Adult Medicaid Admin. Letters

DMA ADMINISTRATIVE LETTER NO. 16-02 ADDENDUM 1

DSS ADMINISTRATIVE LETTER NO. ECONOMIC INDEPENDENCE

(WORK FIRST AND FOOD STAMPS) 04-2002

DSS ADMINISTRATIVE LETTER NO. ADULT AND FAMILY SERVICES 02-2002

DIVISION OF AGING, ADULT SOCIAL SERVICES SECTION ADMINISTRATIVE LETTER 04-1

TO: COUNTY DIRECTORS

ATTENTION: INCOME MAINTENANCE DIRECTORS

MEDICAID CASEWORKERS AND SUPERVISORS

WORKFIRST CASEWORKERS AND SUPERVISORS

FOOD STAMP CASEWORKERS AND SUPERVISORS

SPECIAL ASSISTANCE CASEWORKERS AND SUPERVISORS

SECURITY CONTROL OFFICERS

FRR/BEER CONTROL OFFICERS

DATE: February 15, 2004

SUBJECT: SECURITY OF INTERNAL REVENUE SERVICE (FRR) AND SOCIAL SECURITY ADMINISTRATION INFORMATION (BEER)

I. General

The purpose of this letter is to provide updated information concerning the requirements for using and securing Federal Tax Information (FTI) received from the IRS and the SSA. The changes in this letter are effective immediately.

The changes include:

A. Additional information needed on the Internal Inspection form about the destruction process

B. A revised log of who has accessed FRR/BEER reports.

C. Definitions for “Return” and “Return Information”.

D. Labeling of storage areas.

E. Retention of the FRR and BEER reports.

F. Changes to the original Administrative Letter

These modifications are a result of the IRS Safeguard Review completed in February 2003.

II. Internal Inspection form

One question has been added to the Internal Inspection form (Attachment I). The Medicaid Program Representative (MPR) completes the internal inspection form annually.

Question (13.c): Are the FRR/BEER reports destroyed in the presence of county dss staff? (If NO, please provide a narrative of the county’s destruction process.)

The above question was added because it is not only important that the FRR/BEER reports are destroyed, but that a county dss employee is present during the destruction process. For example, if your county uses a contractor to shred or incinerate all your paper reports and the contractor picks up the shred material and takes it off site to destroy, then a county dss employee must accompany them until the reports are destroyed.

IRS Publication 1075 states:

“Federal Tax Information (FTI) must never be disclosed to an agency’s agents or contractors during disposal unless authorized by the Internal Revenue Code.” (IRS Publication 1075, page 31, 8.4)

III. Access/DISTRIBUTION Log

A. Changes to the Log

Since Federal Tax Information received from the IRS is distributed to several different program areas, the IRS requested that a column be added to the log indicating in which program area (MA, SA, FS, or WF) the reports are used (Attachment IV).

B. Updating the Log

Because of the sensitive nature of the data being handled, it is important that both the access/distribution log (Attachment IV) and destruction log (Attachment V) be updated immediately after the reports are distributed, received back, or destroyed. If any reports are missing you will know immediately instead of several weeks or months later.

IV. Definitions

“Each agency receiving Federal Tax Information (FTI) should have an awareness program that annually notifies all employees having access to FTI of the confidentiality provisions of the Internal Revenue Code (IRC), a definition of what “returns” and “return information” is, and the civil and criminal sanctions for unauthorized inspection or disclosure” (IRS Publication 1075, Page 28, 7.2).

Make sure each worker receives a copy of the definitions in Attachment VIII during the safeguard awareness training.

V. LABELING STORAGE AREAS

Any location in the agency where FTI is stored must be marked as containing FTI. Please label any file cabinets or storage area with Attachment VII.

VI. Retention of the FRR and BEER reports

Based on the most recent issue of the DHHS records retention schedule, the FRR and BEER reports must be maintained to match the case record retention schedule as published by DHHS. The following retention schedule documents can be viewed at http://www.dhhs.state.nc.us/control1/.

Records Retention and Disposition Schedule Memorandum

Records Retention and Disposition Schedule Spreadsheet

As of November 2003, FRR/BEER data is being stored on tape. You must continue to keep 2 years of FRR/BEER reports on paper, but may now begin destroying the paper copies older than 2 years. If your county office were to need FRR/BEER data that is more than 2 years old, contact DMA EIS at 919-857-4019.

VII. FRR/BEER SAFEGUARD AWARENESS TRAINING

A. New Employees

FRR/BEER Safeguard Awareness Training must be completed with each new employee who will have access to FTI. The documentation of annual security training (Attachment III) must be signed and a copy given to the MPR when the Internal Inspection is completed.

VII. (CONT’D)

B. Annual Training for All Employees

Beginning in 2004, please complete the annual security training between January 1 and March 31 of each year. By doing so, the entire state performs their training the same time each year and the documentation of annual security training forms are finished when the MPRs visit your county for the Internal Inspection.

FRR/BEER Safeguard Awareness Training must be completed annually with all employees who have access to FTI. Provide the MPR with a copy of the documentation of annual security training (Attachment III).

NOTE: Please make sure the most current documentation of annual security training form is used.

C. Online Training

http://www.dhhs.state.nc.us/dma/frrbeer/safeguardtrain_files/frame.htm

The URL above is a link to an online PowerPoint show that may be used for the Annual Safeguard Awareness Training. Copies of all required documents must still be given to each worker at the time of training and all workers must still sign the documentation of annual security training.

VIII. ADMINISTRATIVE LETTER MAINTENANCE

A. Please add the following text to section IV.C.1 in the original administrative letter:

The following text is being added to match the wording of the sample letter provided in the original Administrative Letter (Attachment VI).

“The IMC may send a blank DSS-3431 for the client’s signature with the original request. Do not include the name of the financial institution, account number, or any other information from the FRR/BEER report.”