Section 441.9.7. Consent to disclosure by the subject of a confidential record.

To the extent permitted by any applicable provision of law, the subject of a confidential record may have a copy of the portion of that record concerning the subject disclosed to a third party. A request for such a disclosure must be in writing and must identify the particular record or records to be disclosed, the particular person or class of persons to whom the record may be disclosed, and the time period during which the record may be disclosed. The subject of the record and, where applicable, the person to whom the record is to be disclosed may be required to provide proof of identity.

No confidential information about clients of the department shall be released without the client’s consent, except as provided in rule 441—9.10(17A,22). Release of information includes:

        1.            Granting access to or allowing the copying of a record,

        2.            Providing information either in writing or orally, or

        3.            Acknowledging information to be true or false.

       9.7(1) Forms.

        a.           General. Department staff shall use Form 470-2115, Authorization for the Department to Release Information, for releases by the subject that do not involve health information requiring use of the authorization form described in paragraph 9.7(1)“c.”

        b.           Obtaining information from a third party. The department is required to obtain information to establish eligibility, determine the amount of assistance, and provide services. Requests to third parties for this information involve release of confidential identifying information about clients. Except as provided in rule 441—9.9(17A,22), the department may make these requests only when the client has authorized the release on one of the following forms.

       (1)             Form 470-0461, Authorization for Release of Information.

       (2)             Form 470-1630, Household Member Questionnaire.

       (3)             Form 470-1631, Bank or Credit Union Information.

       (4)             Form 470-4670, Addendum for Application and Review Forms for Release of Information.

       (5)             Form 470-1638, Request for School Verification.

       (6)             Form 470-2844, Employer’s Statement of Earnings.

       (7)             Form 470-1640, Verification of Educational Financial Aid.

       (8)             Form 470-3742, Financial Institution Verification.

       (9)             Form 470-3951, Authorization to Obtain or Release Health Care Information.

        c.           Health information.

       (1)             When consent or authorization for use or disclosure of health information is required, facilities and department staff responding to third-party requests for health information shall use Form 470-3951, Authorization to Obtain or Release Health Care Information, or a form from another source that meets HIPAA requirements.

The department shall not require a subject to sign a HIPAA authorization form as a condition of treatment, payment, enrollment in a health plan, or eligibility for benefits. The department as a health care provider may require a subject to sign a HIPAA authorization form for the use or disclosure of protected health information for research, as a condition of the subject’s receiving research-related treatment.

A subject may revoke a HIPAA authorization provided under subparagraph 9.7(1)“c”(1) at any time, provided that the revocation is in writing using Form 470-3949, Request to End an Authorization, except to the extent that the department has taken action in reliance thereon.

       (2)             Except as provided in subparagraph 9.7(1)“c”(1), department staff shall release mental health or substance abuse information only with authorization on Form 470-0429, Consent to Obtain and Release Information, or a form from another source that meets requirements of law.

        d.           Photographs and recordings. The department uses Form 470-0060, Authorization to Take and Use Photographs, and Form 470-0064, Authorization to Take and Use Photographs of Minor or Ward, for permission to use photographs in department publications. The department shall obtain authorization from the subject or person responsible for the subject (such as a guardian, custodian, or personal representative) before taking photographs or making any type of recording for any purpose other than those specifically allowed by law or for internal use within an institution.

        e.           Veteran’s Home. Rescinded IAB 10/29/03, effective 11/1/03.

       9.7(2) Exceptions to use of forms.

        a.           Counsel. Appearance of counsel before the department on behalf of the subject of a confidential record is deemed to constitute consent for the department to disclose records about the subject to the subject’s attorney.

        b.           Public official. A letter from the subject to a public official which seeks the official’s intervention on behalf of the subject in a matter that involves the department shall be treated as an authorization to release information. The department shall release sufficient information about the subject to the official to resolve the matter.

        c.           Medical emergency. Department staff may authorize release of confidential information to medical personnel in a medical emergency if the subject is unable to give or withhold consent. As soon as possible after the release of information, the subject shall be advised of the release.

        d.           Abuse information. Consent to release information is not required to gather information for investigations of child abuse or dependent adult abuse.

       9.7(3) Opportunity for subject to agree or object. This subrule describes when the department may use or disclose protected health information, without a written authorization, to persons involved in the subject’s care and for notification purposes. However, the department shall give the subject an opportunity to agree or object, unless this requirement is waived as specified in paragraph 9.7(3)“e.”

        a.           Involvement in the subject’s care. The department may disclose protected health information that is directly relevant either to a subject’s care or to payment related to the subject’s care, provided payment is relevant to the person’s involvement in the subject’s care. The person involved must be:

       (1)             A family member;

       (2)             Another relative;

       (3)             A close personal friend of the subject; or

       (4)             Any other person identified by the subject.

        b.           Notification purposes. The department may use or disclose protected health information to notify, or assist in notifying, identifying or locating a family member, a personal representative of the subject, or another person responsible for the care of the subject of the subject’s location, general condition or death. For disaster relief purposes, the use or disclosure shall be in accordance with paragraph 9.7(3)“f.”

        c.           Uses and disclosures with the subject present. If the subject is present for, or available before, a use or disclosure permitted by this subrule and has the capacity to make health care decisions, the department may use or disclose the protected health information if the department:

       (1)             Obtains the subject’s agreement;

       (2)             Provides the subject with the opportunity to object to the disclosure, and the subject does not express an objection; or

       (3)             Reasonably infers from the circumstances, based on the exercise of professional judgment, that the subject does not object to the disclosure.

        d.           Informing the subject. The department may orally inform the subject of and obtain the subject’s oral agreement or objection to a use or disclosure permitted by this subrule.

        e.           Limited uses and disclosures when the subject is not present. When the subject is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the subject’s incapacity or an emergency circumstance, the department may, in the exercise of professional judgment, determine that disclosure is in the best interest of the subject.

       (1)             When the department determines that disclosure is in the subject’s best interest, the department may disclose only the protected health information that is directly relevant to the person’s involvement with the subject’s health care.

       (2)             The department may use professional judgment and its experience with common practice to make reasonable inferences of the subject’s best interest in allowing a person to act on behalf of the subject to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of protected health information.

        f.            For disaster relief purposes. The department may use protected health information or disclose protected health information to a public or private organization authorized by law or by its charter to assist in disaster relief efforts for the purpose of coordinating with these organizations the uses or disclosures permitted by paragraph 9.7(3)“b.” The requirements in paragraphs 9.7(3)“c” and “d” apply to these uses and disclosures to the extent that the department, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.

[ARC 0420C, IAB 10/31/12, effective 1/1/13]