HUD has recently restated its intention to punish owners and managers of HUD assisted housing who fail to adequately safeguard the personally identifiable information (PII) of applicants and tenants in HUD assisted properties. Notice PIH 2010-15(HA), issued on May 6, 2010, provides details on HUD requirements regarding privacy protection and should be reviewed by all operators of HUD assisted housing.
The Notice provides guidance on protecting sensitive privacy information, and outlines the steps that contractors and third party business partners should take to ensure protection of sensitive information. Among the steps stipulated in the Notice:
• Collect only PII that is needed;
• Manage access to PII by sharing it only with personnel with a “need to know.” Be careful when discussing PII on the phone, and never leave messages containing sensitive PII on voicemail;
• Protect hard copy and electronic files containing PII;
• Protect electronic transmissions of sensitive PII via fax, email, etc;
• Protect hard copy transmissions of files containing PII; and
• Have a solid program in place relative to records management, retention and disposition.
Details of these requirements are contained in the Notice. All owners/agents of HUD assisted properties should obtain a copy of the Notice and abide by its requirements.