Current through Register Vol. 47, No. 5, March 10, 2024
A. Pursuant to
Section 26-3.1-102(7)(a),
C.R.S. and except as provided in Section
26-3.1-102(7)(b),
C.R.S. and Section 30.250, B, reports of the mistreatment or self-neglect of
any at-risk adult, including the name and address of any at-risk adult, member
of said adult's family, or informant, or any other identifying information
contained in such reports and subsequent cases resulting from the reports, is
confidential, and is not public information. The county and state departments
shall treat all information related to the report and the case, whether in
written or electronic form, as confidential and such information includes, but
is not limited to, the following:
1.
Identifying information, such as the name, address, relationship to the at-risk
adult, Date of Birth, or Social Security Number of the:
a. At-risk adult;
b. At-risk adult's family members;
c. Reporting party;
d. Alleged perpetrator; and,
e. Other persons involved in the
case.
2. Allegations,
assessment, and investigative findings, including, but not limited to:
a. The initial report of allegations and
concerns;
b. The client's safety
and risk as determined by the client assessment;
c. Medical and behavioral diagnoses, past
medical conditions, and disabilities;
d. Services provided to or arranged for the
adult;
e. Information learned as a
result of a criminal investigation;
f. Information obtained during the APS
investigation and the substantiation or non-substantiation of the allegations;
and,
g. Legal protections in place
including, but not limited to, wills, advance directives, powers of attorney,
guardianship, conservatorship, representative payeeship, and protective
orders.
B.
Pursuant to Section
26-3.1-102(7)(b),
C.R.S., disclosure of a report of the mistreatment or self-neglect of an
at-risk adult and information relating to an investigation of such a report and
subsequent cases resulting from the report is permitted only when authorized by
a court for good cause. A court order is not required, and such disclosure is
not prohibited when:
1. A criminal
investigation into an allegation of mistreatment is being conducted, when a
review of death by a coroner is being conducted when the death is suspected to
be related to mistreatment, or when a criminal complaint, information, or
indictment is filed and the report and case information is relevant to the
investigation, death review, complaint, or indictment.
2. There is a death of a suspected at-risk
adult from mistreatment or self-neglect and a law enforcement agency files a
formal charge or a grand jury issues an indictment in connection with
death.
3. The disclosure is
necessary for the coordination of multiple agencies' joint investigation of a
report or for the provision of protection services to an at-risk adult, such
as, but not limited to:
a. Coordination with
law enforcement to conduct a joint investigation;
b. Providing protective services, such as
establishing eligibility for, arrangement and implementation of services and
benefits, and appointment of a guardian and/or conservator.
c. A review of a power of attorney is
requested under the uniform power of attorney act, as outlined at C.R.S. Title
15, Article 14, Part 7 or review of a fiduciary under C.R.S. Title 15, Article
10, Part 5.
d. Reviewing a case
with the Adult Protection Team to find solutions to cases with complex service
provision needs, in accordance with the Adult Protection Team's by-laws, and
when in executive session with members who have signed a confidentiality
agreement.
4. The
disclosure is necessary for purposes of an audit of a county department of
human or social services pursuant to Section
26-1-114.5, C.R.S.
5. The disclosure is made for purposes of the
appeals process relating to a substantiated case of mistreatment of an at-risk
adult pursuant to Section
26-3.1-108(2),
C.R.S.
a. This Subsection is in addition to
and not in lieu of other federal and state laws concerning protected
confidential information. Disclosures allowed are:
i. Notification made by the county department
to substantiated perpetrator(s) of mistreatment pursuant to Section
26-3.1-108, C.R.S.
ii. Disclosure by the State Department for
purposes of the appeals process relating to a substantiated case of
mistreatment of an at-risk adult pursuant to Section
26-3.1-108(2),
C.R.S.
6. The
disclosure is made by the State Department to an employer, or to a person or
entity conducting employee screening on behalf of the employer, as part of a
CAPS check pursuant to Section
26-3.1-111, C.R.S. or by a county
department pursuant to Section
26-3.1-107, C.R.S.
