Title of Regulation: 22VAC40-910. General Provisions for Maintaining and Disclosing Confidential Information of Public Assistance, Child Support Enforcement, and Social Services Record (amending 22VAC40-910-20, 22VAC40-910-90, 22VAC40-910-100).

Statutory Authority: § 63.2-217 of the Code of Virginia.

Public Hearing Information: No public hearings are scheduled.

Public Comment Deadline: October 17, 2018.

Effective Date: November 1, 2018.

Agency Contact: Eleanor Brown, Senior Research Associate, Department of Social Services, 801 East Main Street, Richmond, VA 23219, telephone (804) 726-7076, FAX (804) 726-7946, or email eleanor.brown@dss.virginia.gov.

Basis: Section 63.2-217 of the Code of Virginia gives the State Board of Social Services the responsibility to make rules and regulations to carry out the purposes of social services programs. Sections 63.2-102 through 63.2-105 of the Code of Virginia pertain to confidentiality of public assistance and social services records and information.

Purpose: The language has been amended to delete or update references to regulations that have been repealed or renumbered. The goal of amending the regulation is to update and clarify it for the agency and the welfare of the public.

Rationale for Using Fast-Track Rulemaking Process: This regulatory action merely cleans up and streamlines the existing regulation. These are minor changes that will not alter the intent or requirements of the regulation. Therefore, it is not anticipated to be controversial.

Substance: Amendments include (i) removing a condition under which client information can be disclosed that is redundant and found elsewhere in the same regulation; (ii) clarifying when nonidentifying statistical information about clients can be released; (iii) deleting regulatory provisions under 22VAC40-910-90 that refer to repealed regulations; and (iv) updating a reference to a regulation.

Issues: These changes pose no disadvantage to the public, agency, or Commonwealth. The advantage to all parties of the proposed changes to the wording is making the regulation easier to comprehend.

Small Business Impact Review Report of Findings: This fast-track rulemaking action serves as the report of the findings of the regulatory review pursuant to § 2.2-4007.1 of the Code of Virginia.

Department of Planning and Budget's Economic Impact Analysis:

Summary of the Proposed Amendments to Regulation. The State Board of Social Services (Board) proposes to: 1) add clarifying language, 2) delete redundant text and provisions that refer to repealed regulations, and 3) update a reference to a regulation that was renumbered.

Result of Analysis. The benefits likely exceed the costs for all proposed changes.

Estimated Economic Impact. None of the proposed amendments affect rules or requirements. The changes may be beneficial nonetheless in that the rules and requirements may become clearer to the reader.

Businesses and Entities Affected. The proposed amendment potentially affects all individuals who comment on pending regulatory changes.

Localities Particularly Affected. The proposed amendments do not disproportionately affect particular localities.

Projected Impact on Employment. The proposed amendments do not significantly affect employment.

Effects on the Use and Value of Private Property. The proposed amendments do not affect the use and value of private property.

Real Estate Development Costs. The proposed amendments do not affect real estate development costs.

Small Businesses:

Definition.

Pursuant to § 2.2-4007.04 of the Code of Virginia, small business is defined as "a business entity, including its affiliates, that (i) is independently owned and operated and (ii) employs fewer than 500 full-time employees or has gross annual sales of less than $6 million."

Costs and Other Effects. The proposed amendments do not significantly affect costs for small businesses.

Alternative Method that Minimizes Adverse Impact. The proposed amendments do not adversely affect small businesses.

Adverse Impacts:

Businesses. The proposed amendments do not adversely affect businesses.

Localities. The proposed amendments do not adversely affect localities.

Other Entities. The proposed amendments do not adversely affect other entities.

Agency's Response to Economic Impact Analysis: The Department of Social Services concurs with the economic impact analysis prepared by the Department of Planning and Budget.

Summary:

The amendments (i) clarify existing language, (ii) delete a citation to repealed regulations, and (iii) update a citation to a regulation.

22VAC40-910-20. General provisions.

A. Except as otherwise provided in these regulations or consistent with other federal and state laws or regulations, no person shall disclose or use, or authorize, permit, or acquiesce to the use of any client information that is directly or indirectly derived from the client records of the department, agency, provider, or the State Board of Social Services. Exceptions to this provision are provided in 22VAC40-910-80, 22VAC40-910-90, and 22VAC40-910-100.

B. Protecting confidential information. All client records, which could disclose the client's identity, are confidential and must be protected in accordance with federal and state laws and regulations. Such client information includes, but is not limited to:

1. Name, address, and any types of identification numbers assigned to the client and all individuals for whom the client receives assistance on behalf of, including but not limited to social security number;

2. Public assistance, child support enforcement services, or social services provided to the client;

3. Information received for verifying income and eligibility;

4. Evaluation of the client's confidential information;

5. Social and medical data about the client and all individuals for whom the client receives assistance on behalf of, including diagnoses and past histories of disease or disabilities;

6. Information received from third parties such as an employer; and

7. Information associated with processing and rendering appeals.

C. Ownership of client records.

1. Client records are the property of the department or agency. Employees and agents of the department or agency must protect and preserve such records from dissemination except as provided herein in this chapter.

2. Only authorized employees and agents may remove client records from the department or agency's premises.

3. The department and agency shall destroy client records pursuant to records retention schedules consistent with federal and state regulations.

