450.1 Policy 450 Confidentiality May 9, 2019 (Revised) POLICY Local WIC programs shall keep information about participants’ and applicants’ records confidential. PURPOSE To protect participants’ and applicants’ right to confidentiality, local WIC programs shall restrict the use or disclosure of information to persons directly connected with the administration or enforcement of the WIC program. RELEVANT REGULATIONS 7 CFR §246.26(d) Confidentiality of applicant and participant information 42 CFR Part 2—Confidentiality of Alcohol and Drug Abuse Patient Records; Final Rule OAR 333-025-0160 ORS 179.505 (as amended)—Inspection of patient records, consent, exceptions scope of use, release to others, penalty ORS 419B—Reporting of Child Abuse ORS 433.045(3)—HIV/AIDS WRO Policy Memo 800-B WIC Volunteers and Participant Confidentiality WRO Policy Memo 800-C and ASM 94-3 WRO Policy Memo 800-E and ASM 94-152 Confidentiality Issues WRO Policy Memo 800-O HIPAA and Applicability to WIC OREGON WIC PPM REFERENCES

♦ 451—Change in Guardianship ♦ 588—Program Integrity: Complaints ♦ 596—Program Integrity: Acknowledgement of Employee Responsibilities ♦ 635—Participant Notification: Eligibility and Rights & Responsibilities ♦ 650—WIC Transfers/VOC and WIC Overseas Program ♦ 885—Other Referrals: Required and Recommended ♦ 901—Data Systems Security ♦ 902—State Provided Laptops and Air Cards

Confidentiality, Continued 450.2 APPENDICES 450.11 Appendix A Procedures to Follow in Responding to a Subpoena (WRO policy memo 800-C to FNS Instruction 800-1) DEFINITIONS Basic eligibility information: The least amount of information needed to determine program eligibility. Eligibility criteria include applicant category (pregnant/breastfeeding women, infants and children under age five), residency, income, medical data, medical/nutritional risks, and certification date. CSFP: Commodity Supplemental Food Program. USDA purchased food available to CSFP state agencies that store the food and distribute it to public and non-profit private local agencies. The population served by CSFP is similar to that served by WIC, but CSFP also serves elderly people, and provides food rather than the food vouchers. Eligible people cannot participate in both programs at the same time. Complainant: Any person or group of persons who allege discrimination in the delivery of WIC program benefits and services and who request a fair hearing. Confidentiality: The preservation, in confidence, of all information concerning a participant and/or applicant that may be disclosed between the participant/applicant and the health care provider and their staff, and where release of the information would constitute an invasion of privacy. HIPAA: Health Insurance Portability and Accountability Act, a law which sets national standards for privacy, security and the exchange of participant and/or applicant information. Informed consent: Written authorization, given voluntarily, for exchange of individually identifiable information from the affected individual or a designated alternate, such as a parent consenting for a child. Participant records: Documents, regardless of medium or physical form, containing information relating to case histories, health records, treatment charts, progress reports, or accounts of the participants of any provider that are maintained in the regular course of business. Subpoena: An order that requires the named party to appear before a court at a hearing or a trial, to attend out of court at a deposition or to submit copies of requested documents. BACKGROUND N/A

