Updated: 09/24
201 Acquisition, Use and Security of Personal Information
201.01 Type of Personal Information to be Obtained
The Division will collect only that personal information which is timely, necessary and relevant to the determination of eligibility and rehabilitation needs of the individual.
NOTE: Personal information is any information about an applicant or eligible individual including, but not limited to, name, address, social security number, and financial, educational, employment, family, or medical information, as well as photographs and lists of names.
201.02 Use of Personal Information
All information obtained shall be used only for purposes directly connected with the individual’s rehabilitation program and/or the administration of the rehabilitation program.
201.03 Procedures for Obtaining Personal Information
In keeping with the mandate to use to the greatest extent possible existing information in the determination of eligibility and rehabilitation needs, the counselor will ascertain from the applicant possible sources of relevant information. A completed
Request for Confidential Information (RS-2a) will be signed by the individual or the individual’s representative for each source from whom information is to be requested. The Request is available as an attachment to an AWARE™ letter, designated as "Cover Letter and Request for Info" in the drop-down menu, in both the Referral and Participant Modules. A copy of each
Request for Confidential Information (RS-2a) obtained off-site will be retained in the record of services.
201.04 Information Held Confidential
Personal information about an individual, whether obtained directly from the individual or from another source, shall be kept confidential and may not be disclosed except in accordance with Division’s policy and procedure contained in this section.
201.05 Notice to Applicants
Applicants will be advised in the appropriate modes of communication regarding the requirements of confidentiality. At the time of application for rehabilitation services, DORS staff shall, using the
DORS Intake Form (RS-1c), notify each applicant about:
The authority under which information is collected.
The principal purpose for which the information is intended to be used.
Whether provision of the information is mandatory or voluntary and the specific consequences of not providing the information.
The individual’s right to:
Inspect and obtain copies of records which contain personal information about the individual.
Amend or correct any records which contain inaccurate or incomplete information.
The Division policies regarding obtaining written consent from the individual before personal information is disclosed to another person and the circumstances under which written consent is not required.
201.06 Security of Records of Services
Office Procedures
Personal information about applicants and eligible individuals shall not be left on desktops, on computer screens, or in any other location where it can be seen by people other than rehabilitation services staff.
Computer lists and other electronic data and reports containing confidential information will be handled with the same security measures as required for records of services and confidential reports.
Under no circumstances shall computer program passwords be made available to unauthorized personnel or persons. Instructions for using the computer will not be left where others might access them.
Confidential information will be stored so that it is not accessible to anyone other than office staff.
Office doors will be locked whenever office personnel are not on the premises.
Removing Hard Copy Records of Services from Office – Hard copies of records of services will be removed from the local office only with supervisory approval. When transfer or administrative requirements necessitate that hard copy records of services be sent outside of the local office, they will be delivered by staff or courier or, if necessary, sent by certified mail.
201.07 Retention of Records of Services
Records of services shall be maintained for a minimum of three years following the end of the program year in which the record was closed. Staff shall verify pertinent documentation is appropriately attached in AWARE™ (see
Section 303.02) before records of services will then be destroyed, pursuant to Health-General Article, §4-305, Annotated Code of Maryland, and federal audit requirements.
In the event of a case being filed for cost reimbursement, records shall be maintained by the Social Security Unit, Program Income Branch, for six years from the claim response date by SSA, pursuant to SSA’s Vocational Rehabilitation Providers Handbook.
202 Access of an Applicant or Eligible Individual to Records of Services
202.01 Right of the Individual to Inspect and Obtain Copies of Records
Subject to
Section 202.02, when requested by an individual or the individual’s representative, the counselor shall permit the individual or the individual’s representative to inspect and obtain copies of any records in the custody of the Division which contain personal information about the individual.
A request to inspect and obtain copies of records shall be in writing, dated and signed by the individual or the individual’s representative, and identify the records which are the subject of the request.
The counselor shall comply with a request to inspect and obtain copies of records within a reasonable period, but not to exceed 30 days after receipt of the request. A written response from the counselor will contain notification of the time and place of the meeting to be held, within the 30-day period, to review the record of services.
If the requested records are unavailable or have been destroyed or lost, the counselor shall notify the individual or the individual’s representative within 10 working days after receipt of the request.
If the disclosure of requested records is restricted under
Section 202.02.a or b, such restrictions shall be explained to the individual or the individual’s representative. The counselor shall:
Inform the individual and/or the individual’s representative and document in the record of services that specific records contain information which requires professional explanation and interpretation, and, in the counselor’s judgment, review by and/or release directly to the individual would not be in the individual’s best interests;
Encourage the individual to authorize release of the information to a physician or licensed psychologist to facilitate appropriate interpretation of the information, and assist the individual in arranging a meeting between the health care professional and the individual.
