All client information is confidential. The Department may not release or disclose client information, except as specifically authorized in administrative rule, law, or as ordered by a court. This means that in responding to questions about a client, staff must not even identify the person as being a client of the department.
Obtain a signed authorization from the client if there is any question regarding the release of information. View the request as one of honoring and respecting your client’s choice and dignity, not as an impediment to providing services.
When and how to obtain consent to release information. A client must sign and date a release of information form (DHS 2099) before a case worker can request information from a third party or release or redisclose information to third parties.
To obtain informed consent, the release form must be understood by the client. Barriers to understanding may include either physical or mental disabilities, or the inability to speak or read English. On the other hand, the presence of a physical or mental disability does not necessarily mean that the person is incapable of giving informed consent.
In most cases, a client indicates informed consent by signing the form with his or her name. For an individual who cannot sign his or her own name, the client can make a mark such as an "X" or request another person to sign on his or her behalf. If a person signs on behalf of the client, the signature should indicate who actually signed, so if client Mary asks Sue to sign on her behalf, it can be recorded as "Mary, by Sue". There is no need to obtain witness of a client signing unless there are other reasons for doing so (e.g. client request, mental competency issue, etc.)
The case worker who needs the information should obtain the signature of the client, or when appropriate, the client’s legal representative, including a guardian or in some circumstances, a conservator.
When approaching a client to obtain consent, it is important to remember that an individual’s ability to give informed consent will depend on a number of factors, including the benefits and risks of a particular decision. Allowing a case worker to talk with a family member about a client’s individual situation would require a different level of informed consent than consenting to a series of cancer treatments, for example. If a person has an established history of non-verbal communication, they may give permission for a case manager to talk with another party about non-intrusive information by giving their usual sign of consent. In such cases, the case manager must document their explanation to the client about what information they intend to give and for what purpose. They must also document the non-verbal method the client used to indicate consent.
Authorization for Use and Disclosure of Information. Staff may request that a client complete a written authorization using the DHS 2099, Authorization for Use and Disclosure . Complete the form with the client whenever possible, making sure that the client understands the form before signing. There should be only one record holder listed per form. The form must include an expiration date/event; and the signature of the individual on the form.
The Authorization for Use and Disclosure is valid for the time period established on the release. The instructions to the DHS 2099 note that the authorization is valid for one year. It is advisable however, to limit their duration to the shortest period of time during which the release or exchange of information may occur.
Provide the release form in the appropriate native language or in an alternate format (braille, large print, etc.) if necessary.
You may conduct business while maintaining client confidentiality. Relevant information may be shared without identifying the specific client. For example, "I am working with a women in her late 80's who was recently diagnosed with terminal cancer. She needs the following type of care. . .". However, if it becomes necessary to identify the client by name or to provide enough specifically identifying information so that the client will become known even if the client’s name is not revealed, obtain the client's permission to disclose the necessary and relevant information.
What if the client refuses to sign the release? An individual may refuse to sign a release of information form. The case worker should continue to talk through with the client what specific objections the client has to the release and why. If that does not resolve the difficulties, the case worker should attempt to serve the client as well as possible with the information available. Also, the case worker should make clear to the client what can or cannot be done without the case worker receiving certain information and assist the client in making an informed choice.
Failure to sign a release cannot be the basis for denying program services to otherwise eligible applicants. However, if the release of information is necessary to obtain documentation related to eligibility for the program, a denial would be based on the lack of required verification necessary to determine program eligibility.
Redisclosure. Any use or sharing of information obtained under a consent form, or by other means, to anyone else or for any other purpose is a redisclosure.
Information received by the Department which is otherwise confidential or privileged under Oregon law can not be released to a third party without the client providing further written consent.
For example, the Department often obtains copies of an individual’s medical records in connection with an eligibility determination or abuse investigation. These medical records obtained from a third party are exempt from redisclosure unless an additional release is obtained.
Make every reasonable effort not to use, request, or disclose more than the minimum amount of personal information required by law or necessary to accomplish the intended purpose of the use or disclosure.