Confidentiality, Continued 450.3 PROCEDURE Local Program Responsibilities 1.0 Local WIC program staff shall be made aware of the requirement to maintain confidentiality of participant records. All WIC employees must sign a statement to this effect as a condition of employment. This includes provisions to provide confidentiality during the collection of information (i.e., interviewing process), as well as to protect the confidentiality of oral, written and computerized records. Refer to 596—Program Integrity: Acknowledgement of Employee Responsibilities. Staff 1.1. Local programs shall: 1.1.1. provide staff and volunteers with orientation/education regarding confidentiality; 1.1.2. cover confidentiality policies and practices regularly at in-service meetings/training; 1.1.3. designate the responsibility for releasing confidential information to only a small number of individuals; and Volunteers 1.1.4. exercise discretion in the screening, selection and training of volunteers who would have access to participant information. Local programs shall ensure volunteers sign a confidentiality agreement (see WRO Policy Memo 800-B). Participant confidentiality 2.0 Local WIC programs shall comply with the following provisions to ensure participant confidentiality. Participant signature form 2.1. The “Participant Signature Form” (form 57-629), must be reviewed with and signed by all participants at every certification and recertification appointment to ensure understanding. See 596 – Program Integrity: Acknowledgement of Employee Responsibilities. Written authorization 2.2. A participant must voluntarily give written consent before information about the individual can be released to anyone not indicated on the Participant Signature form, except as specified in ¶7.0. Consent must be based on a full understanding of what information will be exchanged, with whom it will be shared, and how it will be used. 2.2.1. Use the least amount of information to accomplish the purpose for which the information was requested. 2.2.2. Usage and disclosure of participant information cannot exceed that which is authorized by the participant. 2.3. Maintain confidentiality of participants’ records. 2.4. Allow participants access to their own records. Refer to ¶8.0 of this policy.

Confidentiality, Continued 450.4 2.5. Protect from unauthorized disclosure the names or other identifying information (e.g., addresses) of program participants, except for statistical information that does not identify any individual by name, e.g., height, weight, risk factor, age, race or zip code. Refer to ¶7.2 of this policy. 2.6. Verify telephone requests to assure that the requesting party is entitled to the information and to confirm their identify. 2.7. Release participant health information only when an authorizing signature or telephone verification has been obtained. WIC eligibility information 3.0 USDA regulations state that local WIC programs shall restrict the use or disclosure of confidential applicant or participant information to: • Persons directly connected with the administration or enforcement of the WIC program; • Persons investigating or prosecuting violations in the WIC program under federal, state, or local authority; • Persons under contract with the State agency to perform research regarding the WIC Program; and • The comptroller general of the United States for audit and examination authorized by law. Transfers 3.1. Local programs are required to issue transfer cards with at least the minimum WIC eligibility information without a written authorization from the participant (see 650—WIC Transfers/VOC and WIC Overseas Program). No VOC card 3.2. WIC Programs (either in Oregon or in another state or territory) and CSFPs may request the minimum WIC eligibility information when a participant does not have a VOC card. The requesting program does not need a release of information for this transfer information to another WIC Program. Sharing WIC participant information for non-WIC purposes 4.0 According to federal WIC regulations, state and local WIC programs may disclose confidential applicant and participant information to public organizations for use in their programs that serve persons eligible for WIC. Memorandum of understanding 4.1. Prior to sharing confidential participant information, a Memorandum of Understanding (MOU) must be signed between WIC and the receiving agency. The MOU must state the purpose(s) for which the confidential information will be used.

Confidentiality, Continued 450.5 Purpose of information-sharing 4.2. The receiving organization may use the confidential information only for: • Establishing the eligibility of WIC applicants or participants for the programs that the organization administers; • Conducting outreach to WIC applicants and participants for such programs; • Enhancing the health, education or well-being of WIC applicants or participants who are currently enrolled in such programs, including the reporting of known or suspected child abuse or neglect that is not otherwise required by state law; • Streamlining administrative procedures in order to minimize burdens on staff, applicants or participants in either the receiving program or the WIC program; and/or • Assessing and evaluating the responsiveness of the state’s health system to participants’ health care needs and health care outcomes. Required written authorization 5.0 An MOU does not apply in the following cases. A specific written authorization for release of information, located in the References section of this policy, is required before these types of confidential information may be disclosed: HIV/AIDS 5.1. An HIV test and result information has special protection. A written release of information must be obtained from the patient/participant specifying that HIV test information may be disclosed. Pursuant to ORS 192.558: 5.1.1. Regardless of the manner of receipt or the source of the information, including information received from the tested individual, no person shall disclose or be compelled to disclose the identity of any individual upon whom an HIV-related test is performed, or the results of such a test in a manner which permits identification of the subject of the test, except as required or permitted by the law of this state or any rule, including an Oregon Health Authority rule considered necessary for public health or health care purposes, or as authorized by the individual whose blood is tested. 5.1.2. Written authorization for the release of HIV test information is required to include specific information. [OAR 333-025-0160] (See Reference 3 on page 450.10.) 5.1.3. Do not redisclose participant HIV test information. Alcohol and drug abuse 5.2. Alcohol and drug information can only be released after obtaining written release of information specifically for alcohol and drug information. For a sample form, see #3 in References section of this policy. 5.2.1. Do not redisclose participant alcohol and drug information. Mental health and disability