If the individual has not agreed to release of the information to a health care professional, the counselor shall provide the information to the person chosen by the individual (see
Section 202.02.b).
202.02 Restrictions on Disclosure of Information
Information obtained from another source (not purchased or provided by the Division):
When the Division has obtained personal information from another person, agency or organization, the information shall be disclosed only by, or under the conditions established by, the other person, agency or organization.
When personal information from another person, agency or organization includes a statement prohibiting release of the information to the individual or relatives, such information shall not be disclosed to the individual or relative. The counselor shall inform the individual of the identity of the person or organization that provided the information and any procedure for contacting the person or organization directly to obtain the information.
When personal information from another person, agency or organization includes a statement prohibiting re-release of the information, but does not explicitly prohibit release to the individual, the DORS counselor may release the information to the individual, with a signed consent form, consistent with
Section 203.01.
When personal information from another person, agency or organization does not include a statement describing conditions for release and the counselor believes release of the information may be harmful to the individual, it will be released to the person chosen by the individual as indicated in
Section 202.02.b(2) with a signed consent form, consistent with
Section 203.01.
Information purchased by or provided by the Division:
Reports of assessments or treatment purchased or provided by DORS may be released, consistent with
Section 202.01,
Section 202.02b and
Section 203.01.
Medical, psychological or other personal information which the counselor believes may be harmful to an individual may not be released directly to the individual but shall be provided through a third party chosen by the individual, which may include, among others, an advocate, a family member, or a qualified medical or mental health professional, unless a court has appointed a representative to represent the individual, in which case the information must be released to the court-appointed representative.
The individual or the individual’s representative, if appropriate, must authorize the release of information by signing the
Consent for Disclosure of Information (RS-2b) on which the counselor has written a statement regarding the sensitive nature of the information (e.g., “Information being released is sensitive and may be harmful to the individual. It is recommended that interpretation be provided by a qualified health care provider”).
Confidentiality Notice – To each disclosure made requiring the individual’s written consent, the counselor shall attach a copy of the consent form (see
Section 203.02a) and the
Notice Regarding Further Disclosure of Information (RS-2c).
A copy will be attached to the information being disclosed, with a copy retained in the record of services.
Records of minors (i.e., individuals under 18 years of age) which relate to or reveal substance abuse diagnosis or treatment may not be released to the individual’s representative, including a parent or guardian, without the explicit written consent of the individual, in accordance with federal alcohol and drug abuse confidentiality regulations, 42 C.F.R. Section 2.
202.03 Right of the Individual to Amend or Correct Records
An applicant or eligible individual or the individual’s representative may request the Division to amend or correct any records in the custody of the Division which, in the judgment of the individual, contain inaccurate or incomplete information.
A request to amend or correct records shall be in writing, dated and signed by the individual or the individual’s representative, and shall:
Identify the records which are the subject of the request.
Describe the requested change precisely.
State the reasons for the change.
Within 30 days after receiving a request to amend or correct records, the counselor shall:
Make or refuse to make the requested change.
Give the individual or the individual’s representative written notice of the action taken.
If the requested change is refused, state the reasons for the refusal. The counselor may refuse to amend or correct records because, among other reasons, the records were not created by the Division.
If the counselor refuses to make the requested change and the individual or the individual’s representative disagrees with the action, the counselor shall advise the individual or the individual’s representative of the appeal process (see
Section 202.04). The counselor shall also advise the individual or the individual’s representative that he or she may file with the Division a concise statement that, in five pages or less, states the reasons for the requested change in the record of services and for disagreement with the counselor’s action. The statement of disagreement shall be attached to the disputed record and the counselor shall provide a copy of the statement whenever the disputed record is disclosed to another person.
202.04 Appeal of Denial to Inspect or Amend Records
An individual or the individual’s representative may request an appeal hearing (see RSM 1, Section 304) if the counselor takes any of the following actions with respect to any records in the custody of the Division which contain personal information about the individual:
Denies a request to inspect and obtain copies of the records.
Denies a request to amend or correct records.
Fails to attach a statement of disagreement to a disputed record.
Fails to provide a statement of the disagreement when a disputed record is disclosed to another person.
