainerAnnie
Enter
your name here
Trainer
Stevenson
© Copyright 2009 Nan McKay & Associates
Welcome to Your Housing Help Session!
ƒ Today’s Topics:
ƒ EIV Update
ƒ Recent webcasts
ƒ EIV Security
ƒ New requirements
ƒ HUD training
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 2
1
© Copyright 2009 Nan McKay & Associates
Welcome to Housing Help!
ƒ Upcoming topics for the management series:
ƒ 4/10/09: Creating & managing a housing nonprofit
(PH)
ƒ 4/17/09: Managing your HCV funding
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 3
© Copyright 2009 Nan McKay & Associates
EIV Update
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 4
2
© Copyright 2009 Nan McKay & Associates
HUD’s EIV Web Page
ƒ http://www.hud.gov/offices/pih/programs/ph/rhi
ip/uivsystem.cfm
ƒ EIV User Manual (Version 8.0, December 2007)
ƒ Privacy and Security Requirements
ƒ Security Procedures Guide
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 5
© Copyright 2009 Nan McKay & Associates
EIV Update
ƒ HUD training webcasts on EIV
ƒ 1/16/08
ƒ 8/26/08
ƒ 2/11/09 – 2/12/09
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 6
3
© Copyright 2009 Nan McKay & Associates
EIV Update
ƒ 2/09 webcasts are archived at:
http://www.hud.gov/webcasts/archives/ph.cfm
ƒ 2008 webcasts are archived at:
http://www.hud.gov/webcasts/archives/iv.cfm
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 7
© Copyright 2009 Nan McKay & Associates
EIV Update
ƒ Training materials from webcasts
ƒ PowerPoints
ƒ Case studies & solutions
ƒ Handouts
ƒ http://www.hud.gov/offices/pih/programs/ph/rhiip/tr
aining.cfm
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 8
4
© Copyright 2009 Nan McKay & Associates
January 2008 Webcast
ƒ HUD webcast 1/16/08 contained revised
guidance on use of EIV
ƒ Previous guidance is obsolete and has been
removed from EIV website
ƒ $2400 discrepancy
ƒ Instructions on anticipating income with EIV
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 9
© Copyright 2009 Nan McKay & Associates
HUD Guidance on EIV
ƒ EIV is sufficient as third-party verification
when:
ƒ The family does not dispute the data, and
ƒ Current tenant-provided documents (i.e.
paystubs) are available
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 10
5
© Copyright 2009 Nan McKay & Associates
HUD Guidance on EIV
ƒ The PHA MUST obtain additional thirdparty verification when the family
disputes EIV employer data
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 11
© Copyright 2009 Nan McKay & Associates
HUD Guidance on EIV
ƒ The PHA MAY obtain additional third-party
verification when the PHA determines that
additional information is necessary, such
as:
ƒ Effective dates of employment
ƒ Pay rate, hours worked for new jobs
ƒ Confirmation of a change in circumstances
(reduced hours, reduced rate of pay)
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 12
6
© Copyright 2009 Nan McKay & Associates
HUD Guidance on EIV
ƒ Use tenant-provided documents to
project annual income, unless:
ƒ The family disputes EIV employer data,
OR
ƒ The PHA determines that additional
information is necessary
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 13
© Copyright 2009 Nan McKay & Associates
HUD Guidance on EIV
ƒ HUD recommends that tenant-provided
documents should be dated within 60
days of interview date
ƒ Current and consecutive
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 14
7
© Copyright 2009 Nan McKay & Associates
HUD Guidance on EIV
ƒ Quote from webcast:
ƒ “The PHA will use tenant-provided
documents or most current information to
calculate anticipated annual income.”
