Section 500.150  Confidentiality/Privacy

 

a)         As used in this Section:

 

1)         "Destruction" means physical destruction or removal of personal identifiers from information so that the information is no longer personally identifiable.

 

2)         "Records" means the type of records covered under the definition of education records in 34 CFR 99 (the regulations implementing the Family Educational Rights and Privacy Act of 1974).

 

3)         "Participating agency" means any local service provider, service coordinator and regional intake entity that collects, maintains, or uses personally identifiable information, or from which information is obtained, under this Part.

 

b)         Access rights:

 

1)         Each participating agency shall permit parents to inspect and review any records relating to their children that are collected, maintained, or used by the agency under this Part (including records relating to evaluations/assessments, eligibility determinations, development and implementation of IFSPs, individual complaints dealing with the eligible child, and any other area under this Part involving records about the child and the child's family).  The agency shall comply with a request without unnecessary delay and before any meeting regarding an IFSP or any hearing relating to the identification, evaluation, or placement of the child, or the provision of early intervention services to the child, and in no case more than 45 days after the request has been made (consistent with 34 CFR 99.10(b)).  If the information is protected health information under HIPAA, the agency shall comply with the request within 30 days if the information is accessible on site, and within 45 days if it is not accessible on site.

 

2)         The right to inspect and review records under this Section includes:

 

A)        The right to a response from the local service provider to reasonable requests for explanations and interpretations of the records;

 

B)        The right to request copies of the records containing the information if failure to provide those copies would effectively prevent the parent from exercising the right to inspect and review the records; and

 

C)        The right to have a representative of the parent inspect and review the records.

 

3)         A participating agency may presume that the parent has authority to inspect and review records relating to his or her child unless the agency has been advised that the parent does not have the authority under applicable State law governing such matters as guardianship, separation, and divorce.

 

4)         The agency shall also comply with the provisions regarding access of HIPAA protected health information as set forth in 45 CFR 164.524, particularly provisions regarding grounds for denial, reviewability of denial, notice of denial, required review by a licensed health care professional, and notice and existence of a complaint procedure.

 

c)         Record of access/Accounting of disclosure

            Each participating agency shall keep a record of parties obtaining access to records collected, maintained, or used under this Part (except access by parents and authorized employees of the participating agency), including the name of the party, the date access was given, and the purpose for which the party is authorized to use the records.  At the parent's request, each participating agency shall also provide an accounting of disclosures of a child's HIPAA protected health information that have been made in the past six years, as required in 45 CFR 164.528 (exceptions are provided in Section 164.528 for various disclosures).

 

d)         Records on more than one child

            If any record includes information on more than one child, the parents of those children shall have the right to inspect and review only the information relating to their child or to be informed of that specific information.

 

e)         List of types and locations of information

            Each participating agency shall provide parents on request a list of the types and locations of records collected, maintained, or used by the agency.

 

f)          Fees

 

1)         Each participating agency may charge a fee for copies of records that are made for parents under this Part if the fee does not effectively prevent the parents from exercising their right to inspect and review those records.

 

2)         A participating agency may not charge a fee to search for or to retrieve information under this Part.

 

g)         Amendment of records at parent's request

 

1)         A parent who believes that information in the records collected, maintained, or used under this Part is inaccurate or misleading or violates the privacy or other rights of the child may request the participating agency that maintains the information to amend the information.

 

2)         The agency shall decide whether to amend the information in accordance with the request within 60 days after its receipt of the request.  If the agency is unable to act on the request within 60 days, the agency may extend the time for its response by no more than 30 days, provided that the agency, within 60 days after its receipt of the request, provides the individual with a written statement of the reasons for the delay and the date by which the agency will complete its action on the request.

 

3)         If the agency decides to refuse to amend the information in accordance with the request, it shall inform the parent of the refusal, and advise the parent of his or her right to a hearing as set forth in subsection (h).

 

4)         The agency shall also comply with the provisions regarding amendments of HIPAA protected health information as set forth in 45 CFR 164.526, particularly the provision regarding denial and regarding notice and provision of a complaint procedure.

 

h)         Hearing regarding records

 

1)         A participating agency shall give the parent an opportunity for a hearing to challenge the content of the agency's records on the grounds that the information in the records is inaccurate, misleading or in violation of privacy rights of the child.

 

2)         The participating agency that generated the record at issue shall hold a hearing within a reasonable time after it has received a hearing request.

 

3)         The participating agency shall give the parent notice of the date, time and place reasonably in advance of the hearing.

 

4)         The hearing may be conducted by an individual, including an official of the participating agency, who does not have a direct interest in the outcome of the hearing.

 

5)         The participating agency shall give the parent a full and fair opportunity to present evidence relevant to the grounds of challenge to the records.

 

6)         The parent may at his/her own expense be assisted or represented by one or more individuals of choice, including an attorney.

 

7)         The participating agency shall make its decision within a reasonable time after the hearing.  The decision shall be based solely on the evidence presented at the hearing and shall include a summary of the evidence and reason for the decision.

 

8)         If the decision of the agency is that the information challenged is inaccurate, misleading or in violation of the child's privacy rights, the participating agency shall:

 

A)        amend the record accordingly; and

 

B)        inform the parent of the amendment in writing.

 

9)         If the decision is that the challenged information is not inaccurate, misleading or in  violation of privacy rights, the participating agency shall inform the parent of the right to place a statement in the record commenting on the contested information and stating why he or she disagrees with the decision.

 

10)         If a statement is placed in the record pursuant to subsection (h)(9), the participating agency shall:

 

A)        maintain the statement with the contested part of the record for as long as the record is maintained;

 

B)        disclose the statement whenever it discloses the contested part of the record; and

 

C)        at the parent's written request, disclose the statement to individuals to whom the contested part of the record was previously sent.

 

i)          Safeguards:

 

1)         Each participating agency shall protect the confidentiality of personally identifiable information at collection, storage, disclosure and destruction stages.

 

2)         Each agency shall require one official to assume responsibility for ensuring the confidentiality of the information.

 

3)         All persons collecting or using the information shall be trained regarding confidentiality requirements.

 

4)         Each participating agency shall maintain, for public inspection, a current listing of those employees having access to the information.

 

(Source:  Amended at 27 Ill. Reg. 13438, effective July 24, 2003)