202.05 Request of the Individual for Release of Information to a Third Party
If the individual or the individual’s representative requests the release of records to a third party, the individual or the individual’s representative shall sign a
Consent for Disclosure of Information (RS-2b) in accordance with
Section 203.02. A request to release information pertaining to or revealing diagnosis and/or treatment of drug or alcohol abuse of a minor, i.e., individual under age 18, requires the written consent of the minor, consistent with federal regulations (see
Section 202.02.c).
The counselor shall disclose only the information or records specified in the written consent, subject to the restrictions in
Section 202.02. Fees for copying records may be charged in accordance with
Section 203.10.
203 Disclosure of Confidential Information
203.01 Disclosure of Information to a Third Party
Personal information about an applicant for or recipient of DORS services may be disclosed to a third party with the individual's informed written consent:
For the Provision of Rehabilitation Services – Prior to service delivery, DORS will disclose personal information to the chosen provider, using the
Consent to Disclose to Service Providers (RS-2f); or
Upon the consumer or legal representative’s written request, using the
Consent for Disclosure of Information (RS-2b). DORS will release confidential information to the consumer or identified third party, as requested (see
Section 202.05).
If the information is from a third party and is stamped “not to be Further Disclosed,” it may be disclosed if the conditions stated above are met.
203.02 Requirements for Disclosure of Information
Written Consent – The
Consent for Disclosure of Information (RS-2b) shall be completed for each source to which information is to be disclosed. It shall be dated and signed by the applicant or eligible individual or the individual’s representative, and shall:
Identify the person to whom the information is to be released.
State the purpose of the release.
Identify the information, records and/or specific reports to be disclosed.
Be valid for 45 days from the date consent is given unless otherwise specified in writing or revoked in writing by the individual or the individual’s representative.
Be included with the confidential information being released
A copy of the signed
Consent for Disclosure of Information (RS-2b) shall be provided to the consumer or legal representative, as well as attached in the AWARE™ electronic file.
Written Consent –
Consent to Disclose to Service Providers (RS-2f) shall be completed prior to referring a consumer to DORS-approved providers. The form shall be dated and signed by the applicant, or eligible individual, or the individual’s representative, and:
Shall specify an expiration date one year from signature, or upon case closure, whichever comes first.
Be included with all documents disclosed to Providers.
A copy of the signed
Consent to Disclose to Service Providers (RS-2f) record of services will be provided to the consumer or legal representative, and attached in the AWARE™ electronic file.
Confidentiality Notice – To each disclosure made requiring the individual’s written consent, the counselor shall attach a copy of the consent form (see
Section 203.02(a)) and the
Notice Regarding Further Disclosure of Information (RS-2c).
203.03 Circumstances under which Written Consent is Not Required to Disclose Personal Information
The Division may disclose personal information without obtaining written consent from the individual or the individual’s representative, under the following circumstances, when the disclosure is:
Subject to
Section 203.06 in connection with an administrative or judicial proceeding to review an action of the Division affecting the individual;
Subject to
Section 203.07, to comply with a judicial order or lawfully issued subpoena;
Subject to
Section 203.08, in connection with an audit, evaluation, or research;
To a third-party resource who initiated the referral for the service and who is responsible for payment;
In response to a law enforcement, fraud or abuse investigation, unless expressly prohibited by federal or State laws or regulations;
Necessary to protect an individual or other person when the individual poses a threat to his or her own safety or the safety of the other person;
Required by State of federal law or regulation;
To agencies, organizations, or individuals with whom DORS has formal cooperative agreements or from whom the individual is requesting or receiving services connected with the individual's rehabilitation program, or both; or
To an employee of Disability Determination Services and concerns an individual served by both DORS and its component, Disability Determination Services.
203.04 Documentation of Records Released without Consent
The counselor shall ensure a record of each disclosure made without the written consent of the individual is documented in the electronic case file (see
Section 203.03).
203.05 Release of Information to the Workers’ Compensation Commission
If the individual has been referred by or is known to the Workers’ Compensation Commission, the counselor will inform the individual that reports supporting program goals and progress will be forwarded to the Commission.
203.06 Disclosure of Records in Administrative or Judicial Proceeding
When personal information is disclosed in connection with an administrative or judicial proceeding to review an action of the Division affecting the individual, the Division shall:
Request that the information be placed under seal when such procedure is available; or
Take other appropriate action to protect the confidentiality of the information.
203.07 Disclosure of Records to Comply with Judicial Order or Subpoena
When a DORS staff person receives a judicial order or subpoena to disclose personal information, the staff person shall notify the Assistant Attorney General's Office via supervisory channels and provide a copy of the order or subpoena.
