Chapter 910. General Provisions for Maintaining and Disclosing Confidential Information of Public Assistance, Child Support Enforcement, and Social Services Record
22VAC40-910-10. Definitions.
The following words and terms when used in this chapter will have the following meanings unless the context clearly indicates otherwise:
"Agency" means a local department of social services.
"Agent" means any individual authorized to act on behalf of or under the direction of the Commissioner of the Virginia Department of Social Services or State Board of Social Services for the sole purpose of accessing confidential client records in the administration of public assistance, child support enforcement, or social services programs.
"Client" means any applicant for or recipient of public assistance or social services or any individual about whom the child support enforcement division maintains information.
"Client record" or "client information" means any identifying or nonidentifying information, including information stored in computer data banks or computer files relating to a client.
"Department" means the Virginia Department of Social Services.
"Human research" means any formal and structured evaluation involving individuals in a special project, program, or study.
"Legally responsible person" means (i) the biological or adoptive parent or other relative with whom the child primarily resides and who has legal custody of the child; (ii) the biological or adoptive parent with whom the child does not primarily reside and who has legal custody of the child; or (iii) a committee or guardian appointed by a court to represent the interest of a client.
"Near fatality" means an act that, as certified by a physician, places the child in serious or critical condition. Serious or critical condition is a life-threatening condition or injury.
"Provider" means any person, agency or organization providing public assistance, child support enforcement services, or social services through a contract or an agreement with the department or agency.
"Public assistance" means Temporary Assistance for Needy Families (TANF); auxiliary grants to the aged, blind and disabled; medical assistance; energy assistance; food stamps; employment services; child care; and general relief.
"Research" means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to general knowledge related to specific programs, including research for the development of new knowledge or techniques that would be useful in the administration of public assistance, child support enforcement, or social services programs.
"Social services program" means foster care, adoption, adoption assistance, adult services, adult protective services, child protective services, domestic violence services, family preservation, or any other services program implemented in accordance with regulations promulgated by the State Board of Social Services.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003; amended, Virginia Register Volume 30, Issue 6, eff. January 2, 2014.
22VAC40-910-20. General provisions.
A. Except as otherwise provided in these regulations or consistent with other federal and state laws or regulations, no person shall disclose or use, or authorize, permit, or acquiesce to the use of any client information that is directly or indirectly derived from the client records of the department, agency, provider, or the State Board of Social Services. Exceptions to this provision are provided in 22VAC40-910-80, 22VAC40-910-90, and 22VAC40-910-100.
B. Protecting confidential information. All client records, which could disclose the client's identity, are confidential and must be protected in accordance with federal and state laws and regulations. Such client information includes:
1. Name, address, and any types of identification numbers assigned to the client and all individuals for whom the client receives assistance on behalf of, including social security number;
2. Public assistance, child support enforcement services, or social services provided to the client;
3. Information received for verifying income and eligibility;
4. Evaluation of the client's confidential information;
5. Social and medical data about the client and all individuals for whom the client receives assistance on behalf of, including diagnoses and past histories of disease or disabilities;
6. Information received from third parties such as an employer; and
7. Information associated with processing and rendering appeals.
C. Ownership of client records.
1. Client records are the property of the department or agency. Employees and agents of the department or agency must protect and preserve such records from dissemination except as provided in this chapter.
2. Only authorized employees and agents may remove client records from the department or agency's premises.
3. The department and agency shall destroy client records pursuant to records retention schedules consistent with federal and state regulations.
D. Disclosure of client information.
1. Consent. As part of the application process for public assistance or social services, the client or legally responsible person must be informed of the need to consent to a third-party release of client information necessary for verifying his eligibility or information provided. Whenever a person or organization that is not performing one or more of the functions delineated in 22VAC40-910-80 C or does not have a legitimate interest pursuant to 22VAC40-910-100 requests client information, the person or organization must obtain written permission from the client or the legally responsible person for the release of the client information unless one of the conditions delineated in this subsection exists. A client's authorization for release of client information obtained by the department, agency, or provider also satisfies this requirement.
Client records may be released without the client's written permission if a court of competent jurisdiction has ordered the production of client records and the department, agency, or provider does not have sufficient time to notify the client or legally responsible person before responding to the order.
2. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents shall have the discretion to release nonidentifying statistical information. A client's written permission is not required in order to release nonidentifying statistical information when such release is permissible in accordance with state and federal law and regulations.
3. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents do not have to obtain consent from the client to obtain or review client records.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003; Volume 35, Issue 2, eff. November 1, 2018.
22VAC40-910-30. Notification of release of confidential client information.
If one of the conditions in 22VAC40-910-20 D 1a is met and consent is not obtained before the release of the client records, the department, agency or provider must make reasonable efforts to provide written notification to the client or legally responsible person within five business days after disclosure.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003.
22VAC40-910-40. Consent process.
The consent for release of client information must contain the following:
1. The name of the entity supplying the information and the name of the requesting party;
2. The consent must be signed and dated by the client or legally responsible person. The client or legally responsible person may add other information, which may include, but is not limited to, a statement specifying the date, event or condition upon which the consent expires.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003.
22VAC40-910-50. Release of client records for research purposes.
A. Prior to the initiation of research involving client records by any individual or institution that entered into an agreement with or is funded or licensed by the department or agency, a written plan outlining the proposed research must be submitted to the department or agency for review and approval. In the event client records are requested from multiple agencies or the department and an agency or agencies, the plan must be submitted to the department.
B. The plan must include:
1. The purpose of the proposed research;
2. A description of how client records will be used;
3. A provision that when the research is completed, client records will either be destroyed or returned to the department; and
4. A confidentiality agreement signed by the individual or institution's authorized representative, which includes that:
a. Client records will be used only for the purposes for which they are being provided;
b. Client records will not be released to any persons not connected with the research;
c. Security safeguards will be in place to protect against loss and unauthorized access, use, modification or disclosure of client records;
d. Authorized persons involved in the research are required to maintain confidentiality of all client records connected with the research;
e. Identifying information from client records must not be discussed with or released to anyone except authorized persons involved in the research;
f. Final product(s) of the research will not reveal any information that may serve to identify any person about whom information has been obtained through the department, agency or provider without written consent of such person and the department, agency or provider;
g. Authorized person(s) involved in the research who fail to comply with the terms of this confidentiality agreement will be immediately terminated from the research;
h. This confidentiality agreement must survive and continue after completion of the research. The individual or institution continues to be responsible for any breach; and
i. Disclosure of client records in violation of §§ 63.2-102 and 63.2-104 of the Code of Virginia is a Class 1 misdemeanor.
C. Client records will be released for research purposes if the following conditions are met:
1. For public assistance and social services, the Commissioner of the Virginia Department of Social Services or his designee(s), or agency director or his designee(s) authorizes the plan and the release of the client records; or
2. For child support enforcement, the Commissioner of the Virginia Department of Social Services or his designee(s), or the Director of Child Support Enforcement authorizes the plan and the release of the client records; and
3. The individual or institution complied with the appropriate security forms for the release of the client records or has entered into a contract with the department or agency that stipulates the department's or agency's requirements for the confidentiality of client records.
D. The confidentiality of human research activities involving public assistance, child support enforcement, and social services programs and clients is governed by 22VAC40-890, Human Subject Research Regulations, established pursuant to § 63.2-218 of the Code of Virginia.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003.
22VAC40-910-60. Client's right of access to client information.
Any client has the right to obtain their client record upon written or verbal request. The client must be permitted to review or obtain a copy of his client record with the following exceptions:
1. Information that the department, agency or provider is required to keep confidential pursuant to federal and state laws or regulations.
2. Information that the department, agency or provider may withhold from the client pursuant to the Freedom of Information Act (§ 2.2-3700 et seq. of the Code of Virginia).
3. Information that would breach another individual's right to confidentiality. When the material requested includes confidential client information about individuals other than the client, the parts of the client record relating to other individuals will be redacted.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003.
22VAC40-910-70. Publicizing safeguarding requirements.
The department, agency or provider shall inform clients in writing that client information shall be confidential pursuant to federal and state laws.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003.
22VAC40-910-80. Confidential client information pertaining to public assistance.
A. Confidentiality of client information of public assistance programs is assured by §§ 63.2-102 and 63.2-805 G of the Code of Virginia.
B. Information may be released only for a purpose directly connected with the administration of a public assistance program, except as herein provided or pursuant to §§ 63.2-102 and 63.2-805 G of the Code of Virginia.
C. Purposes directly related to the administration of a public assistance program include but are not limited to:
1. Establishing eligibility;
2. Determining the amount of public assistance;
3. Providing services for public assistance clients; and
4. Conducting or assisting in an investigation or prosecution of a civil or criminal proceeding related to the administration of the public assistance program.
