Virginia Law

A. Prior to the initiation of research involving client records by any individual or institution that entered into an agreement with or is funded or licensed by the department or agency, a written plan outlining the proposed research must be submitted to the department or agency for review and approval. In the event client records are requested from multiple agencies or the department and an agency or agencies, the plan must be submitted to the department.

B. The plan must include:

1. The purpose of the proposed research;

2. A description of how client records will be used;

3. A provision that when the research is completed, client records will either be destroyed or returned to the department; and

4. A confidentiality agreement signed by the individual or institution's authorized representative, which includes that:

a. Client records will be used only for the purposes for which they are being provided;

b. Client records will not be released to any persons not connected with the research;

c. Security safeguards will be in place to protect against loss and unauthorized access, use, modification or disclosure of client records;

d. Authorized persons involved in the research are required to maintain confidentiality of all client records connected with the research;

e. Identifying information from client records must not be discussed with or released to anyone except authorized persons involved in the research;

f. Final product(s) of the research will not reveal any information that may serve to identify any person about whom information has been obtained through the department, agency or provider without written consent of such person and the department, agency or provider;

g. Authorized person(s) involved in the research who fail to comply with the terms of this confidentiality agreement will be immediately terminated from the research;

h. This confidentiality agreement must survive and continue after completion of the research. The individual or institution continues to be responsible for any breach; and

i. Disclosure of client records in violation of §§ 63.2-102 and 63.2-104 of the Code of Virginia is a Class 1 misdemeanor.

C. Client records will be released for research purposes if the following conditions are met:

1. For public assistance and social services, the Commissioner of the Virginia Department of Social Services or his designee(s), or agency director or his designee(s) authorizes the plan and the release of the client records; or

2. For child support enforcement, the Commissioner of the Virginia Department of Social Services or his designee(s), or the Director of Child Support Enforcement authorizes the plan and the release of the client records; and

3. The individual or institution complied with the appropriate security forms for the release of the client records or has entered into a contract with the department or agency that stipulates the department's or agency's requirements for the confidentiality of client records.

D. The confidentiality of human research activities involving public assistance, child support enforcement, and social services programs and clients is governed by 22VAC40-890, Human Subject Research Regulations, established pursuant to § 63.2-218 of the Code of Virginia.