Client records are subject to redaction prior to access or disclosure. Client records frequently include information pertaining to other individuals, and must be redacted. Redaction should be done by first copying the original record, then blacking out with a permanent marker the information to be withheld, and finally making a copy of the redacted record.
Verification. In every situation in which information is shared inside or outside of DHS, with or without an authorization, staff, volunteers, and contractors are required to take reasonable steps to verify the identity of the person receiving the information, unless the department workforce member fulfilling the request already knows the person or has already verified identity.
When asked for information regarding a client, there are questions that may be asked in each situation to help determine whether this particular piece of information may be released without a client’s consent.
A signed release is not necessary to provide client information in the following situations:
If someone is requesting information that does not fall into one of these categories, or if you want to share information that does not fall into one of these categories, authorization is required.
The "Exchanging Information" list (section 6 below), is a list of types of agencies you may contact regarding a client. Examples are provided of the circumstances when authorization may or may not be necessary. This list is intended to be instructive rather than definitive. Each situation should be individually analyzed.
A client has the right to authorize use and disclosure of A&D or MH treatment information to “DHS”, or to a specific program within DHS, such as Self-Sufficiency, or to a specific person (name or title).
A&D and MH treatment information may be disclosed only to the entity (such as DHS), program (such as SPD) or the person (name or title) and only for the specific purpose listed on the DHS 2099.
A client has the right to informed consent when filling out the DHS 2099. Informed consent means the worker has told the client he or she may disclose A&D and MH information to “DHS” as a whole or may limit disclosure to a specific program such as SPD.
In all circumstances, any use or disclosure should be limited to only that information which is reasonably necessary to fulfill the purpose of the request. Exception: For the purposes of mandatory reporting and abuse investigations, A&D treatment information may be disclosed if necessary even if the client has not signed a release authorizing disclosure.
A&D and Mental Health Privacy Law. The clarification above is found in federal A&D law (42 CFR part 2), OAR 410-014-0020 and ORS 179.505.
Some elements of A&D federal law and MH state law regarding use and disclosure of A&D and MH treatment information are stricter than HIPAA. Under HIPAA, the stricter law applies.
Federal law 42 CFR part 2 prohibits unauthorized use, disclosure and redisclosure of A&D treatment information. State law ORS 179.505 prohibits unauthorized use, disclosure and redisclosure of MH information. These laws:
Reminder: The purpose of the use and disclosure must be specific to the individual or organization to which the information will be disclosed. If the purpose changes, or is no longer applicable to the individual or organization named on the authorization form to receive the information, the client must complete a new authorization before the information may be disclosed.
Reminder: The client’s right to limit use and disclosure of A&D and MH information must be communicated to the client.
If A&D or MH treatment information is used and disclosed more broadly than the client has authorized on the DHS 2099, the person using the information or making the disclosure may be in violation of federal or state law.
DHS staff may submit questions regarding DHS Privacy Policies and completion of the DHS 2099 authorization form to PrivacyHelp, DHS . This email address can be found in the GroupWise address book or firstname.lastname@example.org. The Privacy Program phone number is 503-945-5780.
According to Oregon Revised Statutes 433.045(3), in no instance may a Department employee reveal to any person or agency that a client is HIV positive. (A person who is HIV positive has been exposed to the AIDS virus.) Information on a client's HIV status should usually not be included in the case record unless necessary to determine eligibility. Workers must judge whether a report containing information about HIV is needed to determine eligibility. If not, the information must be destroyed. If HIV information is needed for eligibility determination, the report should be retained, but marked with a notation that the information cannot be released to any person or agency. Do not enter HIV status information into any shared communication system such as Oregon ACCESS.
When policy permits use or disclosure of an individual’s information to another entity, or when a request is made for an individual’s information from another entity, staff must make reasonable efforts to limit the amount of information to the minimum necessary needed to accomplish the intended purpose of the use, disclosure, or request. For more information on minimum necessary, see DHS Policy AS-100-04 for more information.
