subchapter 23H Confidentiality and access to client records

 

SECTION .0100 ‑ General

 

10A NCAC 23H .0101 SCOPE

The rules of this Subchapter protect the client's right to confidentiality. Non-identifying statistical information, general information about the scope of any programs administered by the agency, and any written policy relevant to the administration of the Medicaid program, are not confidential information.

 

History Note: Authority G.S. 108A-54; 108A-80;

Eff. September 1, 1984;

Amended Eff. August 1, 1990;

Transferred from 10A NCAC 21A .0401 Eff. May 1, 2012;

Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016.

10A NCAC 23H .0102 INFORMATION FROM OTHER AGENCIES

If the agency receives information from another agency or individual, that information shall be treated as any other information generated by the Division of Medical Assistance or the county department of social services, and disclosure thereof will be governed by any condition imposed by the furnishing agency or individual.

 

History Note: Authority G.S. 108A-54; 108A-80;

Eff. September 1, 1984;

Transferred from 10A NCAC 21A .0402 Eff. May 1, 2012;

Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016.

 

10A NCAC 23H .0103 CONFIDENTIALITY

(a) Except as otherwise provided in these Rules it shall be unlawful for any person to obtain, disclose or use, or to authorize, permit or acquiesce to the use of any list of names or other information concerning any client applying for or receiving Medicaid that may be directly or indirectly derived from the records, files, or communications of the agency, or acquired in the course of performing official duties except for purposes directly connected with the administration of the Medicaid program.

(b) Whenever federal or state statutes or regulations specifically address confidentiality issues, the agency shall disclose or keep confidential client information in accordance with those federal or state statutes or regulations.

(c) Whenever there is inconsistency between federal or state statutes or regulations specifically addressing confidentiality issues, the agency shall abide by the statute or regulation which provides more protection for the client.

 

History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.302;

Eff. September 1, 1984;

Amended Eff. August 1, 1990;

Transferred from 10A NCAC 21A .0403 Eff. May 1, 2012;

Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016.

 

10A NCAC 23H .0104 OWNERSHIP OF RECORDS

(a) All client information contained in any records of the agency is the property of the agency, and employees of the agency shall protect and preserve such information from dissemination except as provided by the rules of this Subchapter.

(b) Original client records may not be removed from the premises by individuals other than authorized staff of the agency, except by a court order.

(c) The agency shall be allowed to destroy records in accordance with record retention schedules promulgated by the Division of Archives and History, rules of the Division of Medical Assistance, and state and federal statutes and regulations.

 

History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.306;

Eff. September 1, 1984;

Transferred from 10A NCAC 21A .0404 Eff. May 1, 2012;

Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016.

 

10A NCAC 23H .0105 SECURITY OF RECORDS

(a) The agency shall provide a secure place or places with controlled access for the storage of records. Only individuals who must access client information in order to carry out duties assigned or approved by the agency shall be authorized access to the storage area or areas.

(b) Only authorized individuals may remove a record from the storage area or areas and the authorizing individual shall be responsible for the security of the record until it is returned to the storage area or areas.

(c) The agency shall establish procedures to prevent accidental disclosure of client information from automated data processing systems.

(d) The director shall assure that all authorized individuals are informed of the confidential nature of client information and shall disseminate written policy to and provide training for all persons with access to client information.

 

History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.306;

Eff. September 1, 1984;

Amended Eff. August 1, 1990;

Transferred from 10A NCAC 21A .0405 Eff. May 1, 2012;

Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016.

 

10a NCAC 23H .0106 LIABILITY OF PERSONS WITH ACCESS

(a) Failure to comply with the rules in this Subchapter may constitute a misdemeanor and be punishable by fine or imprisonment as provided by North Carolina General Statute 108A-80.

(b) Individuals employed by the agency and governed by the State Personnel Act are subject to suspension, dismissal or disciplinary action for failure to comply with these Rules.

(c) Individuals other than employees but including volunteers and students who are agents of the Department of Health and Human Services and who have access to client information shall be liable in the same manner as employees.

 

History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.304;

Eff. September 1, 1984;

Amended Eff. August 1, 1990;

Transferred from 10A NCAC 21A .0406 Eff. May 1, 2012.

 

10A NCAC 23H .0107 RIGHT OF ACCESS

(a) An individual has the right to obtain data about his own case. Upon written or verbal request the client shall be able to review or obtain without charge a copy of the information in his records with the following exceptions:

(1) Information that the agency is required to keep confidential by state or federal statutes or regulations;

(2) Confidential information originating from another agency as provided for in Rule .0104 of this Section.

(3) Information that would breach another individual's right to confidentiality.

(b) The agency shall provide access as promptly as feasible but not more than five working days after receipt of the request.

 

History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.306;

Eff. September 1, 1984;

Transferred from 10A NCAC 21A .0407 Eff. May 1, 2012.

 

10A NCAC 23H .0108 WITHHOLDING INFORMATION FROM THE CLIENT

(a) When the director or a delegated representative determines on the basis of the exceptions in Rule .0107 of this Section to withhold information from the client, this reason shall be documented in the client record.

(b) The director or delegated representative must inform the client that information is being withheld, and upon which of the exceptions specified in Rule .0107 of this Section the decision to withhold the information is based. If confidential information originating from another agency is being withheld, the client shall be referred to that agency for access to the information.

(c) When a delegated representative determines to withhold client information, the decision to withhold shall be reviewed by the supervisor of the person making the initial determination.

 

History Note: Authority G.S. 108A-54; 108A-80;

Eff. September 1, 1984;

Amended Eff. August 1, 1990;

Transferred from 10A NCAC 21A .0408 Eff. May 1, 2012.

