FFY2012 EAP Annual Training Section 5

1. FFY2012 EAP Annual Training Section 5 Includes Chapter 13 Incidents & Appeals, Chapter 14 Communication, Information & Reports, Chapter 15 Data Practices & Records, Chapter 16 Grant Contracts, Chapter 17 Program Fiscal Management, Chapter 18 Monitoring & Technical Assistance and eHEAT Enhancement List

2. Chapter 13: Incidents & Appeals

3. Chapter 13: Training Topics • Context • Policies and Procedures • Chapter Changes • Process Highlights and Reminders • New Appendix

4. Chapter 13: Context • Office of Administrative Hearings (OAH) Appeal • General Accounting Office (GAO) • Office of the Legislative Auditor (OLA) • National Program Integrity Workgroup • Energy vendor monitoring is a key tool in fraud discovery and prevention

5. Chapter 13: Chapter Changes • Chapter Title • Reorganization • Incidents then Appeals • Structured according to Processes and Procedures • Non-policy changing language rewrites throughout • Intent is to provide better Clarification • Encourage full review of chapter

6. Chapter 13 - Reorganization Chapter Contents Incidents • Types of Incidents • Incident Reporting • Errors • Fraud • Overpayments • Disasters and Emergencies Appeals • General Appeal Procedures • Appeal Timelines • Service Provider Procedures • State Office Appeal Procedures • Office of Administrative Hearings

7. Chapter 13 – New Language Types of Incidents (Page 1) Incidents are program events occurring outside of normal business activities and operations. Types of incidents include: Event Notifications • Events including use of the Walk Away policy, subpoena or other court order requests, or an event that the Service Provider believes rises to the level of an incident and believes the State Office should be made aware. Data Security and Breaches

8. Types of Incidents (Continued) Errors • Unintentional misuse of program funds or unintentional mistakes in the handling and processing of application information.  • An event that can result in accidental over or under payment to energy vendors or households. Events of Suspected Fraud • Events including suspected or intentional deception, omission, or concealment made for personal gain, to assist or harm others and/or misuse of program funds. Disasters and Emergencies

9. Chapter 13 – Updated Form Updated Incident Report Form (Appendix 13A) • New Fields: • Contact Name • Phone Number • Date of Submission • All fields must be completed before submitting form • Follow incident handling procedures outlined in Chapter 13 • Ask questions along the way

10. Ch. 13: New Fraud Procedures Investigation of Suspected Fraud (Page 2) When undertaking the investigation the Service Provider must: • Report the situation to the DOC by completing and submitting an Incident Report Form to the DOC and assigned EAP Field Representative via eap.mail@state.mn.us. Coordinate actions with the DOC. • Ensure due process and protect the privacy rights of the household. If legal action commences, the privacy rights may change. • Contact agency’s fraud investigator, management and/or corporate attorney to determine next steps. • Stop payments to the energy vendor or household and request a refund or freeze of EAP credit on the household’s energy vendor account. • Collect and verify facts and information to determine if an error or potential fraud occurred.

11. Investigations of Suspected Fraud Continued • Collect and verify facts and information to determine if an error or potential fraud occurred. • Conduct follow-up interviews to obtain additional information, if necessary. • Report the suspected fraud to the local authority who handles fraud cases (district attorney, sheriff, etc.). • Take appropriate action to safeguard public resources such as requesting repayment of EAP funds from the household. • Deny the household for the current program year if the applicant is found guilty of fraud. • The Service Provider must track fraud cases until completion including convictions and restitution if applicable and submit all updates and conclusions to the DOC.

12. Ch. 13: Fraud Policies & Procedures Assure Due Process and Diligence • Each step outlined in the error and fraud sections must be followed from discovery to reporting to investigation to communication to action. • There are additional steps for suspected vendor or contractor fraud. • In error and suspected fraud discoveries don’t assume end result, follow each step in the process • Maintain DOC communication • Documentation is critical

13. Chapter 13 – New Language Preventing and Detecting Errors or Fraud (Page 2) • Service Providers must utilize procedures by establishing internal controls and self monitoring activities to reduce, find and correct errors that may occur during intake, verification, certification and bookkeeping activities. Where feasible, divide responsibility for application intake, data entry, verification, certification and payments. This separation between duties, verifying accuracy and other internal controls can reduce situations that would allow for potential errors and fraud to occur. • Reminder: Internal Controls should address Households, Service Providers, and Vendors

14. Chapter 13 – New Policy Overpayments & Recovery of EAP Funds Section (Page 3, also in Chapter 11): • A “Benefit Fix” is required when an EAP benefit changes by $10 or greater. Any resulting overpayment not recovered by adjusting scheduled payments or recalling EAP credit on the household’s vendor account must be recovered from the household. • Listed in this section to remind Service Providers of the overpayment step in error and fraud procedures.

