How to Set EIV Policy, Inform Residents

In late March, HUD announced that it was delaying the effective date of the Enterprise Income Verification System (EIV) and Social Security verification rules it issued in January (as discussed in last month's Insider). HUD has changed the effective date for the new EIV and Social Security disclosure requirements from March 30, 2009, to Sept. 30, 2009.

According to HUD, the delay will give it time to consider possible changes to the proposed regulations and to respond more fully to comments and concerns about their impact. Denise Muha of the National Leased Housing Association applauded the move, saying it gives HUD time to make the requirements clearer.

Under program rules now in effect, the head of household must disclose Social Security numbers (SSNs) for all family members who are at least 6 years of age or older at recertification. Unless HUD changes its policy before then, beginning on September 30, you must collect and verify SSNs for all household members, regardless of age, as well as for all applicants and new household members. For many people, meeting this requirement will require a visit to the Social Security office before their recertification date. You must stress the importance of complying, though: Under the new rule, you must terminate the tenancy of a participant if he does not provide the required SSN documentation for the whole household.

To inform residents and waiting-list applicants of the new rules, you can adapt our Model Letter: Tell Residents About New EIV Rules, based on one drafted by the Idaho Housing and Finance Association and the National Center for Housing Management.

Use of the EIV will become mandatory for multifamily owners and management agents on September 30. After that date, EIV compliance will become a required part of Management and Occupancy Reviews.

Update Site Policy

Even if you already have EIV access and experience, you should review your site policies and procedures before September 30. Be sure you have guidelines all staff members understand and follow. To help you, the Insider put together this list of seven topics your policy should cover.

Purpose. Your site's policy should state exactly how you will use EIV resident data. It should make clear that you consider EIV information confidential and you use it only for the reasons allowed by law—to verify income and eligibility in assisted housing programs.

Staff roles. Your policy should clarify who does what when. Because EIV responsibilities are ongoing, you need to identify who will be responsible for keeping you up to date and compliant with HUD rules. Most important, you need to make sure that you know who is responsible for maintaining electronic access to the EIV system, including negotiating its many security requirements.

EIV use will also produce new work responsibilities for your occupancy staff. You should anticipate the new workload, or at least, new work requirements, in writing your EIV policy. Most owners using the EIV for the first time will find that it will be a good tool to detect underreporting of income, says Muha. Ruth O'Sullivan, executive director of the Rockville Housing Authority in Maryland, says, “The EIV has proven to be a gold mine in identifying fraud.” She advises multifamily sites to use the EIV to its fullest and follow through on anything and everything.

To do so, you'll need to have clear policies on how to handle potential fraud cases and how to follow up on discrepancies in income. HUD has high expectations on resolving situations in which EIV data is substantially different from tenant-reported or third-party-reported income, so be sure you have a reasonable compliance policy in place to guide your staff. Be sure it is consistent with current HUD guidelines.

Privacy. Your policy should identify the staff members you authorize to view EIV data and those you do not. EIV access must be restricted to authorized personnel. All staff must consider EIV data confidential. Your policy should specify that you understand that EIV data is subject to the provisions of the Federal Privacy Act, the Freedom of Information Act, and related laws. Maintaining privacy means that you must take steps to keep the data out of public view at computer terminals and in paper files. It also means that you must keep non-authorized users, including some program auditors, from seeing EIV data.

Security. Your policy should state how you will maintain the security of EIV data, both in the electronic system and in paper files. As housing expert Cindy Telfer suggests, the policy should give an idea of how you will ensure that you meet HUD security requirements and how you would deal with security breaches. You should ensure you have a current signed clearance on file for all EIV users. You must also maintain both coordinator access and user access. Users must recertify annually; coordinators must recertify all their users every quarter, on the following schedule:

• Quarter 1: January 1 - March 31 (30-day grace period April 1 - April 29)

• Quarter 2: April 1 - June 30 (30-day grace period July 1 - July 30)

• Quarter 3: July 1 - September 30 (30-day grace period October 1 - October 30)

• Quarter 4: October 1 - December 31 (30-day grace period January 1 - January 30)

Updating. Your policy should state how you will update the policy to reflect evolving HUD requirements.

Data destruction. EIV printout data cannot be kept in resident files indefinitely. You must destroy wage, unemployment, employment, and new hire information two years from the print date. This requirement does not apply to Social Security and SSI data in the EIV. Telfer recommends the following policy language:

Model Language

The [insert name of property management company] must destroy wage, unemployment, employment, and new hire information two years from the print date. Under no circumstances may [insert name of company] maintain the information for a longer period of time. This data destruction requirement is imposed by the U.S. Department of Health and Human Services, as outlined in the computer matching agreement between HUD and HHS. This destruction requirement does not apply to SS/SSI benefit information.

PRACTICAL POINTER: Telfer suggests you create a placeholder document to show that you removed EIV data from a resident's file. This document should state that you obtained the required EIV data to support the resident's income determination, but you removed it from the file and shredded it because of the HUD-HHS requirement to destroy certain EIV data after two years. (See “Q&A: Preserving Records While Purging Excess Paperwork,” Insider, October 2008, p. 8.)

Tenant challenge. Under HUD rules, you must allow residents access to records pertaining to them on request, and you must give them an opportunity to correct or challenge the contents of the records. In particular, you must give residents the opportunity to resolve income discrepancies. Your policy should give staff—and program auditors—a clear roadmap of how you meet this requirement.

EDITOR'S NOTE: For more information, go to the Multifamily EIV Web site at: http://www.hud.gov/offices/hsg/mfh//rhiip/eiv/eivhome.cfm.
Intensive HUD EIV training Webinars are available on the HUD site, at: http://www.hud.gov/webcasts/archives/iv.cfm.

Insider Sources

Denise B. Muha: Executive Director, National Leased Housing Association, 1900 L St. NW, Ste. 300, Washington, DC, 20036; (202) 785-8888; dmuha@hudnlha.com.

Ruth O'Sullivan: Executive Director, Rockville Housing Authority, Rockville, MD; (301) 424-6265; RuthO'sullivan@rockvillehe.org.

Cindy Telfer: Owner, CCTelfer & Associates, LLC; (734) 260-5002; cctelfer@aol.com.

Search Our Web Site by Key Words: EIV; Enterprise Income Verification System; Social Security; disclosure requirements