CHAPTER 9
PUBLIC RECORDS AND FAIR
INFORMATION PRACTICES
Preamble
These rules describe the records of the Iowa department of human services and procedures for access to these records. All records of the department are open to the public except those that the department is authorized or required by law to keep confidential.
These rules also implement the federal Health Insurance Portability and Accountability Act (HIPAA) regulations at 45 CFR Parts 160 and 164 as amended to August 14, 2002. These rules set forth the standards the department of human services must meet to protect the privacy of protected health information. The department has chosen to be considered a hybrid entity for purposes of HIPAA because there are parts of the department that are not part of the covered entity for purposes of HIPAA compliance.
The rules on protected health information apply only to those parts of the department that are considered part of the covered entity: the named health plans and health care providers defined in these rules and the divisions or programs that perform functions on behalf of a named health plan. Targeted case management, refugee services, and the child support recovery unit are examples of parts of the department that are not included in the covered entity.
441—9.1(17A,22) Definitions. As used in this chapter:
“Business associate” means a person or organization, other than a member of the department’s workforce, who meets one of the following criteria:
	1.	Performs, or assists in the performance of, a function or activity on behalf of the department which involves the use or disclosure of protected health information, including claims processing or administration, data analysis, research, utilization review, quality assurance, billing, benefit management, practice management, and repricing, or any other function or activity regulated by the rules on protected health information.
	2.	Provides legal, auctuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for the department. The provision of the service shall involve the disclosure of protected health information from the department or from another business associate of the department to the person or organization.
“Client” means a person who has applied for or received services or assistance from the department.
“Confidential record” means a record which is not available as a matter of right for examination and copying by members of the public under applicable provisions of law. Confidential records include:
	1.	Records or information contained in records that the department is prohibited by law from making available for examination by members of the public, and
	2.	Records or information contained in records that is specified as confidential by Iowa Code section 22.7, or other provision of law, but that may be disclosed upon order of a court, the lawful custodian of the record, or by another person duly authorized to release the record.
Mere inclusion in a record of information declared confidential by an applicable provision of law does not necessarily make that entire record a confidential record.
“Covered entity” means:
	1.	A health plan.
	2.	A health care clearinghouse.
	3.	A health care provider that transmits any health information in electronic form in connection with a transaction covered by the HIPAA regulations.
“Covered functions” means the functions performed by a covered entity which make the covered entity a health plan, health care clearinghouse, or health care provider.
“Custodian” means the department or a person who has been given authority by the department to act for the department in implementing Iowa Code chapter 22. For local offices, the custodian is the service area manager. For a child support recovery office, the custodian is the regional administrator. For an institution, the custodian is the institution superintendent. For a central office unit, or for requests dealing with more than one service area, region, or institution, the custodian is the division administrator.
“Data aggregation” means the action by which a business associate combines protected health information of the department with protected health information of another covered entity to permit data analyses that relate to the health care operations of the respective covered entities.
“Department” means the Iowa department of human services.
“Designated record set” means a group of records maintained by or for the department that is:
	1.	The medical records about subjects that are maintained for facilities;
	2.	The enrollment, payment, and eligibility record systems maintained for Medicaid; or
	3.	The enrollment, payment, and eligibility record systems maintained for the HAWK-I program that are used, in whole or in part, by the HAWK-I program to make decisions about subjects.
For purposes of this definition, the term “record” means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for the department.
“Disclosure” means releasing, transferring, providing access to, or divulging in any other manner information outside the organization holding the information.
“Facility” or “facilities” means, with respect to HIPAA rules about health information, one or more of these department institutions: Cherokee Mental Health Institute, Clarinda Mental Health Institute, Glenwood Resource Center, Independence Mental Health Institute, Mount Pleasant Mental Health Institute, and Woodward Resource Center.
“Health care” means care, services, or supplies related to the health of a subject. “Health care” includes, but is not limited to, the following:
	1.	Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedures with respect to the physical or mental condition, or functional status, of a subject or affecting the structure or function of the body; and
	2.	Sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.
“Health care clearinghouse” means a public or private organization, including a billing service, repricing company, community health management information system or community health information system, and “value-added” networks and switches, that performs either of the following functions:
	1.	Processes or facilitates the processing of health information received from another organization in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction.
	2.	Receives a standard transaction from another organization and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving organization.
“Health care operations” has the same definition as that stated in 45 CFR 164.501 as amended to August 14, 2002. For a covered entity in the department, “health care operations” has the following meaning:
	1.	For Medicaid, “health care operations” means any of the following activities of the department to the extent that the activities are related to covered functions:
	●	Conducting quality assessments and evaluating outcomes.