ƒ EIV quarterly wages are NOT used to
project annual income
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 15
HUD Guidance on EIV:
File Documentation
© Copyright 2009 Nan McKay & Associates
ƒ If the family does not dispute EIV employer
data, and the PHA determines that
additional information is not necessary:
ƒ EIV income details report
ƒ ICN in FL
ƒ Tenant-provided documents
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 16
8
HUD Guidance on EIV:
File Documentation
© Copyright 2009 Nan McKay & Associates
ƒ If the family disputes, or PHA requires
additional information:
ƒ EIV printout (except in FL)
ƒ Tenant-provided documents
ƒ Third-party written verification
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 17
© Copyright 2009 Nan McKay & Associates
August 2008 Webcast
ƒ Comprehensive training on “Effective Use of
EIV”
ƒ Extensive discussion of EIV reports and their
usage
ƒ New reports
ƒ Added functionality
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 18
9
© Copyright 2009 Nan McKay & Associates
August 2008 Webcast
ƒ EIV sign-on now includes certification of EIV &
security training
ƒ HUD webcast training is sufficient
ƒ EIV training and annual EIV security training are
separate requirements
ƒ Staff members may view webcast(s) and obtain
certification from HUD
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 19
© Copyright 2009 Nan McKay & Associates
August 2008 Webcast
ƒ Clarification that EIV is sufficient verification of
SS/SSI if family agrees
ƒ Discussion of identity theft
ƒ Guidance on use of income discrepancy report
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 20
10
© Copyright 2009 Nan McKay & Associates
2008 Webcasts
ƒ Both 2008 webcasts include case studies of
unreported income
ƒ Calculation method for overpaid subsidies
ƒ First written guidance from HUD on this issue
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 21
© Copyright 2009 Nan McKay & Associates
2/09 Webcasts
ƒ Day 1: First 2 hours on rent refinement final
rule
ƒ FR notice 1/27/09
ƒ HUD has proposed delay of effective date for
further review
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 22
11
© Copyright 2009 Nan McKay & Associates
2/09 Webcasts
ƒ Deceased tenant report: single-member
households now marked with red asterisk
ƒ User ID masked per PHA requests
ƒ PH flat rent families are now excluded from the
income discrepancy reports
ƒ Additional planned improvements for 2009 &
2010
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 23
© Copyright 2009 Nan McKay & Associates
HUD Consolidated Reviews
ƒ Program areas under review:
ƒ RIM
ƒ UIV
ƒ SEMAP
ƒ PHAS Management Assessment (MASS)
ƒ Civil rights
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 24
12
© Copyright 2009 Nan McKay & Associates
HUD Consolidated Reviews
ƒ HUD UIV Monitoring Report
ƒ Implementation review
ƒ Security assessment
ƒ Income discrepancy review
ƒ5 highest dollar discrepancies per program
ƒ Link in your HHS e-mail
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 25
© Copyright 2009 Nan McKay & Associates
EIV Data Security
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 26
13
© Copyright 2009 Nan McKay & Associates
Introduction
ƒ HUD has published an EIV Security
Procedures manual for PHAs
ƒ Available on HUD’s EIV web page
ƒ See workbook references tab
ƒ EIV security requirements are mandatory
ƒ Violations may result in civil and/or criminal
penalties
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 27
© Copyright 2009 Nan McKay & Associates
Introduction
ƒ The information in this session is adapted
from 2 sources:
ƒ HUD’s EIV Security Procedures manual
ƒ HUD’s EIV webcasts
ƒ “Includes security awareness training”
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 28
14
© Copyright 2009 Nan McKay & Associates
Introduction
ƒ In this session, we will cover:
ƒ Privacy Act requirements
ƒ Overview of policies and controls for securing
UIV data
ƒ Administrative
ƒ Technical
ƒ Physical
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 29
© Copyright 2009 Nan McKay & Associates
Privacy Act Requirements
ƒ Whenever HUD or a PHA requests information
about a tenant they should ensure the following:
ƒ The data is only used for verification of tenant
income to determine:
ƒ a tenant’s eligibility for participation in a rental
assistance program
ƒ the level of assistance that they are entitled to
receive
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 30
15
© Copyright 2009 Nan McKay & Associates
Privacy Act Requirements
ƒ Whenever HUD or a PHA requests information
about a tenant they should ensure the following:
ƒ It is not disclosed in any way that would violate
the privacy of the individuals represented in the
system
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 31
© Copyright 2009 Nan McKay & Associates
Privacy Act Requirements
ƒ The tenant is notified of the following:
ƒ HUD or the PHA’s authorization and purpose
for collecting the information
ƒ the uses that may be made of the data
collected, and
ƒ the consequences to the individual for failing to
provide the information
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 32
16
© Copyright 2009 Nan McKay & Associates
Privacy Act Requirements
ƒ On request, the tenant is provided with
access to records pertaining to them and an
opportunity to correct or challenge the
contents of the records
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 33
Civil Penalties Associated with
the Privacy Act
© Copyright 2009 Nan McKay & Associates
ƒ A tenant may take legal action against
HUD or a PHA for the following agency
actions:
ƒ Refusal to grant access to a record
ƒ Refusal to amend or correct a record
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 34
17
Civil Penalties Associated with the
Privacy Act
© Copyright 2009 Nan McKay & Associates
