Confidentiality of information.

(a) For the purposes of this section, the term:

(1) “Administering” means running public benefits programs in a manner that complies with District of Columbia or federal laws, rules, or regulations.

(2) “Applicant” means an individual who has submitted an application for services under one or more IMA programs.

(3) “Disclosure” means the release, transfer, provision of, provision of access to, or distribution of information in any manner by an entity holding the information to a person outside of the entity.

(4) “Health Insurance Portability and Accountability Act” means the Health Insurance Portability and Accountability Act of 1996, approved August 21, 1996 (Pub. L. 104-191; 110 Stat. 1936), and the regulations issued thereunder, 45 C.F.R. Parts 160 and 164, enacted for the primary purpose of safeguarding the privacy of an individual’s protected health information by restricting the use or disclosure of the information to certain limited circumstances, such as treatment by medical providers, payment of medical bills, or health care operations.

(5) “IMA” means the Income Maintenance Administration within the Department of Human Services.

(6) “IMA programs” means public benefit programs, including TANF, POWER, Medical Assistance (including Medicaid), Food Stamps, Interim Disability Assistance, Burial Assistance, Refugee Resettlement Assistance, General Assistance for Children, Child Care Subsidy, Emergency Rental Assistance, and programs under titles I, V-A, IV-D, XVI, or XIX of Title 21 of the Social Security Act, approved August 14, 1935 (49 Stat. 757; 42 U.S.C. § 301 et seq.), and such other public benefits programs as may be designated as IMA programs by the Mayor.

(7) “Individual’s representative” means a person authorized in writing to review or copy an applicant’s or recipient’s record, or submit or receive information on behalf of the applicant or recipient by:

(A) The applicant or recipient;

(B) A court of competent jurisdiction; or

(C) A person otherwise authorized by law to make decisions on behalf of the applicant or recipient, including decisions related to health care, such as the custodial parent, legal guardian, or personal representative, as set forth at 45 C.F.R. § 164.502(g).

(8) “Personal notes” means:

(A) Mental health information regarding an applicant or recipient disclosed to a mental health professional in confidence by other persons on condition that such information not be disclosed to the applicant or recipient, or to other persons; and

(B) A mental health professional’s speculations about the applicant or recipient.

(9) “Personal representative” means a person who:

(A) Under applicable law, has the authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care;

(B) Is an executor, administrator, or other person who, under applicable law, has authority to act on behalf of a deceased individual or the individual’s estate; or

(C) Is a parent, guardian, or other person acting in loco parentis who may have the authority to act on behalf of an unemancipated minor, as more fully set forth at 45 C.F.R. § 164.502(g).

(10) “Protected health information” means any individually identifiable information, whether oral or recorded, in any form or medium, that is created or received and relates to the past, present, or future physical or mental health condition of an applicant or recipient, or to the payment for health care for an applicant or recipient.

(11) “Recipient” means an applicant who meets the eligibility requirements and has been determined eligible to receive services through an IMA program.

(12) “Record” or “applicant’s or recipient’s record” means any hard copy or electronic item, collection, or grouping of information, which includes protected health information, relating to an applicant or recipient that is maintained, collected, used, or disseminated for the purpose of administering an IMA program. The term “record” or “applicant’s or recipient’s record” includes information that the government of the District of Columbia collects and stores by the operation or administration of computerized public benefits eligibility screening tools.

(b) IMA shall keep records to document information about applicants and recipients relating to IMA programs. The information shall be privileged and confidential and shall only be used or disclosed in accordance with this section.

(1) The applicant or recipient has a right to privacy and shall be provided with a written notice about IMA’s privacy practices and the conditions governing inspection of records. A copy of the notice shall be maintained in the applicant’s or recipient’s record.

(2) IMA shall secure the written authorization of the applicant, recipient, or individual’s representative pursuant to the requirements of 45 C.F.R. § 164.508 before requesting or disclosing information about the applicant or recipient to or from other agencies or individuals. A copy of the authorization shall be maintained in the applicant’s or recipient’s record.

(3) An applicant or recipient shall submit a verbal or written request and an individual’s representative shall submit a written request to access information in an applicant’s or recipient’s record, including protected health information. Except for pyschotherapy and personal notes, and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding, the IMA shall make all information in the applicant’s or recipient’s record available to the applicant, recipient, or the individual’s representative.

(A) IMA shall permit inspection or provide a copy of the information no later than 30 days after receiving the written request if the information is available on-site unless the applicant or recipient is under investigation pursuant to any provisions of subsection (c) of this section. If the written request is for information that is not maintained by or accessible to IMA on-site and IMA has knowledge of the information and its location, IMA must permit inspection or provide a copy of the information no later than 60 days after receiving the written request.

(B) If IMA authorizes disclosure to a third party, other than the applicant or recipient’s individual representative, pursuant to a valid authorization, the disclosure shall be limited to the information specifically identified in a written authorization from the applicant, recipient, or the individual’s representative.

(4) An applicant, recipient, or individual’s representative who believes that information in an applicant’s or recipient’s record is inaccurate or misleading may request that IMA amend the information by submitting a written request for amendment setting forth the reason for the change, including documentation, where appropriate. Within 60 days after it receives the request, the IMA shall make a determination on the request and either make amendments to the record or deny the request.

