Current through Register Vol. 41, No. 3, September 23, 2024
A. Except
as otherwise provided in these regulations or consistent with other federal and
state laws or regulations, no person shall disclose or use, or authorize,
permit, or acquiesce to the use of any client information that is directly or
indirectly derived from the client records of the department, agency, provider,
or the State Board of Social Services. Exceptions to this provision are
provided in
22VAC40-910-80,
22VAC40-910-90,
and
22VAC40-910-100.
B. Protecting confidential information. All
client records, which could disclose the client's identity, are confidential
and must be protected in accordance with federal and state laws and
regulations. Such client information includes:
1. Name, address, and any types of
identification numbers assigned to the client and all individuals for whom the
client receives assistance on behalf of, including social security
number;
2. Public assistance, child
support enforcement services, or social services provided to the
client;
3. Information received for
verifying income and eligibility;
4. Evaluation of the client's confidential
information;
5. Social and medical
data about the client and all individuals for whom the client receives
assistance on behalf of, including diagnoses and past histories of disease or
disabilities;
6. Information
received from third parties such as an employer; and
7. Information associated with processing and
rendering appeals.
C.
Ownership of client records.
1. Client records
are the property of the department or agency. Employees and agents of the
department or agency must protect and preserve such records from dissemination
except as provided in this chapter.
2. Only authorized employees and agents may
remove client records from the department or agency's premises.
3. The department and agency shall destroy
client records pursuant to records retention schedules consistent with federal
and state regulations.
D. Disclosure of client information.
1. Consent. As part of the application
process for public assistance or social services, the client or legally
responsible person must be informed of the need to consent to a third-party
release of client information necessary for verifying his eligibility or
information provided. Whenever a person or organization that is not performing
one or more of the functions delineated in
22VAC40-910-80
C or does not have a legitimate interest pursuant to
22VAC40-910-100
requests client information, the person or organization must obtain written
permission from the client or the legally responsible person for the release of
the client information unless one of the conditions delineated in this
subsection exists. A client's authorization for release of client information
obtained by the department, agency, or provider also satisfies this
requirement.
Client records may be released without the client's written
permission if a court of competent jurisdiction has ordered the production of
client records and the department, agency, or provider does not have sufficient
time to notify the client or legally responsible person before responding to
the order.
2. The
Commissioner of the Virginia Department of Social Services, the State Board of
Social Services, and their agents shall have the discretion to release
nonidentifying statistical information. A client's written permission is not
required in order to release nonidentifying statistical information when such
release is permissible in accordance with state and federal law and
regulations.
3. The Commissioner of
the Virginia Department of Social Services, the State Board of Social Services,
and their agents do not have to obtain consent from the client to obtain or
review client records.
Statutory Authority: §
63.2-217
of the Code of Virginia.