Confidentiality, Continued 450.6 5.3. Mental health and developmental disability information can only be released after obtaining a written release of information specifically for mental health or developmental disability information. 5.3.1. Do not redisclose participant mental health and disability information. Documentation of all disclosures 6.0 Whenever a participant’s record (or part of the record) is disclosed in a situation that requires written authorization, the signed authorization should be kept on file. 6.1. Keep the signed authorization in an aggregate file by date along with the “Participant Signature Form” or in a special alpha file. 6.2. The authorization for release of information shall include: • Participant name; • Date of disclosure; • Date of expiration; • Name of recipient; • Name of disclosing person; and • The information disclosed or a description of the information. Disclosures without authorization 7.0 Confidential information may be released without participant consent in certain instances. Mandatory reporting of suspected child abuse or neglect 7.1. Suspected child abuse or neglect must be reported to a law enforcement agency or to the appropriate agency of the Department of Human Services. In the case of child abuse, follow your local program’s procedure for reporting mandatory abuse. [ORS 419B.010] Statistical information 7.2. Local WIC programs may disclose information or data to persons engaged in scientific research, program evaluation, peer review, quality assurance, disease prevention, abuse fatality review, fiscal audits, etc. as long as the released information excludes any items that would identify program participants or applicants. Before releasing information for research, etc., local programs must contact the State WIC office to discuss the nature of data to be disclosed and the validity of the request for disclosure. Medical emergencies 7.3. In the event of a medical emergency, local WIC programs may disclose medical/clinical information to medical personnel without participant consent, but only to the extent necessary to meet the medical emergency. [(ORS 179.505(4)(a)] The person responding should consider the following guidelines: 7.3.1. A medical emergency exists if a patient is severely injured, unconscious, delirious or otherwise unable to convey consent (e.g. a diabetic client in insulin shock).

Confidentiality, Continued 450.7 7.3.2. The information disclosed should be only that necessary to assess and/or treat the emergency. 7.3.3. Ensure that the party requesting information (e.g. hospital emergency room) is a legitimate caller by verifying name and phone number. Danger to society 7.4. Local program staff may lawfully report participant’s confidential information to law enforcement officials when necessary to protect health or safety in an emergency, for example, if there is reason to believe an individual may be dangerous to her or himself or to others. [ORS 179.505(12) In all other circumstances, information should not be released to law enforcement officials without presentation of a subpoena. Participant access to own records 8.0 Local WIC programs shall allow participants access to their own record. CFR246.26(5) states that a participant/patient may request that a copy of her/his health record be released to her/him, and in the case of incompetence, the legal guardian has the right to immediate inspection of the record. Subpoenas and court orders 9.0 For procedures on responding to subpoenas, refer to your own agency’s internal policies and procedures. For additional guidance, see Appendix B: Procedures to Follow in Responding to a Subpoena. Protection of complainants 10.0 The identity of every complainant shall be kept confidential, except to the extent necessary to carry out the purposes of any investigation, hearing or judicial proceeding. Refer to 588—Program Integrity: Complaints for the complaint process. Protection of participants 11.0 Local WIC programs must be sensitive to the confidential needs and personal safety of all participants. 11.1. Local programs shall protect the confidentiality of participants’ information and their whereabouts. Example: Ivy Leege checks into the WIC clinic and is being counseled in another area of the clinic. Later, a person comes to the check-in station and states, “Is Ivy Leege here? She’s supposed to have a WIC appointment today. I have to give her a ride.” An appropriate response would be: 1. Do not confirm if Ivy Leege is a WIC participant or if she is there. 2. Offer the person a seat, while you or another staff informs Ivy that this request has been made. 3. If Ivy says “no,” continue to protect her confidentiality and presence. 4. If the requester becomes abusive, follow clinic procedure on handling abusive participants. Domestic violence