ƒ If found liable, HUD or the PHA will be
required pay the tenant:
ƒ Damages sustained as a result of
the agency’s action
ƒ The costs of the lawsuit, including
reasonable attorney fees
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 35
Criminal Penalties Associated with the
Privacy Act
© Copyright 2009 Nan McKay & Associates
ƒ A PHA employee can be found guilty of a
misdemeanor or a felony if that employee,
knowingly and willfully:
ƒDiscloses a tenant’s records to an
unauthorized party
ƒFraudulently represents him/herself to obtain
another individual’s record
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 36
18
© Copyright 2009 Nan McKay & Associates
Security Safeguards
ƒ HUD describes 3 types of safeguards:
ƒ Administrative
ƒ PHA access policies
ƒ Technical
ƒ Part of EIV system
ƒ Physical
ƒ Barriers to unauthorized access
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 37
© Copyright 2009 Nan McKay & Associates
Administrative Safeguards
ƒ PHAs should implement administrative
safeguards to address the following:
ƒ Assigning and monitoring access rights
ƒ Determine which users should have access to
UIV information
ƒ Maintain a record of all users who have
approved access to UIV data
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 38
19
© Copyright 2009 Nan McKay & Associates
Administrative Safeguards
ƒAssigning and monitoring access rights
ƒConduct a quarterly review of all user IDs to
determine if the user still has a valid need to
access the UIV data
ƒEnsure that access rights are modified or
revoked as appropriate
ƒMore information: Day 1 of 2/09 webcast
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 39
© Copyright 2009 Nan McKay & Associates
Administrative Safeguards
ƒKeeping records and monitoring security issues
ƒAssure that a copy of Form HUD-9886 has been
signed by each adult member of the household and
is kept in the household file
ƒMaintain a key control log to track the inventory of
keys available, the number of keys issued and to
whom the keys are issued
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 40
20
© Copyright 2009 Nan McKay & Associates
Administrative Safeguards
ƒKeeping records and monitoring security issues
ƒEnsure that all employees and contractors who have
been issued keys to secure areas complete a form
acknowledging the receipt of the key
ƒMaintain a log of all users who access designated secure
areas including the date and time of entry and exit and
the purpose of the access
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 41
© Copyright 2009 Nan McKay & Associates
Administrative Safeguards
ƒKeeping records and monitoring security issues
ƒEnsure that combination locks are reset regularly,
including whenever an employee leaves the PHA
ƒEnsure that UIV information is disposed of in an
appropriate manner and maintain a log of all documents
that have been burned or shredded
ƒOr may follow written records retention policy
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 42
21
© Copyright 2009 Nan McKay & Associates
Administrative Safeguards
ƒConducting security awareness training
ƒEnsure that all users of UIV data receive training in
UIV security policies and procedures at the time of
employment and at least annually afterwards
ƒMaintain a record of all personnel who have
attended training sessions
ƒTrain on individual PHA policies as well as HUD or
third-party training
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 43
© Copyright 2009 Nan McKay & Associates
Administrative Safeguards
ƒConducting security awareness training
ƒCommunicate security information and
requirements to appropriate personnel
ƒDistribute all user guides and security procedures
to personnel using UIV data
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 44
22
© Copyright 2009 Nan McKay & Associates
Administrative Safeguards
ƒReporting improper disclosures
ƒReport any evidence of unauthorized access or
known security breaches to the PHA executive
director
ƒDocument all improper disclosures in writing
ƒReport all security violations regardless of
whether the security violation was intentional or
unintentional
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 45
© Copyright 2009 Nan McKay & Associates
Technical Safeguards
ƒ Purposes of the technical safeguards:
ƒ Reduce the risk of a security violation related to the EIV
systems’ software, network, or applications
ƒ Identify and authenticate all users seeking access to the
UIV data
ƒ Deter and detect attempts to access the system without
authorization
ƒ Monitor the user activity on the EIV system
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 46
23
© Copyright 2009 Nan McKay & Associates
Technical Safeguards
ƒThe technical controls that have been built into the
EIV systems address the following:
ƒ User identification and authentication
ƒEach user is required to have their own user ID
and password
ƒThe user ID identifies the PHA(s) and tenant
information that the user is authorized to access
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 47
© Copyright 2009 Nan McKay & Associates
Technical Safeguards
ƒUser identification and authentication
ƒPasswords are encrypted and the password
file is protected from unauthorized access
ƒThe system forces all users to change their
password every 21 days and limits the reuse
of previous passwords
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 48
24
© Copyright 2009 Nan McKay & Associates
Technical Safeguards
ƒUser identification and authentication
ƒ After three unsuccessful attempts to log into PIC,
the user ID is locked. All PIC password resets are
handled by the security administrators at the PHA
or in the local HUD Field Office. Additional
information and assistance can be obtained from
[email protected] In using the EIV system, the log
on restrictions do not apply.