15. Chapter 13 – New Policy New Sub-Section: Overpayment Documentation Service Providers must document overpayments when recovering EAP funds paid to a household, energy vendor or contractor. The documentation must include: • A list of households in which an overpayment was made. • The date the household, Service Provider, energy vendor or contractor was notified of the overpayment. • Description of the incident and when it occurred. • How and when the incident was discovered. • The disposition made, i.e., amount to recover. • The date and/or amount of any recovery or the amount of un-collectible funds • Corrective action to prevent similar occurrences.

16. Chapter 13 – New Language Appeals Process – 4 Stages • Stage 1: Local Level Informal Complaint • Stage 2: Local Level Formal Appeal • Stage 3: DOC State Office Appeal • Stage 4: Office of Administrative Hearings

17. Ch. 13 Appeals Policies & Procedures • Processes are more clear in the chapter now. Follow each step and contact the DOC as needed • Timelines are crucial. These must be followed by the SP/DOC (likely to be lenient for the Household) • Be clear with households on how to appeal • Requirements of appeal correspondence • Retaining documentation • OAH Appeals Stage: New Language from the OAH

18. Ch. 13: New Tracking Requirement Local Level Formal Appeal Tracking (Page 8) • Service Providers are required to maintain information on local level appeals using the Local Level Formal Appeals Tracking form (Appendix 13B). • This spreadsheet must be usedto track all local level formal appeals and updates as they occur. The DOC may request this information at any time. • Also will be reviewed during monitoring visits • Tracking form was sent out with the Local Plan

19. Q & A: Incidents & Appeals Coordinator’s Role

20. Chapter 14 Data Practices & Records

21. Ch. 14: Data Practices & Records Training Topics • Importance of Data Security – Internal Controls • Security of Records – Email (Review) • DOC has a new secure email system (Not in manual) • Technology Security - Electronic Files • Permissions – Privacy Notice (New) • Segregation of duties • Security Agreements – Reliable controls, documentation • Monitoring - State Access to Records • Technology Security • Disclosure Statement

22. Ch. 14: Data Practices & Records Importance of Data Security – Internal Controls Due to the dangers of giving out personal information the government has responded with laws like the Minnesota Government Data Practices Act (MGDPA), which regulates how governmental agencies can collect and use information • Internal controls must restrict unauthorized and unnecessary access to household information

23. Importance of Data Security Civil and Administrative Remedies for Violations Civil Action: An individual or the representative of a decedent damaged by a government agency’s violation of the act may recover damages, costs, and attorney fees as part of a civil action in action in district court. For a willful violation, exemplary damages of $1,000 to $15,000 per violation may be imposed. The district court may also issue an injunction ordering a government agency not to violate the act. (Minn. Stat. § 13.08, subds. 1 and 2) • May also be criminal penalties in some cases for violations of the act including the failure of a government entity to comply with the act’s provisions

24. Security of Records – Email (Ch. 14, p. 2) E-Mail Data Privacy To maintain data privacy on e-mails: • Use only household numbers for identification when possible • Use secure e-mail practices when private household data is included • Use secure e-mail practices to send New Vendor information containing Tax IDs and/or Social Security Numbers • Remind vendors to use only EAP household numbers and vendor account numbers when communication via e-mail about a customer • Contact DOC for help if a vendor does not cooperate with data privacy requirements, as required by the vendor agreement

25. Security of Records – Email(Ch. 14, p. 4) Assure that e-mails do not contain private information, or, if they must, have an acceptable process for encrypting them. Note:Household numbers are not private information. Names and addresses and other identifying information are private • Email attachments containing private data are more common violations of security • Use EAP HH # and energy vendor customer account numbers (Do not use names unless email is encrypted)

26. State’s Secure Email System The system the DOC EAP uses for delivering encrypted messages is Microsoft Exchange Hosted Encryption • The Energizer #33 introduced system • Registration required for first message received • Relies to email are encrypted

27. Technology Security - Electronic Files Service Providers must incorporate business practices needed to safeguard electrically stored data • File back-up • Scanned household records • Limited access to system files • Laptop computers • Access – Windows password • Work from home

28. Permissions – Privacy Notice (Chap. 14, p. 5 – 6) Staff of other organizations may also have access to private EAP data they need to carry out job responsibilities for EAP administration, research and evaluation. These situations will usually involve use of data in ways that are not routine. Please contact your DOC Field Representative before providing information to these agencies: • SP staff must be aware that the list was rewritten

29. Segregation of Duties Roles and Responsibilities (Chap. 4, p.7) • Service Providers must ensure electronic and physical records of private data can only be accessed by staff assigned to use the data • Limiting staff access to only data necessary for their job assignments is accomplished partly by limiting their eHEAT functions • Enable and disable eHEAT users as needed

30. eHEAT Security Agreements New eHEAT Security Agreement signed every year • Part of internal control for EAP • Regular review • Review job duties in relation to eHEAT roles/functions • Segregation of duties and back-up staff assessment Best practice: Coordinate with data practices training

31. Monitoring - State Access to Records EAP Contract - #10. Monitoring and Corrective Action • 10.1 Monitoring. The Grantee will allow the State access to its business site(s) and will secure written permission from its subgrantees to allow the State access to subgrantees’ sites and records for the purpose of monitoring Grantee performance, compliance with contract requirements. The Grantee will cooperate with the State in the performance of such monitoring activities.

