Organization and Management (OM) OM-15 WIC Confidentiality and Privacy 1

Maine Center for Disease Control and Prevention WIC Nutrition Program Effective: October 1, 2011 Policy No.OM-15 Revised: October 1, 2022

WIC Confidentiality and Privacy Authority 7 CFR §246.26 (c)(d); and § 246.9 5 U.S.C. §552, Freedom of Information Act 10-144 Chapter 286 §II.C and §II.E Maine Public Law 1999, C. 512, An Act to Amend the Law Governing the Confidentiality of Health Care Information Maine Public Law 1987, C. 539 (rpr) Chapter 501, 19203-D, Release of Confidential HIV Status Information Maine DHHS Policies # DHHS-03-13, DHHS-04-16, DHHS-03-15 and DHHS-02-13 Policy 1. The State Agency, as a public health entity, shall be exempt from the confidentiality measures mandated by Health Insurance Portability and Accountability Act of 1996 (HIPAA). However, the intent of HIPAA privacy protections shall be followed as best practice. 2. The State Agency shall restrict the use and disclosure of confidential applicant and participant information to persons directly connected with the administration or enforcement of the WIC program. 3. Local Agencies shall have all employees sign a Confidentiality Statement and Conflict of Interest Statement annually. 4. Local Agencies shall have a policy that addresses privacy and practices, including the breach of confidentiality. 5. All Freedom of Information Act (FOIA) requests must be sent to the State Agency for response. 6. A WIC participant and/or the authorized representative have the right to access all information they have provided the WIC Program. 7. Requests for participant information from those who are not the authorized representative shall be in compliance with the Maine DHHS Privacy policies (see Appendices OM-15- A, OM-15-B, OM-15-C and OM-15-D).

Organization and Management (OM) OM-15 WIC Confidentiality and Privacy 2

8. The State and/or Local Agency may disclose confidential applicant, participant, or vendor information pursuant to a valid subpoena, administrative subpoena, or search warrant. 9. Indiscriminate use of confidential information by WIC staff shall be prohibited and it shall be mandatory that any breaches in WIC data security or participant confidentiality be reported. 10. Any WIC employee who suspects wrongful or negligent release of identifiable or potentially identifiable data shall immediately report this information to his or her direct supervisor, who shall then immediately notify the State and Local Agency Directors and the ME CDC Privacy Officer. Procedures 1. The Local Agency shall ensure that confidentiality and privacy policies exist within their agencies. 1.1 As part of this policy, the Local Agency must have confidentiality statements that all employees sign (see Appendix OM-15-E Maine CDC WIC Partners’ Confidentiality Statement). 1.2 Copies of all signed Confidentiality Statements shall be sent to the State Agency. 1.3 The original document shall be stored in the employee file. 2. Release forms authorizing disclosure to private physicians or other health care providers may be included as part of the WIC application or certification process. 2.1 The State or Local Agency must: 2.1.1 Permit participants to refuse to sign the release form, and 2.1.2 Notify applicants and participants that signing the form is not a condition of eligibility, and refusing to sign the form shall not affect the applicant’s or participant’s application or participation in the WIC Program. 2.2 All other requests for applicants or participants to sign voluntary release forms must occur after the application and certification process is completed. 3. Release forms used by Maine CDC WIC for the purpose of disclosure of information are: 3.1. Request for Information for Infants and Children (Appendix CE-3-E) 3.2. Request for Information for Women (Appendix CE-3-F) 3.3. Maine CDC WIC Nutrition Program Nutrition Assessment (Appendix CE-3-C) 3.4. Authorization of Release of HIV Status (Appendix CE-3-G)

Organization and Management (OM) OM-15 WIC Confidentiality and Privacy 3

4. WIC staff may also accept disclosure for information from other requesting entities, such as but not limited to private physician(s), DHHS Office of Child and Family Services, and Head Start. 5. Any local, state or federal WIC agency staff may access participant records. Other Local Agency staff may not have access to WIC records without participant consent. 6. Persons under contract with the State Agency to perform research regarding the WIC program or who are investigating or prosecuting WIC program violations under Federal, State or local law may be granted limited access to participant information by the State Agency. 7. The State and Local Agencies shall have a copy of the Maine CDC Privacy Policies (Appendices OM-15-A, OM-15-B and OM-15-C) readily available for guidance concerning release of restricted and unrestricted data. 8. If a participant informs a WIC staff person that she or her child has tested positive for HIV, this information may be documented in the WIC file. If the information is documented, it must be recorded on a separate client note documentation screen. 8.1. In accordance with Public Law, Chapter 501, Section 19203-D, release of this information as part of the certification file cannot be done without a specifically authorized release of HIV status signed by the participant or parent/guardian (see Appendix CE-3-G and Appendix OM-15-D). 8.2. If HIV status alone is the nutrition risk used to determine eligibility for the program (Risk 352b), verification must be obtained from the physician or someone working under the supervision of the physician. A request to release this information must be made on a separate, specific release form (Appendix CE-3-G). Attach the signed release to the appropriate WIC request for information form. 8.3. Questions regarding the release of or request for HIV status information are to be directed to the State Agency to ensure compliance with current State law. 9. Requests for unrestricted data, including data in aggregate or summary form may be granted as long as the released information excludes any items which would identify program participants/applicants. 10. Data sharing agreements with programs and providers outside of the ME CDC WIC Program requires a contract or memorandum of understanding (MOU) that holds the organization/individual accountable to the confidentiality, privacy and data security policies. The written agreement for the release of confidential information must: 10.1. Specify that the receiving organization may use the confidential applicant and participant information only for: 10.1.1. Establishing the eligibility of WIC applicants or participants for the programs that the organization administers; 10.1.2. Conducting outreach to WIC applicants and participants for such programs;

