How to Complete and Submit Form HUD-52676: EIV Rules of Behavior

Form HUD-52676 is the PIH EIV System User Access Authorization Form and Rules of Behavior and User Agreement. Anyone who logs into HUD’s Enterprise Income Verification system, or who handles EIV reports in print or electronic form, has to complete it before touching the data. You type the form, have your PHA’s Authorizing Official sign it, complete the required training, and submit it to the EIV Coordinator at your local HUD field office.¹

Who Has to Sign

HUD grants EIV access to a narrow group: HUD employees, HUD contractors, Public Housing Authority employees, and PHA-hired management agents. Every one of them completes the form before receiving login credentials.¹

Staff who never log into EIV but still view or handle EIV reports also sign, but their process is shorter. They check the box at the top of Part I indicating they only view EIV information, skip Sections B through E, and sign the User Agreement in Part III. Their completed form stays on-site rather than going to HUD.¹

Every form, whether it goes to HUD or lives in the office, needs the PHA’s Executive Director or a designee to sign as the Authorizing Official. Without that signature the form is incomplete and HUD will not process it.¹

Where to Get the Current Form

Download the form from HUDCLIPS at hud.gov/guidance, or from HUD’s Office of the Chief Human Capital Officer documents page.² The current revision is dated June 2023 and carries OMB approval number 2577-0267, expiring June 30, 2026.¹ Check the revision date before you fill anything in. HUD does not accept outdated versions.

Filling Out Part I

The form must be typewritten. Handwritten forms are rejected, even if you plan to submit by fax or mail.¹

Section A: Your Information

PHA Code (for example, DC451)
Full legal name of the HUD office, PHA, or management agent
Business address
Your first name, middle initial, and last name
WASS User ID if you already have one; new users can leave this for HUD to assign
Position title
Phone, email, and fax
Type of work (item 10): pick from the 11 listed options. Selecting option 11, view or handle printed or electronic information only, lets you skip Sections B through E

Section B: Action Requested

Check one box only: initial access, reinstatement after termination, modification of existing access, or termination.¹

Section C: User Access Role

External users pick one of eight PHA User Access Roles matching their responsibilities.

Section D: Projects

List the project numbers you need access to, or check the box for access to all projects.

Section E: HUD Internal Use

Leave this blank if you are PHA staff or a management agent employee. It is only for HUD internal users.

Section F: Authorizing Official

Your Executive Director or their designee signs and dates this block. Electronic signatures are allowed as long as the signed original stays on file and is available for inspection.

Parts II and III

Part II is the Rules of Behavior itself. Nothing to fill in. Read it. It covers password protection, restrictions on sharing credentials, disposal of printed reports, and the prohibition on pulling records you have no business reason to view.

Part III is where you sign. Your signature certifies that you have read the rules, participated in HUD-sponsored PIH EIV training, and completed annual security awareness training within the past 12 months. Electronic signatures are accepted on the same terms as Section F.¹

Training You Need Before Signing

Two requirements sit behind the Part III signature. The first is HUD’s initial PIH EIV system training. The second is annual security awareness training. HUD’s recommended course is the Cyber Awareness Challenge on the Department of Defense’s Cyber Exchange site at public.cyber.mil; select “All Other Users” when launching it.³

If you have not completed the Cyber Awareness Challenge within the past 12 months, you have 30 days from accepting the Rules of Behavior to finish it.³ Failure to certify that this training is complete is grounds for HUD to deny or discontinue your EIV access.¹

Where to Submit It

Send the completed form to the designated EIV Coordinator at your local HUD field office. Do not send it to HUD Headquarters in Washington. Only your local office can process it.¹ Fax, email, and mail are all acceptable channels. If you do not know who your coordinator is, HUD publishes a list of EIV Coordinators by field office and state, and you can also email eivhelp@hud.gov.⁴

Reminder for view-only staff: your form stays on-site. It still needs to exist and be available for audit.

Keeping Access Active

EIV access terminates automatically if you go 90 days without logging into HUD’s Web Access Security Subsystem. It also terminates if your EIV User Administrator does not recertify you during the required cycle.¹ Vacations, extended leave, and quiet stretches when EIV reports are not needed can easily push you past 90 days. Track it internally.

Reinstating Terminated Access

You use the same form. Check Box 2 in Section B for reinstatement instead of Box 1 for initial access, then submit it through the same channels to your local EIV Coordinator.¹

When HUD terminates access because of a security compliance failure, reinstatement is harder. HUD restores access only after the agency implements corrective actions to fix the deficiency.¹ In practice that means documenting the failure, showing HUD how it was resolved, and then resubmitting the form.

How Long Your PHA Has to Keep the Form

The signed form lives at the PHA and is subject to inspection at any time. Keep the initial access form and the most recent modification request for as long as the individual continues to access EIV data. When someone’s access is terminated, keep the termination request form for three years from the termination date.¹ Electronic retention is fine.

Penalties

Violating the Rules of Behavior can result in temporary suspension of your access at the low end, or permanent termination of all access rights at the high end.¹

The Privacy Act of 1974 adds criminal penalties. Willfully disclosing individually identifiable information to someone not entitled to receive it is a misdemeanor with a fine of up to $5,000, and the same penalty applies to obtaining records under false pretenses.⁵ HUD’s Departmental Rules of Behavior echo that fine and add that disciplinary consequences can range from a letter of warning up to removal from federal service. Refusing to sign the form results in denied access to HUD information and information resources.⁶

If You Work in Multifamily Housing

Form HUD-52676 is the Public and Indian Housing form. Multifamily Housing programs use different forms: HUD-90011, the Coordinator Access Authorization Form, plus a separate User Access Authorization Form.⁷ If you are not sure which program your property falls under, your local HUD field office can point you to the right forms and coordinator.

1
U.S. Department of Housing and Urban Development. PIH EIV System User Access Authorization Form and Rules of Behavior and User Agreement
2
U.S. Department of Housing and Urban Development. HUDClips
3
U.S. Department of Housing and Urban Development. TRACS External Users Access/User Recertification/Security Awareness Training Requirements
4
U.S. Department of Housing and Urban Development. PHA Enterprise Income Verification EIV System Field Office Coordinators List
5
Office of the Law Revision Counsel. United States Code Title 5 Section 552a
6
U.S. Department of Housing and Urban Development. Departmental Rules of Behavior for Use of Information Resources
7
U.S. Department of Housing and Urban Development. Enterprise Income Verification System Multifamily Housing Coordinator Access Authorization Form