The Assistant Attorney General shall coordinate the Division's response to the order or subpoena.
203.08 Disclosure of Information in Connection with Audit, Evaluation, or Research
Audit or Evaluation – The Division may disclose personal information in connection with an audit or evaluation for purposes directly related to the administration of the Division’s programs if the person conducting the audit or evaluation assures in writing that the information will:
Be used only for the purposes for which it is provided and will be disclosed only to persons officially connected with the audit or evaluation.
Be managed in a manner to protect confidentiality and to prevent unauthorized disclosure.
Not be disclosed to the individual.
Not be disclosed in any report without the informed written consent of the individual.
Research – The Division may disclose personal information in connection with research which would significantly improve the quality of life for persons with disabilities. The person conducting the research:
Shall submit a written request to the Division which describes:
- The purpose of the research
- Whether the findings will be published
- The nature of the personal information requested
- The safeguards that will be taken to protect the confidentiality of the information.
May not contact any applicant or recipient of DORS services unless the Division approves and monitors the contact. In addition to giving assurances required under
Section 203.08.b.1, the Division shall require the person conducting the research to make a written agreement to protect the confidentiality of personal information in accordance with
State Government Article §10-624(c), Annotated Code of Maryland.
The counselor shall refer all requests for personal information related to audits, evaluations or research to the DORS Director via supervisory channels.
203.09 Responding to Inquiries from Private Attorneys
The following policies and procedures apply to requests for information from private attorneys:
Verbal inquiries:
DORS staff who receive a verbal inquiry from a private attorney regarding a consumer shall:
Obtain and document a summary of the information that the attorney is requesting or asking about;
Inform the attorney that someone from the Division will return his/her call shortly;
Not provide any information or opinion about the matter to the lawyer, including whether the individual is or has been a consumer of DORS services; and
Forward the written summary via email to the Program Director (Regional Director; OBVS Supervisor; WTC Assistant Director) with a copy to the immediate supervisor.
The Program Director shall consult with the appropriate Executive Staff member and DORS legal counsel on the method of the agency responding to the inquiry.
Written inquiries:
Routine written requests for records accompanied by a signed release form shall be processed by staff in accordance with
Section 203.01.
Written inquiries requesting information beyond a routine record request, e.g., the opinion of the counselor, shall be forwarded to the Program Director (see
Section 203.09(a)(1)(d)); the Program Director shall handle as indicated in (a)(2) above.
203.10 Fees
The Division may charge a reasonable fee ($.15 per page) for copying records if reproduction is made by photocopying machine within the Division, or the actual cost of reproduction if reproduction is made by a photocopying machine outside the Division or if the record is not susceptible to photocopying (for example, microfilm, x-rays, etc.). A charge may not be made if the total amount of the fee is $1.00 or less.
The Division may charge a reasonable fee for the time beyond the first 2 hours expended searching for requested records and preparing the records for inspection and copying. The fee may be prorated for fractions of an hour.
The Division may charge for the cost of postage to mail copies of records.
Before copying records, the Division shall:
Estimate the cost of reproduction, including research, preparation time and postage, and
Either obtain the agreement of the person requesting copies of the records to pay the cost or demand prepayment of any estimated fee before reproducing the records.
Upon request, the Division may waive or reduce any fee charged pursuant to this section if the Division determines that the waiver or reduction is in the public interest. The Division shall consider, among other relevant factors, the ability of the person requesting copies of the records to pay the fee.
If a fee is required, payment will be made to the “Maryland State Department of Education.”
203.11 Civil and Criminal Liability
Under State Government Article, §10-626, Annotated Code of Maryland, a person who willfully and knowingly discloses or uses personal information about an applicant for or recipient of DORS services in violation of the law may be liable to the individual for actual and punitive damages, attorney’s fees, and litigation costs.
Under State Government Article, §10-627, Annotated Code of Maryland, a person who willfully or knowingly discloses or uses personal information about an applicant for or recipient of DORS services in violation of the law, or by false pretenses, bribery, or theft gains access to or obtains a copy of a record containing personal information about an applicant for or recipient of DORS services whose disclosure is not authorized by law to a person, may be charged with a misdemeanor and upon conviction may be subject to a fine not exceeding $1,000.
204 Use of Recording Devices
Use of recording devices, including audio, audio/video, and photography, during individual and group meetings, or other activities related to provision of rehabilitation services requires the consent of all individuals present, consistent with Maryland law. Prior to beginning recording of a meeting, DORS staff shall assure that all present agree.