Organization and Management (OM) OM-15 WIC Confidentiality and Privacy 4

10.1.3. Enhancing the health, education, or well-being of WIC applicants or participants who are currently enrolled in such programs, including the reporting of known or suspected child abuse or neglect that is not otherwise required by State law; 10.1.4. Streamlining administrative procedures in order to minimize burdens on staff, applicants, or participants in either the receiving program or the WIC Program; and/or 10.1.5. Assessing and evaluating the responsiveness of a State’s health system to participants’ health care needs and health care outcomes; and 10.1.6. Contain the receiving organization’s assurance that it shall not use the information for any other purpose or disclose the information to a third party. 11. WIC staff shall share confidential participant information with law enforcement if the information is crucial to a criminal report or investigation that is directly related to the receipt of WIC services. Otherwise, a subpoena is required to release any information. 12. WIC staff may release confidential applicant and client information to law enforcement agents investigating or prosecuting WIC Program violations under Federal, State or local law such as in cases of fraud or abuse without a signed release form or client’s consent. The use of this information must be considered necessary for WIC Program purposes as defined by 7CFR §246.26 (d)(ii) and Policy OM-10, Participant Rights and Responsibilities. 13. Upon receiving a subpoena, the Local Agency shall immediately notify the State Agency 13.1. The State Agency shall consult with legal counsel to determine whether the information requested is in fact confidential and prohibited as defined in 7CFR §246.26 (d) and Policy OM-7, Participant Abuse, from being used or disclosed as stated in the subpoena. 13.2. If the State or Local Agency determines that the information is confidential and prohibited from being used or disclosed as stated in the subpoena, the attorney general shall advocate for the WIC program. 14. In responding to a search warrant for confidential information, the State or Local Agency shall: 14.1. Immediately notify the State Agency 14.2. Immediately notify legal counsel for the State and/or Local Agency; 14.3. Comply with the search warrant; and inform the individual(s) serving the search warrant that the information being sought is confidential and seek to limit the disclosure by: 14.3.1. Providing only the specific information requested in the search warrant and no other information, and

Organization and Management (OM) OM-15 WIC Confidentiality and Privacy 5

14.3.2. Limiting to the greatest extent possible the public access to the confidential information disclosed. 14.4. A copy of the search warrant shall be retained in the client’s file and in agency files as evidence of the reason specific information was released regarding a client. 15. The State or Local Agency shall advise and consult legal counsel if any formal complaint from or notice of litigation by a Program applicant or participant are received as a result of the State or Local Agency releasing WIC information in response to a subpoena or search warrant. 16. Any suspected wrongful or negligent release of identifiable or potentially identifiable data, any violation of this WIC Privacy Policy, or other reportable incident described above shall be reported to the State Agency director and the Privacy Officer by submitting an e-mail report detailing the date and nature of the suspected breach, a description of the identified information, the parties involved in the suspected breach, and any other relevant information. No personally identifying information need be included in this initial report. 17. All suspected breaches shall be investigated by the ME CDC Privacy Officer or his/her designee(s), who shall submit a detailed report of findings to the supervisor and other parties as necessary and appropriate. 18. The following are not considered breaches of this WIC Privacy Policy: 18.1. Unintentional acquisition, access, or use of protected health information when such action was made in good faith and within the scope of the employee’s job functions, and when the information is not further acquired, accessed, used, or disclosed. 18.2. Inadvertent disclosure from an individual who is authorized to access protected health information to a similarly situated staff member within the same program. 18.3. Information received as a result of an inappropriate disclosure that is not further acquired, accessed, used or disclosed without authorization. 19. When the Privacy Officer or his/her designee(s) determine that a breach has occurred, a log of the breach shall be created that includes: 19.1. A description of what happened 19.2. The date of the breach and the date of discovery of the breach 19.3. A description of the types of information that were involved in the breach. 20. The Privacy Officer or his/her designee(s) shall submit a final report to the parties involved, describing how the breach was discovered and investigated and, as appropriate, strategies for preventing future breaches.