7. The disclosure is made to the at-risk
adult who is the subject of the report, or if the at-risk adult is otherwise
incompetent at the time of the request, to the guardian or guardian ad litem
for the at-risk adult who is the subject of the report, with the following
conditions:
a. The disclosure shall not be
made until after investigation is complete; and,
b. The disclosure shall not include any
identifying information related to the reporting party or any other appropriate
persons, as follows:
i. The county or state
department shall redact any and all identifying information related to the
reporting party; and,
ii. The
county or state department must redact Personal Identifying Information (PII)
related to the client, any minor children, and alleged or substantiated
perpetrators; and,
iii. The county
or state department may redact PII related to the supports and collaterals as
deemed necessary by the county or state department; and,
c. The county or state department shall
redact all Personal Health Information (PHI) of the reporting party, supports,
collaterals, and alleged or substantiated perpetrator that is protected by the
Health Insurance Portability and Accountability Act of 1996 (HIPAA), as
incorporated by reference in Section 30.100, above, state and/or federal law,
and,
d. The county or state
department shall obtain from the guardian a copy of the guardianship order or
guardian ad litem appointment, independently verify that the order or
appointment remains valid, and attach the order or appointment to the client's
case in CAPS; and,
e. If the
guardian is a substantiated perpetrator in a case of mistreatment of an at-risk
adult, the disclosure must not be made without authorization by a court for
good cause, unless the disclosure is being made for the purposes of the
guardian's appeal process pursuant to Section
26-3.1-102(7)(b)(V),
C.R.S. If the request for disclosure is not part of the appeal process, the
county or state department shall require the guardian to obtain a court order
and the county or state department shall obtain a copy of the court order from
the guardian and attach the order to the case in CAPS.
8. The disclosure is made to a county
department that assesses or provides protective services for children when the
information is necessary to adequately assess for safety and risk or to provide
protective services for a child. A county department that assesses or provides
protective services for at-risk adults is similarly permitted to access
information from a county department that assesses or provides protective
services for children pursuant to Section
19-1-307(2)(X),
C.R.S.
a. Information must be limited to
information regarding prior or current reports, assessments, investigations, or
case information related to an at-risk adult or an alleged
perpetrator.
b. The provisions of
this Subsection 30.250.B.8 are in addition to and not in lieu of other federal
and state laws concerning protected or confidential information.
i. The county department may not share
Personal Identifying Information (PII) or Personal Health Information (PHI)
protected by HIPAA, as incorporated by reference in Section 30.100, above, that
is not necessary to the child welfare investigation, assessment, or provision
of services for the child(ren).
ii.
Information provided to child welfare staff must be the minimum necessary for
worker safety concerns for child welfare staff, the investigation, assessment,
and provision of services for the child(ren).
iii. County department APS staff may share
information with any county department's child welfare staff.
iv. The county department's child welfare
staff shall not be provided access to CAPS, unless that child welfare staff
person is also the county department's APS staff person.
9. The disclosure is made to an
employer required to request a CAPS check pursuant to Section
26-3.1-111 or to the State
Department agency that oversees the employer when the information is necessary
to ensure the safety of other at-risk adults under the care of the employer.
The information must be the minimum information necessary to ensure the safety
of other at-risk adults under the care of the employer or oversight of the
State Department agency.
10. The
disclosure is made pursuant to Section
26-3.1-111(12),
C.R.S. to a health oversight agency, as defined in
45 CFR
164.501 incorporated by reference in Section
30.100,[1], within the Department of Regulatory
Agencies or a regulator within such a health oversight agency, as defined in
Section 12-20-102(14),
C.R.S.
a. The State Department, not county
departments, shall provide this information to DORA.
b. County departments must observe all
confidentiality requirements in the event DORA contacts them during an
investigation.
11. The
disclosure is made to the court pursuant to Section
26-3.1-111(3)(b)
and (8.5)(b), C.R.S.
C.
Whenever there is a question about the legality of releasing information the
requestor shall be advised to submit a written request to the appropriate court
to order the county department to produce the desired records or information
within the custody or control of the county department.
D. Information released under Section
30.250.B, shall be the minimum information necessary to secure the services,
conduct the investigation, or otherwise respond to the court order. The county
department shall:
1. Provide the information
only to persons deemed essential to the court order, criminal or APS
investigation, adult protection team activities, or the provision of
services;
2. Edit the information
prior to its release to physically remove or redact information not essential
to the court order, criminal or APS investigation, adult protection team
activities, or provision of services and benefits;
3. Redact all information that would identify
the reporting party unless ordered by the court, the reporting party has given
written consent, or when sharing the report with law enforcement, per Section
26-3.1-102(3),
C.R.S;
4. Always redact all HIPAA
protected information, as incorporated by reference in Section 30.100, above,
and any other confidential information which is protected by law unless
specifically ordered by a court; and,
5. Redact all other report and case
information not directly related to the court order.
E. In a criminal or civil proceeding or in
any other circumstance in which the APS report and/or case record is subpoenaed
or any request for disclosure has been made, or any county department or State
Department representative is ordered to testify concerning an APS report or
case, the court shall be advised, through proper channels, of the statutory
provisions, rules, and policies concerning disclosure of information.
1. Confidential information shall not be
released unless so ordered by the court for good cause, except as outlined in
Section 26-3.1-102
(7)(b), C.R.S. and Section
30.250.B.
2. The county department
or State Department shall comply within the time frame ordered by the court,
unless a motion to quash is pending, or, if there is no stated timeline within
the court order, in accordance with county department or State Department
policy and provide a written notice with the information to be released
regarding the legality of sharing confidential information.
F. Individuals or groups requesting
information regarding APS reports and/or investigations shall be informed of
the confidential nature of the information and shall be advised that a court
order is required to release information held by the county department, except
as provided in section
26-3.1-102(7)(b),
C.R.S., and at Section 30.250.B above. These persons or groups include, but are
not limited to:
1. Federal and state
legislators;
2. Members of other
governmental authorities or agencies, including county commissioners, city
councils, school boards, and other city and county department boards, councils,
officials, and employees;
3.
Courts;
4. Attorneys, guardians,
conservators, agents under powers of attorney, representative payees, and other
fiduciaries;
5. Family members,
reporting parties, or other interested parties;
6. Any alleged perpetrator; and,
7. Media representatives.
G. Any person who violates any
provision of Section
26-3.1-102(7)
and/or Subsection 30.250, A through F, is guilty of a civil infraction and,
upon conviction thereof, shall be punished by a fine of not more than one
hundred dollars as provided in Section
26-3.1-102(7),
C.R.S.
H. All confidential APS
information and data shall be processed, filed and stored using safeguards that
prevent unauthorized personnel from acquiring, accessing, or retrieving the
information.
1. Client files created prior to
July 1, 2014 when CAPS was implemented shall be kept in a secured area when not
in use. All other documents related to APS reports and cases shall be kept in
CAPS, as outlined in Section 30.260, B and C.
2. Laptops and other mobile devices used to
document in the field shall be protected and encrypted in compliance with HIPAA
security requirements, as incorporated by reference in Section 30.100,
above.
3. Email correspondence that
contains APS confidential information shall be sent through secure encryption
programs.
4. The State Department
shall ensure that only State Department and county department staff persons
with a business need to do so shall have access to CAPS.
a. All CAPS users must electronically sign
the CAPS Security and Confidentiality Agreement annually and follow the
requirements therein.
b. County
departments shall not access information in CAPS that is not necessary to serve
the client.
c. Violations of CAPS
security and confidentiality requirements may result in loss of access to CAPS,
at the discretion of the State Department.
I. Clients shall be referred to the Colorado
Address Confidentiality Program (ACP) as appropriate to determine their
eligibility for services including the legal substitute mailing address and
mail forwarding services. The State Department and county department shall
comply with any applicable provisions for APS clients enrolled in the ACP.
1 Section
26-3.1-111(5)(h),
C.R.S. refers to a health oversight agency defined in federal regulation at
42 CFR
164.501. This appears to be a typographical
error as no such regulation exists. The definition for health oversight agency
can be found at 45 CFR
164.501.