32. Is Disclosure Statement Possible Can a disclosure statement be developed by EAP to limit the information a data subject can request about their application? • Minnesota Government Data Practices Act (MGDPA) gives a data subject access to all private information regarding them • Programs cannot limit data • Best practices: • Keep only required information • Timely disposal of records • Keep professional notes

33. Q & A: Data Practices & Records Coordinator’s Role

34. Chapter 15 Communication, Information & Reports

35. Chapter 15 Training Topics • FSR due date change • Website standards • New DOC web site • Quality & Performance Control Reports • Late reporting tracking and escalation

36. FSR due date change Ch 15, page 7 The FSR due date was changed back to 15th of the month • Last year the due date was changed to the 5th of the month to correspond with the WAP FSR due date • SP fiscal staff notified DOC that it was difficult for them to meet the earlier due date

37. Website Standards New Policy: SP websites must meet these standards: Ch 15, page 7 • Contain local SP address and phone number • Have basic information about EAP (i.e. eligibility, services) • Have current EAP application with local provider name/address/phone or a link to the DOC web application with clear instructions to mail the completed application to local SP • Use of the local SP application is preferred. • Gives HHDs the correct SP contact information and ensures applications get to the local SP quickly. • Links go to the correct DOC website address www.energy.mn.gov

38. New DOC website • DOC is currently redesigning their website • They hope to be done within 5 weeks • Redesigned with better site organization so consumers can find information more easily • Continue to use the www.energy.mn.gov website address

39. Quality & Performance Control Reports Reports are run to ensure: • These reports are an important internal control activity • Program integrity and audit-ability • High quality, timely service to EAP households • Proper implementation of EAP policies • Attention to problems early before they become critical

40. Q&PC Reports (cont.) • Many SPs now run these reports themselves • Self monitoring is key to having good internal controls • Thank you for your responses this past year • Issues have been identified and addressed early • The end of year data is much cleaner than in the past

41. Q&PC Process • Q&PC reports are done by DOC throughout the program year • DOC reviews the reports at the weekly staff meeting • Some Q&PC reports are sent to SPs to make corrections • SPs have a deadline to respond to DOC for some reports: • Duplicate Vendor Account • Duplicate Address • To make the process smoother, timeline was standardized: • Reports are emailed to SPs on Wednesday • Responses are due the following Tuesday • SP should notify DOC if report will be late – must let us know Suggestion: Make it a routine and have a calendar reminder

42. Q&PC Process (cont.) Respond as instructed • DOC has automated the process and the process does not work right if the information is submitted in an incorrect format • Starting in FFY12 Q&PC reports will be returned to the SP if the submission format is incorrect

43. Q&PC Process (cont.) Late reporting tracking and findings • SP response is required • Late or non-responses to QP&C reports are tracked • These reports are treated like other reports and are subject to the late report policy in the EAP Policy Manual

44. Q & A: Comm., Info. & Reports Coordinator’s Role

45. Chapter 16 Grant Contract

46. Grant Contracts Chapter 16 Contract & Local Plans Timelines • Shut down affected everyone's timeline • Original due date: July 15 • Shutdown due date: August 5 • Where we are: Reviews will be conducted during the next two weeks following training - Please respond expeditiously • SP will be notified by reviewer if there are changes needed • AfterLocal Plan is approved – we will notify you • Sign Local Plan and send back by October 1 • Without - cannot start/money • State approval is required before cash may be requested

47. Chapter 16 Contracts Procedure (where we are in the process) • DOC is preparing and executing contracts • DOC will mailed out for signatures • Come back with SP signatures • Combined with Local Plans • Final signed Contract & Local Plans are distributed • Begin the 31st year of LIHEAP Grant Contracts (Continued)

48. Local Plan additions Incidents and Appeals • Incident Management Plan Updated Incident Report form • Appeal Tracking (formal) Local Level Appeals Tracking Form (sent out with Local Plan on June 24) • Will be in “Tools on the Web” Conflict of Interest • GAO report and HHS response are drivers • Conflict of Interest Policy (most SP’s have this in their personnel policy manual) • Business conflict of Interest

49. Local Plan additions (Continued) Inventory Controls/Travel/Equipment • OLA • Documentation Service Provider Website Standards • Can use A16 dollars for EAP website design Self Monitoring/Internal Controls Energy Vendor Monitoring

50. Q & A Grant Contracts Coordinator’s Role