(A) The IMA may deny a request for amendment if the information sought to be amended:

(i) Was not created by IMA, unless the individual requesting the amendment provides a reasonable basis to believe that the originator of the protected health information or the information in the record is no longer available to act on the requested amendment;

(ii) Is not part of the record;

(iii) Is not available for inspection as provided in paragraph (3) of this subsection; or

(iv) Is accurate and complete.

(B) If the request for amendment is denied, the IMA shall provide the applicant, recipient, or the individual’s representative with a written response setting forth the reason for denying the request for amendment and the procedures on how to request reconsideration of the decision, including a statement that the applicant, recipient, or individual’s representative has a right to submit a written statement disagreeing with the denial of all or part of a requested amendment and the basis of such disagreement.

(C) If the request for amendment is granted, the IMA shall notify the applicant, recipient, or individual’s representative of the decision and how to obtain authorization concerning persons to be notified of the amendment.

(D) All documentation generated from a request for amendment shall be included in the record of the applicant or recipient.

(c) All information and records regarding an applicant or recipient provided to or created by the IMA, its representatives, or its employees, in the course of the administration of IMA programs, shall be privileged and confidential and shall only be disclosed:

(1) To the applicant, recipient, or individual’s representative, in accordance with subsection (b) of this section;

(2) To a third party, with a written authorization signed by the applicant, the recipient, or the individual’s representative authorizing disclosure of the specific record, or specific parts of the record; or

(3) Without consent for one of the following purposes:

(A) To administer IMA programs;

(B) To aid in any investigation, prosecution, or criminal or civil proceeding conducted in connection with the administration of IMA programs;

(C) To administer any federal or federally-assisted program, which provides assistance, in cash or in-kind, or services directly to individuals on the basis of need;

(D) To verify a state employment services agency for the purposes of providing information about a public assistance recipient’s eligibility for employer tax credits, except that protected health information shall not be disclosed to such agency;

(E) For an audit or similar activity, such as review of expenditure reports or financial review, conducted in connection with the administration of any public assistance program by any governmental entity which is authorized by law to conduct such audit or activity;

(F) To administer the unemployment compensation program for the District of Columbia or any other state unemployment compensation program, except that protected health information shall not be disclosed to such agency or program;

(G) To report to the Metropolitan Police Department information on known or suspected instances of physical or mental injury, sexual abuse, or exploitation, or to report to the appropriate authority charged with investigating such allegations information on known or suspected instances of negligent treatment or maltreatment of a child or vulnerable adult receiving aid under circumstances which indicate that the child’s or vulnerable adult’s health or welfare is threatened;

(H) To comply with a court order (a subpoena being insufficient) issued by a court of competent jurisdiction to compel disclosure of an applicant’s or recipient’s record or testimony of any Mayor’s representative concerning an applicant or recipient for purposes directly related to the purposes listed in subparagraphs (A) through (G) of this paragraph; or

(I) For the purposes of and in accordance with Chapter 2A of Title 7 [ § 7-241 et seq.].

(d)

(1) The administrator of the IMA shall approve each request for disclosure of a record made pursuant to subsection (c)(3) of this section before the IMA releases the record, or any portion thereof. For each disclosure of a record pursuant to subsection (c)(3) of this section, the IMA shall:

(A) Record the disclosure in the applicant’s or recipient’s record;

(B) Disclose only the information minimally necessary to satisfy the purpose of the request; and

(C) Maintain a central log accounting for disclosures of protected health information.

(2) An accounting for an approved disclosure shall contain, at minimum, the following:

(A) The date of the disclosure;

(B) The name of the person or entity that received the information and, if known, the address of the entity or person;

(C) A brief description of the information disclosed; and

(D) A brief statement of the purpose of the disclosure that states the exact basis for disclosure or, in lieu of that statement, a copy of the written request for disclosure.

(3) Accounting is not required if the information is disclosed:

(A) To administer IMA programs, or to carry out treatment, payment, and health care operations;

(B) To persons involved in the applicant’s or recipient’s care;

(C) For national security or intelligence purposes;

(D) To correctional institutions or law enforcement officials;

(E) Prior to April 14, 2003; or

(F) For the purposes of and in accordance with Chapter 2A of Title 7 [ § 7-241 et seq.].

(e) The IMA shall review a requestor’s credentials to verify the requestor’s identity and authority before disclosing records to an applicant, recipient, or individual’s representative, or to a person requesting disclosure of records pursuant to subsection (c)(3) of this section.

(f) The IMA shall implement appropriate procedures to ensure the security of records and to minimize inadvertent disclosures of confidential records, including protected health information.

(g) The IMA shall retain all information in an applicant’s and recipient’s record for at least 3 years after the case is closed. A request for a disclosure of information under subsection (c)(3) of this section, along with the supporting documentation for each such request that the IMA is required to maintain under subsection (d) of this section, shall be retained by the IMA for at least 6 years, and shall be disclosed to an applicant, recipient, or individual representative upon written request.

(h) The IMA shall ensure that IMA employees are trained on the provisions of this section and are aware that unauthorized use or disclosure of records may constitute cause for adverse or corrective personnel action.

(i) The Mayor, pursuant to subchapter I of Chapter 5 of Title 2 , may issue rules to implement the provisions of this section.