D. Release of client records to law-enforcement agencies and Commonwealth's and county or city attorneys is governed by 7 CFR 272.1(c)(1).
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003; amended, Virginia Register Volume 30, Issue 6, eff. January 2, 2014.
22VAC40-910-90. Confidential client information pertaining to child support enforcement.
A. Confidentiality of child support enforcement client information is assured by §§ 63.2-102 and 63.2-103 of the Code of Virginia.
B. Information may be released only for a purpose directly connected with the administration of the child support enforcement program, except as provided in this chapter or pursuant to §§ 63.2-102, 63.2-103, 63.2-1906 and 63.2-1940 of the Code of Virginia.
C. Purposes directly related to the administration of the child support enforcement program include:
1. Determining the amount of child support;
2. Providing child support enforcement services; and
3. Conducting or assisting in an investigation or prosecution of a civil or criminal proceeding related to the administration of the child support enforcement program.
D.
Release of health insurance information is governed by 22VAC40-880-560.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003; amended, Virginia Register Volume 30, Issue 6, eff. January 2, 2014; Volume 35, Issue 2, eff. November 1, 2018.
22VAC40-910-100. Confidential client information pertaining to social services programs.
A. Confidentiality of client information of social services programs is assured by §§ 63.2-104 and 63.2-105 of the Code of Virginia.
B. Releasing confidential social services information.
1. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents shall have access to all social services client records pursuant to § 63.2-104 of the Code of Virginia.
2. Social services client records must be confidential and can only be released to persons having a legitimate interest in accordance with federal and state laws and regulations pursuant to § 63.2-104 of the Code of Virginia. Section 63.2-104 of the Code of Virginia does not apply to the disclosure of adoption records, reports, and information. The disclosure of adoption records, reports, and information is governed by § 63.2-1246 of the Code of Virginia.
3. The following statutory and regulatory provisions provide guidance on the definition of legitimate interest as applied to specific social services programs:
a. Adult Protective Services client records can be released to persons having a legitimate interest pursuant to 22VAC30-100-50.
b. Child Protective Services Client Records and Information Disclosure:
(1) Child protective services client records can be released to persons having a legitimate interest pursuant to § 63.2-105 A of the Code of Virginia.
(2) The public has a legitimate interest to limited information about child abuse or neglect cases that resulted in a child fatality or near fatality. Pursuant to the Child Abuse and Prevention Treatment Act (CAPTA), as amended (P.L. 108-36 (42 USC § 5106a)) states must have provisions that allow for public disclosure of the findings or information about the case of child abuse or neglect that has resulted in a child fatality or near fatality. Accordingly, agencies must release the following information to the public, providing that nothing disclosed would be likely to endanger the life, safety, or physical or emotional well-being of a child or the life or safety of any other person; or that may compromise the integrity of a Child Protective Services investigation, or a civil or criminal investigation, or judicial proceeding:
(a) The fact that a report has been made concerning the alleged victim child or other children living in the same household;
(b) Whether an investigation has been initiated;
(c) The result of the completed investigation;
(d) Whether previous reports have been made concerning the alleged victim child or other children living in the same household and the dates thereof, a summary of those previous reports, and the dates and outcome of any investigations or actions taken by the agency in response to those previous reports of child abuse or neglect; and
(e) The agency's activities in handling the case.
(3) Information regarding child protective services reports, complaints, investigation and related services and follow-up may be shared with the appropriate Family Advocacy Program representative of the United States Armed Forces as provided in 22VAC40-705-140 E, Child Protective Services Release of Information to Family Advocacy Program Representatives of the United States Armed Forces.
(4) The agency must release child protective services client records in the instances of mandatory disclosure as provided in 22VAC40-705-160. The local department may release the information without written consent.
4. Foster care client records about children in foster care or their parents can be released upon order of the court. For instance, client records may be released to the guardian ad litem and the court appointed special advocate who are appointed for a child as a result of a court order or to attorneys representing the child or the child's parents.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003; amended, Virginia Register Volume 26, Issue 1, eff. October 14, 2009; Volume 35, Issue 2, eff. November 1, 2018.
22VAC40-910-110. Other confidentiality regulatory provisions.
This regulation does not supersede existing regulations pertaining to the confidentiality of client records and should be read in conjunction with all public assistance, child support enforcement, and social services confidentiality regulations under Title 22 of the Virginia Administrative Code.
Statutory Authority
§ 63.2-217 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 19, Issue 24, eff. September 1, 2003.