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 49
© Copyright 2009 Nan McKay & Associates
Technical Safeguards
ƒOnline user alerts
ƒOnline warning messages that inform the
user of the civil and criminal penalties
associated with unauthorized use of the UIV
data
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 50
25
© Copyright 2009 Nan McKay & Associates
Physical Safeguards
ƒ PHAs may implement any combination of the following
physical safeguards:
ƒ Locked and monitored buildings, offices, or storage rooms
ƒ Locked and monitored metal file cabinets
ƒ Designated secure areas and equipment
ƒ Security rooms or locked office space with limited points of
entry (e.g., doors) and means of entry (e.g., keys)
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 51
© Copyright 2009 Nan McKay & Associates
Physical Safeguards
ƒ Designated secure areas and equipment
ƒ Restricted areas with prominently posted signs or other
indicators identifying them and limited points of entry
ƒ Physical and administrative means for monitoring access to
the secure areas and access and use of the protected data
ƒ Restricted use printers, copiers, facsimile machines, etc.
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 52
26
© Copyright 2009 Nan McKay & Associates
Physical Safeguards
ƒ Secure computer systems and output
ƒ Store UIV data in a separate, restricted-access
directory if files are saved to local machine
ƒ Label all diskettes containing UIV data “Confidential” or
“For Official Use Only”
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 53
© Copyright 2009 Nan McKay & Associates
Physical Safeguards
ƒ Secure computer systems and output
ƒ Retrieve all computer printouts as soon as they are
generated so that UIV data is not left lying
unattended in printers
ƒ Avoid leaving a computer unattended with UIV data
displayed on the screen
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 54
27
© Copyright 2009 Nan McKay & Associates
Physical Safeguards
ƒ Disposal of UIV information
ƒ Destroy as soon as it has served its purpose or as
prescribed by the PHA’s policy and procedures
ƒ 2/09 webcast: destroy after 2 years
ƒ All UIV originals and copies should either be burned or
shredded
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 55
© Copyright 2009 Nan McKay & Associates
Implementing Safeguards
ƒ Technical safeguards alone, without
complementary physical safeguards and/or
administrative safeguards, do not meet HUD’s
standard for the protection of private data
ƒ PHAs are strongly encouraged to take all
reasonable steps to implement a combination of
technical, physical, and administrative safeguards
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 56
28
© Copyright 2009 Nan McKay & Associates
Implementing Safeguards
ƒ The physical and administrative
safeguards that are implemented by a PHA
must be appropriate when considered in
combination with the technical safeguards
available to the PHA through the EIV system
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 57
© Copyright 2009 Nan McKay & Associates
EIV Security
ƒ The PHA should develop an EIV security plan
ƒSeparate from admin plan
ƒSee Security Procedures manual
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 58
29
© Copyright 2009 Nan McKay & Associates
EIV Security
ƒFirst steps:
ƒAssess current security measures
ƒCompare to requirements for EIV
ƒAdministrative safeguards
ƒPhysical safeguards
ƒDecide upon “reasonable” steps to assure security of
UIV data
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 59
© Copyright 2009 Nan McKay & Associates
Security Procedures Manual: Tools
ƒ Rules of Behavior/User Agreement
ƒ Each authorized user
ƒ PHA Access Authorization Form
ƒ Completed by PHA for each user
ƒ Key receipt form
ƒ Restricted area access log
ƒ And more!
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 60
30
© Copyright 2009 Nan McKay & Associates
NMA Housing Help Session
NEXT TOPIC…
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 61
© Copyright 2009 Nan McKay & Associates
NMA Housing Help Session
Housing Help Sessions
EIV Security / EIV Update: March 13, 2009
Slide 62
31
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement