Current through all regulations passed and filed through September 16, 2024
(A) What records are confidential?
All information and records concerning a recipient of Ohio works first
(OWF) pursuant to Chapter 5107. of the Revised Code, and prevention, retention
and contingency (PRC) pursuant to Chapter 5108. of the Revised Code are
confidential. No information or records regarding applicants, recipients, or
former recipients of any of the programs listed in this paragraph is to be
released to anyone except as provided in sections
5101.27 and
5101.28 of the Revised Code,
including an entity administering a program assisting needy individuals with
the costs of public utility services or as otherwise delineated in this rule
pursuant to section 5101.30 of the Revised
Code.
(B) When is
information allowed to be disclosed?
In accordance with sections
5101.27,
5101.28 and
5101.30 of the Revised Code,
recipient information and records for any of the programs identified in
paragraph (A) of this rule may be released to the following entities identified
in paragraphs (B)(1) to (B)(8) of this rule. However, only the minimum
information or records necessary to fulfill the need for the sharing of
information shall be released.
(1) A
provider of services or assistance connected with the programs identified in
paragraph (A) of this rule. Access to information under this paragraph is
limited to information that is essential for the provider to render or bill for
services or assistance. Providers shall not use this information except for the
purpose described in this paragraph and are subject to penalties established in
section 5101.99 of the Revised Code for
unauthorized use of the information.
(2) Any private contractor, grantee, or other
state or county entity, performing administrative or other duties on behalf of
the Ohio department of job and family services (ODJFS) or a county agency when
in compliance with paragraphs (B)(2)(a) to (B)(2)(c) of this rule. Access under
this paragraph includes but is not limited to exchange of information pursuant
to section 307.987 of the Revised Code.
Information is limited only to information needed for completion of the
administrative or other duties on behalf of ODJFS or the county agency:
(a) There shall be a signed, written
agreement with the contractor, grantee, or entity, that establishes the purpose
and scope of duties to be performed for ODJFS or the county agency.
(b) The agreement shall contain language that
the contractor, grantee, or entity shall not use the information received
pursuant to the agreement for purposes other than those established in the
written agreement.
(c) The
agreement shall include language that establishes that the contractor, grantee,
or entity is bound by relevant Ohio confidentiality laws and ODJFS rules; and,
that disclosure of the information by the contractor, grantee, or entity in a
manner not authorized by the Revised Code or Administrative Code is a breach of
the contract and subject to penalties set forth in section
5101.99 of the Revised
Code.
(3) Any state
licensing or certification authority while performing its statutory duties of
conducting or assisting with investigations, prosecution or civil or criminal
proceedings against medicaid providers, provided that any such licensing or
certification authority agrees to be bound by the same rules and regulations
regarding recipient confidentiality that binds ODJFS. To ensure agreement of
confidentiality, these information requests and responses will be conducted
solely between the requesting authority and the appropriate office within
ODJFS.
(4) A county child support
enforcement agency when requesting relevant information needed to secure child
support pursuant to rule
5101:1-3-10 of the
Administrative Code.
(5) State and
local offices of women, infants and children, child and family health services,
and the children with medical handicaps program. The information shared is
limited to eligibility information for specific individuals or assistance
groups receiving these services.
(6) A public children services agency (PCSA)
when the county agency is to report known or suspected instances of child abuse
and neglect of a child receiving OWF, PRC or when the PCSA needs information in
order to conduct an assessment or investigation of a report of alleged child
abuse or neglect, as described in rule
5101:2-33-28 of the
Administrative Code. Instances of abuse and neglect situations exist when a
child experiences physical or mental injury, sexual abuse, or exploitation, or
negligent treatment or maltreatment under circumstances that indicate the
child's health or welfare is threatened.
(7) To the extent permitted by federal law,
the ODJFS and county agencies shall provide information, except information
directly related to the receipt of medical assistance or medical services,
regarding recipients of public assistance under a program administered by the
ODJFS or a county agency pursuant to Chapter 5107. or 5108. of the Revised Code
to law enforcement agencies upon request for the purposes of investigations,
prosecutions, and criminal and civil proceedings that are within the scope of
the law enforcement agencies' official duties.
(8) Information about a recipient shall be
exchanged, obtained, or shared only when the ODJFS, the county agency, or law
enforcement agency requesting the information gives sufficient information to
specifically identify the recipient. In addition to the recipient's name,
identifying information may include the recipient's current or last known
address, social security number, other identifying number, age, gender,
physical characteristics, any information specified in an agreement entered
into under section 5101.28 of the Revised Code, or
any information considered appropriate by ODJFS or the county
agency.
(C) What are the
requirements regarding protection of the recipient's right to control personal
data?
The following requirements shall be explained at the time of
application for assistance or services and are included to protect the
recipient's right to control personal data.
(1) Whenever a recipient of any of the
programs identified in paragraph (A) of this rule is asked to supply personal
data to the county agency or ODJFS, the legal requirements for providing or not
providing such data shall be explained to the recipient.
(2) Upon the request of any recipient of any
of the programs identified in paragraph (A) of this rule, the county agency
shall make all data collected about that individual available to the
individual. Medical, psychiatric or psychological information may not be
released to the individual or his or her legal guardian when the county agency
has reason to believe that its release may have an adverse effect on the
individual.
When the county agency has reason to believe that the release of
medical, psychiatric or psychological information may have an adverse effect,
the county agency shall release this information to a physician, psychiatrist
or psychologist designated by the individual. Once the individual provides
expressed and informed consent, the county agency will send this information to
the designated medical provider. The medical provider will then determine
whether the information should be disclosed to the recipient.
In addition, the county agency shall supply an interpretation of the
data when it is not readily understandable. When the individual feels that the
data is incomplete or inaccurate, the individual has the right to include
additional information in the individual's files.
(3) Upon any request for individual data
through compulsory legal process, the recipient of any program identified in
paragraph (A) of this rule, shall be immediately informed of such request. In
addition, the department shall inform the court of the statutory and regulatory
provisions against disclosure of information, when state or federal law
precludes the release of the information. When the court still seeks the
information, and when the information is not protected by any other privilege
recognized by law, the county agency will furnish the specified information to
the court itself along with ODJFS policies for safeguarding that information.
At the same time, the county agency shall notify the individual that the
information has been furnished to the court and shall supply
exact copies of the information to the
individual.
(4) Pursuant to
division (D) of section
5101.27 of the Revised Code,
ODJFS and the county agency may release information about a recipient of any of
the programs listed in paragraph (A) of this rule, when the recipient gives
voluntary, written consent in compliance with section
5101.27 of the Revised
Code.
(D) What are the
county agency responsibilities concerning nondiscrimination?
The county agency is responsible for providing assistance without
discrimination on account of race, color, religion, national origin, gender,
sexual orientation, disability, age or political beliefs, in a manner
consistent with the all federal and state laws relating to
nondiscrimination.
(E) What
forms are to be used to request a release of information?
A signed JFS 07341 "Applicant/Recipient Authorization for Release of
Information" shall be obtained whenever the county agency requests information
from a third party. The county agency shall use the ODM 03397 "Authorization
for the Release or Use of Protected Health Information " when the information
is medical in nature or the JFS 06907 "LEAP-Learning, Earning, and Parenting
Program School Information Release Form" when requesting attendance and
educational information for LEAP program participants. A copy of any signed
release shall be included in the individual's file.
(F) What are the confidentiality requirements
for obtaining information from the social security administration (SSA)?
(1) The SSA sends information to the ODJFS
about retirement, survivors and disability insurance (RSDI) and supplemental
security income (SSI) beneficiaries who are applicants for or recipients of any
of the programs listed in paragraph (A) of this rule. The SSA limits use and
disclosure of this SSA information.
(2) The Privacy Act of 1974, PL 93-579,
(12/1974), 88 Stat. 1896, 5 U.S.C. 522a, 20 C.F.R. 401 allows the SSA to
release information to ODJFS and the county agency without a release of
information from the beneficiary only as long as the information is for a
"routine use" and for specified programs. Every use or disclosure of SSA
information that is not routine or is not for an approved, specified program
requires the prior written permission of the beneficiary or the SSA,
respectively.
(a) The routine uses and
approved programs for RSDI information obtained from SSA are: to determine
eligibility for and administer OWF, supplemental nutrition assistance program
(SNAP), Title XX social services, Title IV-E, child support and energy
assistance.
(b) The routine uses
and approved programs for SSI benefits obtained from SSA are: to determine
eligibility for and administer OWF, SNAP, energy assistance, Title XX social
services, Title IV-E, and child support.
(G) What are the disclosure, confidentiality,
and physical safeguarding requirements of SSA and internal revenue service
(IRS) information?
(1) Whenever ODJFS or the
county agency discloses SSA information received from the SSA to someone who is
not an employee of ODJFS or a county agency, it shall do so only for a routine
use of an approved program and shall disclose only the information needed to
accomplish the purpose of the routine use.
(2) ODJFS may disclose SSA information to
another state agency, provided it is for routine use for an approved program
and only the needed information is disclosed.
(3) ODJFS and/or the county agency shall keep
a record every time they disclose information received from SSA to anyone who
is not an employee of ODJFS or a county agency, even when the disclosure is for
a routine use.
(a) The required record of
disclosure of SSA information shall be kept in the individual case record and
also in a central county agency file.
(b) The case record notation and the central
file shall contain the date of disclosure, the information disclosed, the
purpose of the disclosure, and the person to whom the information was
disclosed. For the case record, the county agency shall enter the notation
about the disclosure. For the central file, the county agency shall maintain
separate records, for each source of data disclosed.
(c) The record of disclosure shall be
retained for five years or the life of the application, whichever is longer.
The disclosure records are subject to inspection by the SSA.
(4) The IRS sends unearned income
information received from 1099 forms filed with that agency to ODJFS regarding
applicants and recipients of any of the programs listed in paragraph (A) of
this rule.
(5)
26
U.S.C. 6103 (3/2020), allows the disclosure
of tax return information to federal, state and local agencies by the IRS for
use in their temporary assistance for needy families and SNAP programs. The
return information is disclosed solely for the purpose of, and to the extent
necessary in, determining eligibility for, or the correct amount of benefits
under the specified programs.
(6)
IRS return information may not be disclosed to, exchanged with, or utilized by
any other state agency. ODJFS and county agency employees who are entitled to
access tax return information generally shall not disclose this information to
any party outside the agency other than the taxpayer to whom the information
relates or the taxpayer's duly appointed representative who has the explicit
authority to obtain tax return information.
(7) To the extent that disclosure of IRS
information is necessary to verify eligibility for and the correct amount of
benefits, including past benefits, such disclosure may be made only when there
is no other means of verifying the unearned income information, and only to the
extent necessary to verify the unearned income information.
(a) All ODJFS and county agency employees
with access to IRS return information shall have disclosure awareness training
for safeguarding requirements and shall be advised on an annual basis of IRS
penalty provisions.
(b) A permanent
system of standardized record keeping shall be maintained by the county agency
that documents requests for, and disclosure of return information. When
redisclosure is authorized, the information disclosed outside the agency shall
be recorded on a separate list that reflects to whom the disclosure was made,
what was disclosed, why and when it was disclosed.
(8) ODJFS and the county agency shall
physically protect SSA and IRS information from unauthorized access. The
physical record number of SSA and IRS information required to be safeguarded
include, but are not limited to, the following:
(a) Benefit earnings exchange record
information that contains federal wage information obtained from the SSA master
earnings file;
(b) IRS information
return master file that contains returns filed by payers of income such as
dividends, interest and retirement income.
(9) ODJFS and the county agency shall:
(a) Limit access to the data to only those
employees and officials who need it to perform their official duties in
connection with the approved programs.
(b) Store data in an area that is physically
safe from access by unauthorized persons.
(c) Store, process and use magnetic tapes,
screen prints and any electronic data in any computer system in such a way that
information cannot be retrieved by unauthorized persons.
(d) Advise all personnel who will have access
to the data of the confidential nature of the information, the safeguards
required, and the criminal and civil sanctions for noncompliance contained in
federal and state statutes.
(e)
Permit the SSA and IRS to make onsite inspections to ensure that adequate
safeguards are being maintained.
(f) Ensure that during interactive interviews
confidential information is not exposed to any individual who is not the
subject of the confidential information.