 

10A NCAC 23H .0109 PROCEDURE FOR REVIEW OF RECORDS

(a) The director or his delegated representative shall be present when the client reviews the record. The director or his delegated representative must document in the client record the review of the record by the client.

(b) A client may contest the accuracy, completeness or relevancy of the information in his record. Correction of the contested information, but not the deletion of the original information if it is required to support receipt of state or federal participation, shall be inserted in the record when the director or his delegated representative concurs that such correction is justified. When the director or his delegated representative does not concur, the client shall be allowed to enter a statement in the record. Such corrections and statements shall be made a permanent part of the record and shall be disclosed to any recipient of the disputed information. If a delegated representative decides not to correct contested information, the decision not to correct shall be reviewed by the supervisor of the person making the initial decision.

(c) Upon written request from the client, his personal representative, including an attorney, may have access to review or obtain without charge, a copy of the information in his record. The client may permit the personal representative to have access to his entire record or may restrict access to certain portions of the record. Rules .0107 and .0108 of this Section shall apply.

 

History Note: Authority G.S. 108A-54; 108A-80;

Eff. September 1, 1984;

Transferred from 10A NCAC 21A .0409 Eff. May 1, 2012.

 

10A NCAC 23H .0110 CONSENT FOR RELEASE

(a) As a part of the application process for Medicaid, the client shall be informed of the need for and give consent to release of information necessary to verify statements to establish eligibility.

(b) No individual shall release any client information which is owned by the Division of Medical Assistance or the county departments of social services, or request the release of information regarding the client from other agencies or individuals without obtaining a signed consent for release of information. Disclosure without obtaining consent shall be in accordance with Rule .0111 of this Section.

(c) The consent for release of information shall be on a form provided by the Division of Medical Assistance or shall contain the following:

(1) Name of the provider and the recipient of the information;

(2) The extent of information to be released;

(3) The name and dated signature of the client;

(4) A statement that the consent is subject to revocation at any time except to the extent that action has been taken in reliance on the consent;

(5) Length of time the consent is valid.

(d) The client may alter the form to contain other information which may include but need not be limited to:

(1) A statement specifying the date, event or condition upon which the consent may expire even if the client does not expressly revoke the consent;

(2) Specific purpose for the release.

(e) The following persons may consent to the release of information:

(1) The client;

(2) The legal guardian if the client has been judged incompetent;

(3) The county department of social services if the client is a minor and in the custody of the county department of social services.

(f) Prior to obtaining a consent for release of information, the delegated representative shall explain the meaning of informed consent. The client shall be told the following:

(1) Contents to be released;

(2) That there is a definite need for the information;

(3) That the client can give or withhold the consent and the consent is voluntary;

(4) That there are statutes and regulations protecting the confidentiality of the information.

 

History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.304; 42 C.F.R. 431.306;

Eff. September 1, 1984;

Amended Eff. August 1, 1990;

Transferred from 10A NCAC 21A .0410 Eff. May 1, 2012.

 

10A NCAC 23H .0111 DISCLOSURE WITHOUT CLIENT CONSENT

(a) Client information from the Medicaid record may be disclosed without the consent of the client under the following circumstances:

(1) To other employees of the county department of social services for purpose of making referrals, supervision, consultation or determination of eligibility;

(2) To other county departments of social services when the client moves to that county and requests Medicaid;

(3) Between the county departments of social services and the Division of Medical Assistance for purposes of supervision and reporting.

(b) Client information may be disclosed without consent to individuals requesting approval to conduct studies of client records, provided such approval is requested in writing and the written request will specify and be approved on the basis of:

(1) An explanation of how the findings of the study have potential for expanding knowledge and improving professional practices;

(2) A description of how the study will be conducted and how the findings will be used;

(3) A presentation of the individual's credentials in the area of investigation;

(4) A description of how the individual will safeguard the information;

(5) An assurance that no report will contain the names of individuals or other information that makes individuals identifiable.

(c) Client information may be disclosed without consent to federal, state, or county employees for the purpose of monitoring, auditing, evaluation, or to facilitate the administration of other state and federal programs, provided that the need for the disclosure of confidential information is justifiable for the purpose and that adequate safeguards are maintained to protect the information from re-disclosure.

(d) Client information may be disclosed without consent for purposes of complying with other state and federal statutes and regulations and court orders.

(e) When information is released without the client's consent, the client shall be informed to the extent possible, of the disclosure. The method of informing the client of the disclosure shall be documented in the appropriate record.

 

History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.306;

Eff. September 1, 1984;

Transferred from 10A NCAC 21A .0411 Eff. May 1, 2012.

 

10A NCAC 23H .0112 DOCUMENTATION OF CONSENT OR DISCLOSURE

Whenever client information is disclosed in accordance with rules of this Subchapter, the director or delegated representative shall insure that documentation of the disclosure is placed in the appropriate client record.

 

History Note: Authority G.S. 108A-54; 108A-80;

Eff. September 1, 1984;

Transferred from 10A NCAC 21A .0412 Eff. May 1, 2012.

 

10A NCAC 23H .0113 PERSONS DESIGNATED TO DISCLOSE INFORMATION

Only directors of county departments of social services and their designated representatives may disclose client information in accordance with rules of this Subchapter.

 

History Note: Authority G.S. 108A-54; 108A-80;

Eff. September 1, 1984;

Amended Eff. August 1, 1990;

Transferred from 10A NCAC 21A .0413 Eff. May 1, 2012.