3304-2-63 Confidentiality of information.

RSC shall collect consumer information, maintain it until appropriate destruction, and keep it confidential. RSC shall also eliminate consumer information when it is no longer necessary and relevant to the lawful functions of RSC, and when its elimination is permitted in accordance with other state and federal regulations that govern RSC.

Throughout this rule, the consumer's legal guardian (court-appointed with authority to act in this area, or a parent for a minor) shall have the same rights as the consumer, and the legal guardian shall also sign any consent to release information.

(A) "Confidential information" means any information received about any person who has been referred to RSC, has applied for services, is currently receiving services, or has received services. Anyone who has access to information held by RSC shall keep such information confidential.

(B) Within fifteen days of the consumer's written request, RSC shall release any information contained in the consumer's case record except for that information listed in paragraphs (D) to (D)(2) of this rule, and shall inform the consumer of his or her right to disagree with information that has been collected and how the consumer may register the disagreement. The consumer shall receive one copy of information on a one-time, no-cost basis.

(C) Upon the consumer's written request to review his or her case record, RSC shall schedule a mutually convenient time for the consumer to review his or her case record.

(1) A counselor or supervisor shall be present during the consumer's review.

(2) On request, the consumer shall receive one copy of information on a one-time, no-cost basis.

(D) The consumer shall not have access to the following information:

(1) Medical, psychological, or other information that an RSC medical or psychological consultant determines may be harmful to the consumer. Such information shall be released only to a third party designated by the consumer, in writing, which may include, among others, an advocate, a family member, or a qualified medical or mental health professional, unless a representative has been appointed by a court to represent the individual, in which case the information shall be released to the court-appointed representative. RSC shall not assume the cost for the interpretation of any information to the consumer. If any information is removed from the case record under this section for the consumer's review, the consumer shall be informed of the procedure for obtaining the release of information to a third party.

(2) The consumer shall not have access to unpurchased information that is marked confidential or which otherwise indicates that it shall not be shown to the consumer. If the consumer requests such information, the consumer shall be referred to the source.

(E) If the consumer objects to any information in the case record, RSC shall review the disputed information for accuracy, relevance, timeliness, and completeness, and shall inform the consumer of the results of the review and the action taken, if any, within ninety calendar days of the consumer's objection.

(1) Information about eligibility or justification for services provided or not provided shall not be destroyed even if it cannot be verified or is inaccurate; it shall be placed in an envelope labeled "For Audit/Internal Program Use Only" and returned to the case record. The information in the envelope shall not be released to anyone.

(2) If information cannot be verified or is inaccurate but is not about eligibility or services, it shall be destroyed (or, when possible, parts of it lined out). A list of deleted documents shall be marked "For Audit/Internal Program Use Only," filed in the case record, and shall not be released to anyone.

(3) If the consumer is not satisfied with the review and the action taken, RSC shall then take either of the following actions, as appropriate:

(a) If the consumer wants to prepare a written rebuttal about information not destroyed, the rebuttal shall be entered into the record, and shall be included when RSC releases a copy of the information the rebuttal is about. If RSC believes the consumer's rebuttal is frivolous or irrelevant, RSC may also include a statement saying that and explain why. RSC shall inform the consumer that at his or her written request, a copy of the rebuttal shall be provided to any person the consumer designates.

(b) RSC shall inform the consumer that at his or her written request, any person the consumer designates shall be informed that the disputed information has been removed.

(F) By signing the general consent on the RSC application for services, the consumer (or the consumer's legal guardian) shall permit RSC to provide only that information needed to obtain services from service providers, vendors, other agencies, and facilities; to obtain placement from employers; to report to the referral source; and to provide information requested by parole officers. If more information than that which identifies the consumer is released to a service provider or a cooperating agency, RSC shall inform the provider of the following:

(1) Whether any of the information released has been determined by an RSC medical or psychological consultant to be potentially harmful to the consumer, and therefore shall be released only to a third party designated by the consumer pursuant to the provision in paragraph (D) of this rule;

(2) That the information shall not be released to others without the consumer's consent; and

(3) That the information shall be used only for the purpose provided.

(G) The consumer's specific written consent shall be needed for the following purposes. If the consumer has a legal guardian (court-appointed with authority to act in this area, or a parent for a minor), the guardian must also sign the consent.

(1) The consumer may sign a written consent to permit any other person to have access to the information in the consumer's record that the consumer may have access to. Any person so designated by the consumer shall receive one copy at no cost.

(2) If the consumer provides a written consent, RSC may release information to the media, but shall release only information that may be released to the consumer. (If media personnel contact RSC about a consumer, RSC shall not discuss any consumer and/or case records, or acknowledge that any person is or is not a consumer, or give identifying data that may reveal a consumer's identity.)

(3) If RSC receives a request for consumer information that is for a purpose not covered elsewhere in this rule, the following shall apply:

(a) The requester shall provide the consumer's written consent;

(b) Only the information that meets the criteria for release to the consumer shall be released;

(c) Information shall be released only to the extent that is needed to meet the requester's needs; and

(d) Released information shall include a statement that the information is provided only for the purpose stated and shall not be released to anyone else unless the consumer's consent is obtained.

(4) If RSC receives a subpoena for consumer records, the records shall be provided only with the consumer's written consent. The attorney who subpoenaed the records shall be responsible for obtaining the consumer's written consent.

(H) Consent from the consumer shall not be needed for RSC to release consumer information for investigations in connection with law enforcement, fraud, or abuse (except where expressly prohibited by federal or state laws or regulations); to protect the consumer or others when the consumer poses a threat to his or her safety or to the safety of others; in response to a court order; to report a felony as required by law; or when required by federal law.

In addition, the consumer's consent shall not be needed for the release of consumer information to an organization, agency, or individual engaged in audit, evaluation, or research for purposes directly connected with the administration of the vocational rehabilitation program, or for purposes which would significantly improve the quality of life for persons with disabilities, and both of the following conditions are met:

(1) If the organization, agency, or individual assures that:

(a) The information shall be used only for the purposes for which it is being provided;

(b) The information shall be released only to persons officially connected with the audit, evaluation, or research;

(c) The information shall not be released to the consumer;

(d) The information shall be managed in a manner to protect confidentiality;

(e) The final product shall not reveal any personal identifying information without the written consent of the consumer or his or her guardian or legal representative; and

(2) The RSC executive director or designee has approved the release.

(I) This rule is designed to implement "Title IV of the Workforce Investment Act," which contains the 1998 amendments to "The Rehabilitation Act of 1973," and resulting regulations.

R.C. 119.032 review dates: 04/19/2010 and 04/17/2015
Promulgated Under: 119.03
Statutory Authority: 3304.16(A)
Rule Amplifies: 3304.21, 3304.16(E), 1347.01, 1347.08 to 1347.10
Prior Effective Dates: 9/30/1985, 5/11/1987, 4/4/1988, 1/3/2000, 1/30/2001,
5/19/2005, 7/30/2007