D. Disclosure of client information.

1. Consent. As part of the application process for public assistance or social services, the client or legally responsible person must be informed of the need to consent to a third-party release of client information necessary for verifying his eligibility or information provided. Whenever a person or organization that is not performing one or more of the functions delineated in 22VAC40-910-80 C or does not have a legitimate interest pursuant to 22VAC40-910-100 requests client information, the person or organization must obtain written permission from the client or the legally responsible person for the release of the client information unless one of the conditions delineated in this subsection exists. A client's authorization for release of client information obtained by the department, agency, or provider also satisfies this requirement.

Client records may be released without the client's written permission under the following conditions: a. A court of competent jurisdiction has ordered the production of client records and the department, agency or provider does not have sufficient time to notify the client or legally responsible person before responding to the order. b. For research purposes as provided in 22VAC40-910-50 if a court of competent jurisdiction has ordered the production of client records and the department, agency, or provider does not have sufficient time to notify the client or legally responsible person before responding to the order.

2. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents shall have the discretion to release nonidentifying statistical information. A client's written permission is not required in order to release nonidentifying statistical information when such release is permissible in accordance with state and federal law and regulations.

3. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents do not have to obtain consent from the client to obtain or review client records.

22VAC40-910-90. Confidential client information pertaining to child support enforcement.

A. Confidentiality of child support enforcement client information is assured by §§ 63.2-102 and 63.2-103 of the Code of Virginia.

B. Information may be released only for a purpose directly connected with the administration of the child support enforcement program, except as herein provided in this chapter or pursuant to §§ 63.2-102, 63.2-103, 63.2-1906 and 63.2-1940 of the Code of Virginia.

C. Purposes directly related to the administration of the child support enforcement program include but are not limited to:

1. Determining the amount of child support;

2. Providing child support enforcement services; and

3. Conducting or assisting in an investigation or prosecution of a civil or criminal proceeding related to the administration of the child support enforcement program.

D. The following regulatory provisions provide guidance on the release of child support enforcement client information:

1. Entities to whom the Division of Child Support Enforcement can release client information is governed by 22VAC40-880-520;

2. The release of client information to and from the Internal Revenue Service is governed by 22VAC40-880-530;

3. Request for client information from the general public is governed by 22VAC40-880-540;

4. Requests for client information from parents is governed by 22VAC40-880-550;

5. Release of health insurance information is governed by 22VAC40-880-560; and

6. Release of client records to law-enforcement agencies and Commonwealth's and county or city attorneys is governed by 22VAC40-880-520 B

Release of health insurance information is governed by 22VAC40-880-560.

22VAC40-910-100. Confidential client information pertaining to social services programs.

A. Confidentiality of client information of social services programs is assured by §§ 63.2-104 and 63.2-105 of the Code of Virginia.

B. Releasing confidential social services information.

1. The Commissioner of the Virginia Department of Social Services, the State Board of Social Services, and their agents shall have access to all social services client records pursuant to § 63.2-104 of the Code of Virginia.

2. Social services client records must be confidential and can only be released to persons having a legitimate interest in accordance with federal and state laws and regulations pursuant to § 63.2-104 of the Code of Virginia. Section 63.2-104 of the Code of Virginia does not apply to the disclosure of adoption records, reports, and information. The disclosure of adoption records, reports, and information is governed by § 63.2-1246 of the Code of Virginia.

3. The following statutory and regulatory provisions provide guidance on the definition of legitimate interest as applied to specific social services programs:

a. Adult Protective Services client records can be released to persons having a legitimate interest pursuant to 22VAC40-740-50 B 22VAC30-100-50.

b. Child Protective Services Client Records and Information Disclosure:

(1) Child protective services client records can be released to persons having a legitimate interest pursuant to § 63.2-105 A of the Code of Virginia.

(2) The public has a legitimate interest to limited information about child abuse or neglect cases that resulted in a child fatality or near fatality. Pursuant to the Child Abuse and Prevention Treatment Act (CAPTA), as amended (P.L. 108-36 (42 USC § 5106a)) states must have provisions that allow for public disclosure of the findings or information about the case of child abuse or neglect that has resulted in a child fatality or near fatality. Accordingly, agencies must release the following information to the public, providing that nothing disclosed would be likely to endanger the life, safety, or physical or emotional well-being of a child or the life or safety of any other person; or that may compromise the integrity of a Child Protective Services investigation, or a civil or criminal investigation, or judicial proceeding:

(a) The fact that a report has been made concerning the alleged victim child or other children living in the same household;

(b) Whether an investigation has been initiated;

(c) The result of the completed investigation;

(d) Whether previous reports have been made concerning the alleged victim child or other children living in the same household and the dates thereof, a summary of those previous reports, and the dates and outcome of any investigations or actions taken by the agency in response to those previous reports of child abuse or neglect; and

(e) The agency's activities in handling the case.

(3) Information regarding child protective services reports, complaints, investigation and related services and follow-up may be shared with the appropriate Family Advocacy Program representative of the United States Armed Forces as provided in 22VAC40-720 22VAC40-705-140 E, Child Protective Services Release of Information to Family Advocacy Program Representatives of the United States Armed Forces.

(4) The agency must release child protective services client records in the instances of mandatory disclosure as provided in 22VAC40-705-160. The local department may release the information without written consent.

4. Foster care client records about children in foster care or their parents can be released upon order of the court. For instance, client records may be released to the guardian ad litem and the court appointed special advocate who are appointed for a child as a result of a court order or to attorneys representing the child or the child's parents.