DHS and Other State or Federal Agencies
Social Security Administration
Home Health Agencies
Mental Health Providers
Medical Supply Providers
Managed Care Plans
Physicians, Dentists, Optometrists/Ophthalmologists
Social Security Administration
Railroad Benefit Board
Pension and Retirement Plans
Financial Institutions, i.e. banks, credit unions, etc.
Legal Aid or other Legal Services
Licensed Care Providers and Other Service Providers
Neighbors/Friends; Other Interested Persons
Client access to their own information
Other Community Contacts
Public Official/State or Federal Legislator
A signed release is not necessary to report suspected child or elder abuse.
The identity of the person making the report must be treated as confidential information and shall be disclosed only with the written and informed consent of that person or by court order.
The entire report of an investigation of non-facility elder abuse must be treated as confidential. The report may be disclosed only with the written consent of the victim or by court order. In contrast, a third party request for a facility abuse investigation report that is neither accompanied by appropriate consent from the abuse victim nor in the form of a subpoena should generally be treated as a public records request. The general policy of the law favors public access to government records. However, the identity of complainants and victims should be removed from any reports released.
When reporting back to the complainant in a case, a staff person shall explain only that the investigation has been completed and that appropriate action has been taken. This would be appropriate under most circumstances.
A copy of the completed Adult Foster Home abuse investigation report is sent to the complainant unless they have requested anonymity.
Mental health evaluations conducted during the course of an abuse investigation, even at the direction of DHS, may not be disclosed to DHS without of the consent of the client or a court order.
The Department's employees are expected to comply with Oregon Child Abuse Reporting Law (ORS 419B.010-419B.015), the Elderly Abuse Reporting Laws (ORS 124.060 and 124.065), Patient Abuse Reporting Laws (ORS 441.640), and the Abuse Reporting for Mentally Ill and Developmentally Disabled Persons (ORS 430.735-430.765). Speak with your supervisor to determine that appropriate office or agency to call.
After the suspected abuse has been reported to the appropriate agency, case references to suspected abuse should be documented in such a way as to protect the identity of the person reporting the suspected abuse and to prevent compromising any follow-up relating to the suspected abuse.
For more information, see the DHS web page on mandatory reporting.
If you receive a subpoena of any type, do not ignore it under any circumstances.
A subpoena is not a court order. A subpoena is a legal document issued by a court or an attorney that orders a person to appear for testimony. It is a writ or order directed to a person and may require the attendance of that person to testify as a witness or may require that person to produce books, papers, documents, etc. A subpoena duces tecum is a legal document that requires records to be produced.
There are many different kinds of subpoenas; some related to criminal cases, others to civil or administrative matters. Generally, simply reading the document will indicate what type of subpoena it is. While subpoenas may differ slightly, they can be treated in a similar fashion for this purpose. None of the subpoenas can compel release of confidential or privileged information; only a court order can compel such action.
Subpoenas that are accompanied by an appropriate consent should be complied with to the extent authorized by the consent form and permitted by the applicable confidentiality law.
If the subpoena is for a judicial proceeding, a staff member may appear before a judge and advise the court that the subpoena seeks production of confidential and privileged information. If the proceeding is not judicial in nature, the party should contact central office. If necessary, the Attorney General’s office will be contacted or the worker advised to call the AAA Legal Counsel. The rules of evidence and statutes concerning privilege may not be binding in a non-judicial proceeding such as administrative hearings, grand jury proceedings, or depositions. It is recommended that personnel respond to the subpoena by refusing to turn over the information on the basis of the confidentiality statutes.
More more information on the procedures for responding to a subpoena, contact SPD Central Office.
Policy for Subpoenas. Anytime a worker is served with a subpoena requesting confidential client information, the worker’s supervisor should be notified immediately. Central office may be contacted for technical assistance and to access help from the Department of Justice.
If the worker is served with a subpoena in a judicial proceeding, the worker will appear before the judge and inform the judge that it is the agency’s position that, absent consent of the client, the requested records and testimony about the requested records or the information they contain are privileged and confidential under both federal and state law.