Confidentiality, Continued 450.8 11.2. When screening for domestic violence, do not ask the “Health History” question if the participant’s partner is present in order to protect their safety. Never include the domestic violence question on a hard copy of materials given to the participant to complete. 11.2.1. If domestic violence is identified, refer the participant to the appropriate services. Refer to 885—Other Referrals: Required and Recommended. Foster parents 11.3. Local WIC programs shall protect the identity and confidentiality of foster parents. 11.3.1. Local WIC programs shall take extra precautions to ensure security of the identity of foster parent(s) and their address(es). For example, do not ask foster parent(s) to repeat their name or address when speaking to the client in a non-private location (i.e. waiting room). 11.3.2. Local programs may consider using the “Sensitive Notes” function in TWIST to flag foster parents. Record control and security 12.0 Records should not be removed from the institution (e.g., left unattended in a car, taken home, etc.) except when necessary for a judicial or administrative proceeding. 12.1. Records should be secure and locked during non-office hours or when unattended by program staff. “Lock” computer screens 12.1.1. Staff should “lock” their computer screens when they have to leave their workstations while they have computerized participant records open. 12.1.2. Staff can also use privacy screen filters or other confidentiality computer tools to limit visibility of on-screen participant information in public areas like the clinic front desk area. 12.2. Determine and assign appropriate levels of access to computerized records. Assign security names and passwords to those employees who must have access to confidential records. Refer to 901—Data Systems Security. Staff passwords 12.2.1. Staff should choose a secure password. 12.2.2. Staff should not share logins and passwords. 12.2.3. Staff should routinely change passwords. 12.3. Store computer media (e.g. CDs, flash drives, external hard drives) 12.4. Do not leave participant information unattended on a printer or FAX machine, or in any area visible or accessible to clients. Satellite clinics and security

Confidentiality, Continued 450.9 12.5. Local programs using laptop computers at satellite clinic sites must use extra security measures to prevent access to or loss of confidential participant information. Refer to 902—State Provided Laptops and Air Cards for details. Email security

12.6. Do not send documents containing confidential, identifiable participant information by e-mail. Users of e-mail should carefully consider the nature of what is put into e-mail, as there is no guarantee of privacy or confidentiality for e-mail documents. If you need to refer to a participant in an email only use the WIC ID number as the means of identification. Examples of breach of confidentiality 13.0 The following are examples of potential breaches of security that should be avoided: • Leaving files open on a computer screen in view of visitors or other unauthorized persons. Refer to 901—Data Systems Security. • Leaving files or printed participant information such as “Daily Clinic Schedules,” “Participant Summary Reports” or clinic forms visible on desks or other locations. • Leaving files or laptop computers with participant information unattended in areas accessible to unauthorized individuals. • Throwing paperwork containing confidential information in a wastebasket or recycle bin without shredding or destruction by other appropriate methods. • Discussing confidential information in places where you could be overheard by any unauthorized individual, such as repeating names and addresses of participants and/or foster parent(s), or discussing participants in a hallway, elevator, restaurant, etc. Additional recommendations 14.0 WIC staff should take every precaution to secure participant information. In addition to requirements indicated in this policy, below are more examples of ways WIC staff can safeguard confidential information. • Sign off from your workstation if you are leaving it for an extended time. See ¶12.1 above. • Place FAX machine in a secure location. • Include a confidentiality statement on your FAX cover letter when transmitting confidential information. • Keep documents or other papers with participant information that you are using in a folder or face down on your desk. • Keep participant files separate from other files. Reporting breaches of confidentiality 15.0 Report breaches of confidentiality to the appropriate authorities such as the WIC Coordinator, nursing supervisor, local administrator, Public Health Officer, or the state WIC program.

