Personal Data Use and Permitted Disclosures By and Among EOHHS and Its Agencies

101 CMR: Executive Office of Health and Human Services

101 CMR 16.00: Personal Data Use and Permitted Disclosures By and Among EOHHS and Its Agencies

16.01: Applicability

.00 applies to the Executive Office of Health and Human Services (EOHHS) and to all other agencies as the term is defined in .03 Agency.

16.02: Purpose

(1) .00 is promulgated pursuant to M.G.L. c. 6A, § 16 and in conformance with M.G.L. c. 66A, § 2(c) to authorize the sharing of data, including personal data by and among EOHHS and its agencies, subject to the appropriate protections for the confidentiality of client data.

(2) .00 governs the use and disclosure of personal data by EOHHS and among the agencies with in it. It prescribes circumstances in which personal data shall or may be used and disclosed by and among EOHHS and EOHHS agencies.

(3) Nothing herein is intended to limit or prohibit the Secretary or agencies from using and disclosing personal data where otherwise permitted or required by federal and state law.

16.03: Definitions

The following terms used in .00 have the meanings given in .03 unless the context clearly requires another meaning.

Agency — the Executive Office of Health and Human Services (EOHHS) or any department, agency, commission, office, board, division, or any other body within EOHHS as set out in M.G.L. c. 6A, § 16, including the Executive Office of Elder Affairs.

Client — an applicant for, or recipient of, agency benefits or services, including services provided by the Department of Social Services or the Department of Youth Services.

Personal Data — has the same meaning as used in M.G.L. c. 66A, and includes “individually identifiable health information” within the meaning of the Health Insurance Portability and Accountability Act, 42 U.S.C. 1320d et seq.

Program Providing Benefits or Services — a state-funded program that provides cash assistance, services, or other benefits including payment for or access to services, or a program that is federally funded or federally assisted, including, but not limited to, the Food Stamp Program, 7 U.S.C. § 2011 et seq., the Temporary Assistance to Needy Families Program, 42 U.S.C. § 601 et seq., Medical Assistance to the States, 42 U.S.C. § 1396 et seq., the State Children’s Health Insurance Plan, 42 U.S.C. § 1397aa et seq., the Child Welfare and Adoption Assistance Program, 42 U.S.C. § 671 et seq., programs funded under the Older Americans Act, 12 U.S.C. 3508g, and programs funded under the Rehabilitation Act.

Secretary — the Secretary of the Executive Office of Health and Human Services who is the executive head of all EOHHS agencies pursuant to M.G.L. c. 6A, § 16.

16.04: Use or Disclosure of Personal Data by EOHHS

(1) EOHHS shall hold data, including, but not limited to, the names, addresses, and dates of birth of agency clients, as well as any other personal data or identifying information the Secretary shall determine necessary to carry out the responsibilities assigned to the Secretary and EOHHS under M.G.L. c. 6A, § 16. EOHHS shall develop policies and guidelines regarding use, disclosure, and maintenance of such data by agency employees to safeguard the confidentiality of such information.

(2) As executive head of all agencies under M.G.L. c. 6A, § 16, the Secretary shall have access to personal data of agency clients held by such agencies. The Secretary may designate others who shall be authorized to access data in the same manner and to the same extent as the Secretary. The Secretary or his designee shall use or disclose such data only in a manner consistent with applicable federal laws, .00, and other state laws. A designee shall include, but is not limited to, an agency employee or contractor engaged in evaluative and other quality assurance activities involving agency programs and services.

16.05: Use or Disclosure of Personal Data Between and Among Agencies

Upon request of an agency or if otherwise required by law, agencies administering programs providing benefits or services shall use or disclose information regarding clients to other agencies when the use or disclosure is directly connected to the administration of an agency’s program and the use or disclosure is not inconsistent with federal or state law. Activities directly connected to the administration of such programs include, but are not limited to:

(1) eligibility determinations;

(2) determination of benefit amounts;

(3) provision of services, insofar as the use or disclosure of personal data will assist the individual(s) who is the subject of the personal data in accessing needed medical, social, education, or other services, or will improve the coordination or management of services provided to the individual(s);

(4) quality assurance activities; and

(5) other activities as the Secretary or his designee may determine consistent with this provision, including those required or permitted by federal and state law.

16.06: Use and Disclosure Only Within EOHHS Agencies

Nothing herein shall be read to authorize the disclosure of personal data to entities or individuals that do not meet the definition of “agency” set forth in .03, without the written consent of the client or his legally authorized representative, except as otherwise required or permitted by federal and state law.

16.07: Safeguarding Personal Data

(1) An agency that receives personal data as a result of a disclosure authorized by .00 shall use and hold the data in a manner consistent with federal and state laws, and shall not disclose it to another party unless legally authorized.

(2) Reasonable efforts shall be made to limit the access to and use and disclosure of personal data authorized by .00 to the minimum necessary to accomplish the purpose for which the access, use, or disclosure is required and permitted.

REGULATORY AUTHORITY

.00: M.G.L. c. 6A, § 16