Agencies | Governor
Virginia Regulatory Town Hall

Proposed Text

highlight

Action:
Update General Provisions for Confidential Information
Stage: Fast-Track
 
22VAC40-910-20

22VAC40-910-20. General provisions.

A. Except as otherwise provided in these regulations or consistent with other federal and state laws or regulations, no person shall disclose or use, or authorize, permit, or acquiesce to the use of any client information that is directly or indirectly derived from the client records of the department, agency, provider, or the State Board of Social Services. Exceptions to this provision are provided in 22VAC40-910-80, 22VAC40-910-90, and 22VAC40-910-100.

B. Protecting confidential information. All client records, which could disclose the client's identity, are confidential and must be protected in accordance with federal and state laws and regulations. Such client information includes, but is not limited to:

1. Name, address, and any types of identification numbers assigned to the client and all individuals for whom the client receives assistance on behalf of, including but not limited to social security number;

2. Public assistance, child support enforcement services, or social services provided to the client;

3. Information received for verifying income and eligibility;

4. Evaluation of the client's confidential information;

5. Social and medical data about the client and all individuals for whom the client receives assistance on behalf of, including diagnoses and past histories of disease or disabilities;

6. Information received from third parties such as an employer; and

7. Information associated with processing and rendering appeals.

C. Ownership of client records.

1. Client records are the property of the department or agency. Employees and agents of the department or agency must protect and preserve such records from dissemination except as provided herein in this chapter.

2. Only authorized employees and agents may remove client records from the department or agency's premises.

3. The department and agency shall destroy client records pursuant to records retention schedules consistent with federal and state regulations.

D. Disclosure of client information.

1. Consent. As part of the application process for public assistance or social services, the client or legally responsible person must be informed of the need to consent to a third-party release of client information necessary for verifying his eligibility or information provided. Whenever a person or organization that is not performing one or more of the functions delineated in 22VAC40-910-80 C or does not have a legitimate interest pursuant to 22VAC40-910-100 requests client information, the person or organization must obtain written permission from the client or the legally responsible person for the release of the client information unless one of the conditions delineated in this subsection exists. A client's authorization for release of client information obtained by the department, agency, or provider also satisfies this requirement.

Client records may be released without the client's written permission under the following conditions: a. A court of competent jurisdiction has ordered the production of client records and the department, agency or provider does not have sufficient time to notify the client or legally responsible person before responding to the order. b. For research purposes as provided in 22VAC40-910-50 if a court of competent jurisdiction has ordered the production of client records and the department, agency, or provider does not have sufficient time to notify the client or legally responsible person before responding to the order.

2. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents shall have the discretion to release nonidentifying statistical information. A client's written permission is not required in order to release nonidentifying statistical information when such release is permissible in accordance with state and federal law and regulations.

3. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents do not have to obtain consent from the client to obtain or review client records.

22VAC40-910-90

22VAC40-910-90. Confidential client information pertaining to child support enforcement.

A. Confidentiality of child support enforcement client information is assured by §§ 63.2-102 and 63.2-103 of the Code of Virginia.

B. Information may be released only for a purpose directly connected with the administration of the child support enforcement program, except as herein provided in this chapter or pursuant to §§ 63.2-102, 63.2-103, 63.2-1906 and 63.2-1940 of the Code of Virginia.

C. Purposes directly related to the administration of the child support enforcement program include but are not limited to:

1. Determining the amount of child support;

2. Providing child support enforcement services; and

3. Conducting or assisting in an investigation or prosecution of a civil or criminal proceeding related to the administration of the child support enforcement program.

D. The following regulatory provisions provide guidance on the release of child support enforcement client information:

1. Entities to whom the Division of Child Support Enforcement can release client information is governed by 22VAC40-880-520;

2. The release of client information to and from the Internal Revenue Service is governed by 22VAC40-880-530;

3. Request for client information from the general public is governed by 22VAC40-880-540;

4. Requests for client information from parents is governed by 22VAC40-880-550;

5. Release of health insurance information is governed by 22VAC40-880-560; and

6. Release of client records to law-enforcement agencies and Commonwealth's and county or city attorneys is governed by 22VAC40-880-520 B

Release of health insurance information is governed by 22VAC40-880-560.

22VAC40-910-100

22VAC40-910-100. Confidential client information pertaining to social services programs.

A. Confidentiality of client information of social services programs is assured by §§ 63.2-104 and 63.2-105 of the Code of Virginia.

B. Releasing confidential social services information.

1. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents shall have access to all social services client records pursuant to § 63.2-104 of the Code of Virginia.

2. Social services client records must be confidential and can only be released to persons having a legitimate interest in accordance with federal and state laws and regulations pursuant to § 63.2-104 of the Code of Virginia. Section 63.2-104 of the Code of Virginia does not apply to the disclosure of adoption records, reports, and information. The disclosure of adoption records, reports, and information is governed by § 63.2-1246 of the Code of Virginia.

3. The following statutory and regulatory provisions provide guidance on the definition of legitimate interest as applied to specific social services programs:

a. Adult Protective Services client records can be released to persons having a legitimate interest pursuant to 22VAC40-740-50 B 22VAC30-100-50.

b. Child Protective Services Client Records and Information Disclosure:

(1) Child protective services client records can be released to persons having a legitimate interest pursuant to § 63.2-105 A of the Code of Virginia.

(2) The public has a legitimate interest to limited information about child abuse or neglect cases that resulted in a child fatality or near fatality. Pursuant to the Child Abuse and Prevention Treatment Act (CAPTA), as amended (P.L. 108-36 (42 USC § 5106a)) states must have provisions that allow for public disclosure of the findings or information about the case of child abuse or neglect that has resulted in a child fatality or near fatality. Accordingly, agencies must release the following information to the public, providing that nothing disclosed would be likely to endanger the life, safety, or physical or emotional well-being of a child or the life or safety of any other person; or that may compromise the integrity of a Child Protective Services investigation, or a civil or criminal investigation, or judicial proceeding:

(a) The fact that a report has been made concerning the alleged victim child or other children living in the same household;

(b) Whether an investigation has been initiated;

(c) The result of the completed investigation;

(d) Whether previous reports have been made concerning the alleged victim child or other children living in the same household and the dates thereof, a summary of those previous reports, and the dates and outcome of any investigations or actions taken by the agency in response to those previous reports of child abuse or neglect; and

(e) The agency's activities in handling the case.

(3) Information regarding child protective services reports, complaints, investigation and related services and follow-up may be shared with the appropriate Family Advocacy Program representative of the United States Armed Forces as provided in 22VAC40-720 22VAC40-705-140 E, Child Protective Services Release of Information to Family Advocacy Program Representatives of the United States Armed Forces.

(4) The agency must release child protective services client records in the instances of mandatory disclosure as provided in 22VAC40-705-160. The local department may release the information without written consent.

4. Foster care client records about children in foster care or their parents can be released upon order of the court. For instance, client records may be released to the guardian ad litem and the court appointed special advocate who are appointed for a child as a result of a court order or to attorneys representing the child or the child's parents.