Confidentiality, Continued 450.10 Agency legal review 16.0 Local WIC Programs should consult their agency’s counsel or legal advisor when developing confidentiality policies and procedures and when dealing with complicated confidentiality issues. References: 1. HIPPA Privacy Rule and Public Health: CDC Guidance http://www.cdc.gov/mmwr/preview/mmwrhtml/m2e411a1.htm POLICY HISTORY Date * Revised, Reviewed, Released July 21, 2008 Released April 23, 2012 Released April 5, 2019 Revised May 9, 2019 Revised (removed bad links)

The date located at the top of the policy is the date of the most recent release. Policies are to be implemented on release date and will become compliance findings 6 months from the release date. *Released: Significant changes made to policy. Release notes can be found in the corresponding document on the Policy and Procedure Manual page. Reviewed: The writer looked at this policy to make sure it was still accurate. Formatting changes may have occurred. Revised: Minor edits or formatting has occurred without need for release. USDA has accepted a policy and watermark is reviewed. Date of Origin: Date policy was initially released

If you need this in large print or an alternate format, please call 971-673-0040. This institution is an equal opportunity provider.

Confidentiality, Continued 450.11 APPENDIX A WRO Policy Memo 800-C

PROCEDURES TO FOLLOW IN RESPONDING TO A SUBPOENA

o State or local agencies, in consultation with their legal counsel, must determine based on the content of the subpoena and the requested information whether or not to comply with the subpoena and release the information as requested or to attempt to quash the subpoena. In making the determination, State or local agencies must determine whether the information is protected under 7 CFR §246.26(d) of the WIC Program regulations. o Decisions to release WIC information as requested by a subpoena or to attempt to quash a subpoena must be based on the requirements and restrictions set forth in 7 CFR §246.26(d) of the WIC regulations, any pertinent State laws, FNS Instruction 800-1, and Policy Memorandum 94-3. Any conflicts identified between Federal and State requirements should be raised with State legal counsel and referred to the Department’s Office of the General Counsel, where appropriate. o When the State or local agency, in consultation with legal counsel, decides to attempt to quash a subpoena, legal counsel must appear before the court to argue against the release of information as requested by the subpoena. The court must be informed that this decision is based on prohibitions against such disclosures as set forth in Federal law at 7 CFR §246.26(d). o If the court denies the motion to quash the subpoena and requires the WIC State or local agency to release the requested information, the State or local agency or legal counsel acting on its behalf shall attempt to:  consider the appropriateness of an appeal of the decision.  ensure information produced is only that which is essential to respond to the subpoena (i.e., provide edited documents reflecting only the requested WIC information), and  attempt to negotiate the extent to which the WIC information actually produced becomes public information (i.e., reviewed in camera by the court, limited entry into the public record). o If the motion to quash the subpoena is denied by the court, we recommend that legal counsel acting on behalf of the State or local agency request the parties reduce to writing the terms of the release of the subpoenaed information so that all parties are in accord as to the use of such information. Ideally, counsel should seek a warrant of attachment or similar court order. A warrant of attachment is a written order by the court based on State law which orders a law enforcement officer to seize specific documents and deliver them to the court, essentially forcing the State or local agency to comply. In this way, there is a record that WIC State or local officials disregarded Federal law protecting the confidentiality of WIC records only after having been compelled to do so by a court. o State or local agencies should advise and consult legal counsel if any formal complaint from or notice of litigation by a program applicant or participant is received as a result of the State or local agency releasing WIC information in response to a subpoena or search warrant. o In some instances, a State or local agency may be required to release confidential information in response to a subpoena or search warrant. However, if the release of such information is made pursuant to and in keeping with WIC Program regulations, instructions, and policy, that release will not result in FNS or its agents taking adverse action against the State or local agency or any individuals acting on their behalf.