22 Va. Admin. Code § 40-910-20 - General provisions

A. Except as otherwise provided in these regulations or consistent with other federal and state laws or regulations, no person shall disclose or use, or authorize, permit, or acquiesce to the use of any client information that is directly or indirectly derived from the client records of the department, agency, provider, or the State Board of Social Services. Exceptions to this provision are provided in 22VAC40-910-80, 22VAC40-910-90, and 22VAC40-910-100.

B. Protecting confidential information. All client records, which could disclose the client's identity, are confidential and must be protected in accordance with federal and state laws and regulations. Such client information includes:

1. Name, address, and any types of identification numbers assigned to the client and all individuals for whom the client receives assistance on behalf of, including social security number;

2. Public assistance, child support enforcement services, or social services provided to the client;

3. Information received for verifying income and eligibility;

4. Evaluation of the client's confidential information;

5. Social and medical data about the client and all individuals for whom the client receives assistance on behalf of, including diagnoses and past histories of disease or disabilities;

6. Information received from third parties such as an employer; and

7. Information associated with processing and rendering appeals.

C. Ownership of client records.

1. Client records are the property of the department or agency. Employees and agents of the department or agency must protect and preserve such records from dissemination except as provided in this chapter.

2. Only authorized employees and agents may remove client records from the department or agency's premises.

3. The department and agency shall destroy client records pursuant to records retention schedules consistent with federal and state regulations.

D. Disclosure of client information.

1. Consent. As part of the application process for public assistance or social services, the client or legally responsible person must be informed of the need to consent to a third-party release of client information necessary for verifying his eligibility or information provided. Whenever a person or organization that is not performing one or more of the functions delineated in 22VAC40-910-80 C or does not have a legitimate interest pursuant to 22VAC40-910-100 requests client information, the person or organization must obtain written permission from the client or the legally responsible person for the release of the client information unless one of the conditions delineated in this subsection exists. A client's authorization for release of client information obtained by the department, agency, or provider also satisfies this requirement.

Client records may be released without the client's written permission if a court of competent jurisdiction has ordered the production of client records and the department, agency, or provider does not have sufficient time to notify the client or legally responsible person before responding to the order.

2. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents shall have the discretion to release nonidentifying statistical information. A client's written permission is not required in order to release nonidentifying statistical information when such release is permissible in accordance with state and federal law and regulations.

3. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents do not have to obtain consent from the client to obtain or review client records.

Notes

22 Va. Admin. Code § 40-910-20

Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003; Amended, Virginia Register Volume 35, Issue 02, eff. 11/1/2018.

Statutory Authority: § 63.2-217 of the Code of Virginia.