The worker may read the following statement to the judge (choose all that apply):
"Your honor, state and federal law prohibits me from disclosing certain client records and testifying about information contained in those records unless certain conditions are met. Unless the client has provided authorization for release of their information, ORS 410.150 and 411.320 provide that these DHS records are confidential and privileged in any judicial proceeding not directly connected to the administration of public assistance programs, including [insert program name].
o Medicaid: "In addition, Federal law governing these programs (such as, 42 U.S.C. 1396a(a)(7) and regulations (42 CFR 431.300 to 431.307 applicable to Medicaid) require DHS to keep all information related to client benefits under [insert program] confidential."
o APS records: "In addition, DHS abuse investigation records are confidential under ORS 124.085, 124.090, 430.763, 441.650 and 441.671."
Note: If the APS records contain or you have personal knowledge that you will disclose on information listed below, then include the relevant paragraph in your reading of the statement.
o HIV: " Furthermore, if the records contain any HIV information, that information is confidential under ORS 433.045."
o Drug and Alcohol: "Furthermore, if the records contain information pertaining to drug and alcohol treatment information, that information is confidential under 42 CFR Part 2 and 42 CFR 2.64 requires the court to make certain findings before ordering the records to be disclosed."
o Records restricting re-disclosure: " In addition there are records for which I do not have authority to re-disclose to a third party."
o HIPAA: "In addition to these laws, recent federal privacy laws relating to client health information under the Health Insurance Portability and Accountability Act (HIPAA) (45 CFR part 164.512(e)), prohibit the release of a person's protected health information in a judicial proceeding on the basis of a subpoena without the person's authorization for disclosure unless certain procedures are met. These include notification by the person issuing the subpoena to the person whose records are being subpoenaed or entry of a qualified protective order governing the release of the information. Failure to comply with these requirements could result in federal criminal or civil liability. "
Note: if there are other specific federal or state confidentiality statutes that are applicable to the program, please provide that information to the court at this time.
In conclusion, it is the agency's position that compliance with the subpoena at this time would violate both federal and state law. With all due respect, I cannot disclose the requested records or provide testimony concerning the information contained in those records unless the person who is the subject of the records expressly authorizes the disclosure for this purpose, or you order me to do so."
The worker should then follow the direction of the judge.
Discovery subpoenas in court cases are issued by an attorney but do not require the worker to appear before a judge. In these cases, the worker has 14 days (or less if the date for production is earlier) to serve the party issuing the subpoena with written objections to the subpoena. The letter of objection may use the following format:
“Pursuant to ORCP 55B, this letter will serve as the [name of your agency] written objections to the subpoena that you issued in [name of case from subpoena]. [Name of agency] objects to production of these records on the grounds that they are confidential and exempt from disclosure under disclosure order 410.150 and ORS 124.090 and 192.502(8)."
Once the written objections are served, the attorney who issued the subpoena has the burden of going to court to obtain a court order compelling the worker to produce the file. The attorney must give the worker notice of his or her intent to go to court and at that time the worker will follow the instruction for addressing the judge.
The Department of Justice (DOJ) Address Confidentiality Program (ACP) is a program which provides a mail forwarding service for victims of domestic violence, sexual assault and stalking. The program has limited enrollment due to the stringent requirements.
When approved, each participant will receive an identification card with the ACP P.O.
Box which is ACP - P.O. Box 1108, Salem, OR 97308. That address will serve
participants across the State. Participants in the program are responsible to present
the identification card when requesting a State agency to use the ACP address. The
P.O. Box will be used as the clients’ mailing address.
Enter “DO NOT DISCLOSE” in the residential address on CMS, FSMIS and Oregon ACCESS. Resident addresses should be kept in the hard file in an envelope marked confidential. The access should be limited to the worker and manager.
An additional 5 days should be added to 10 day notices per 461-175-0050.
For managed care enrollment, an exception needs to be requested for out-of-area enrollment, due to the Salem address. Send an e-mail to HMU,DMAP with client name, case number, prime numbers for all individuals and the managed care plan the client chose, along with the reason why the exception is needed. DMAP has been made aware of the need for an exception for ACP participants.
Oregon Administrative Rules
Oregon Revised Statutes