	●	Developing clinical guidelines.
	●	Improving general health or reducing costs.
	●	Developing protocols, including case management and care coordination models for MediPASS and pharmacy case management as well as for other service areas and client populations under the Medicaid program.
	●	Informing clients of treatment alternatives and related functions.
	●	Reviewing competence or qualifications or performance of health care professionals using the surveillance and utilization review subsystem.
	●	Reviewing health plan performance from encounter data.
	●	Premium rating and rate setting.
	●	Performing activities in reinsurance of risk with the health maintenance organizations.
	●	Reviewing medical level of care and prior authorizations.
	●	Obtaining legal services through the attorney general’s office or the county attorney’s office.
	●	Cooperating in audits and fraud detection by Iowa and federal auditors, the Iowa Medicaid enterprise, or the department of inspections and appeals.
	●	Conducting business planning and development including formulary development by the drug utilization review commission and the department’s research and statistics staff.
	●	Managing activities, which include claiming of federal financial participation, recovering unknown third-party liability, recovering nursing care funds and other expenditures through estate recovery, Grouper programming for hospitals, lock-in activities, and federal reporting of paid claims.
	●	Providing customer service, which includes income maintenance workers answering questions about lock-in providers, copayment for pregnant women, and claims payment problems; and the Iowa Medicaid enterprise provider services unit answering questions on claims payment.
	●	Coordinating care and monitoring the effective delivery of child welfare services to ensure the safety and well-being of children, including reporting and providing testimony to the court of jurisdiction on the condition and service progress of a client receiving services from the department. These care coordination and monitoring activities include providing information concerning the client to attorneys representing the various parties in the court proceedings.
	2.	For the HAWK-I program, “health care operations” means any of the following activities of the department to the extent that the activities are related to covered functions:
	●	Conducting quality assessment and improvement activities, including evaluation of outcomes and development of clinical guidelines; population-based activities relating to improving health or reducing health care costs, protocol development and related functions that do not include treatment.
	●	Reviewing health plan performance.
	●	Premium rating and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits.
	●	Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs.
	●	Performing business planning and development functions, such as conducting cost-management and planning-related analyses relating to management and operations and the development or improvement of methods of payment or coverage policies.
	●	Performing business management and general administrative activities, including, but not limited to, management activities relating to implementation of and compliance with privacy requirements, customer service, and resolution of internal grievances.
	3.	For the facilities, “health care operations” means any of the following activities of the department to the extent that the activities are related to covered functions:
	●	Conducting quality assessment and improvement activities, including evaluation of outcomes and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from these activities; population-based activities relating to improving health or reducing health care costs; protocol development; case management and care coordination; contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment.
	●	Reviewing the competence or qualifications of health care professionals.
	●	Evaluating performance of practitioners, providers and health plans.
	●	Conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers.
	●	Training of non-health care professionals.
	●	Performing accreditation, certification, licensing, or credentialing activities.
	●	Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs.
	●	Performing business planning and development functions, such as conducting cost-management and planning-related analyses related to managing and operating the organization, including formulary development and administration, development or improvement of methods of payment or coverage policies.
	●	Performing business management and general administrative activities, including, but not limited to, management activities related to implementation of and compliance with the requirements of HIPAA; customer service, which includes the provision of data analyses for policyholders, plan sponsors, or other customers, provided that protected health information is not disclosed to the policyholder, plan sponsor, or customer; resolution of internal grievances; and activities consistent with the applicable requirements of subrule 9.10(29) on creating de-identified health information or a limited data set.
“Health care provider” means a provider of services, as defined in Section 1861(u) of the Social Security Act and 42 U.S.C. 1395x(u); a provider of medical or health services, as defined in Section 1861(s) of the Social Security Act and 42 U.S.C. 1395x(s); and any other person or organization that furnishes, bills, or is paid for health care in the normal course of business. In the department, “health care provider” means one of the department’s facilities.
“Health information” means any information, whether oral or recorded in any form or medium, that relates to the past, present, or future physical or mental health or condition of a subject; the provision of health care to a subject; or the past, present, or future payment for the provision of health care to a subject.
“Health maintenance organization (HMO)” means a public or private organization licensed as an HMO under the commerce department, insurance division, 191—Chapter 40.
“Health oversight agency” means an agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe, or a person or organization acting under a grant of authority from or contract with a public agency, that is authorized by law to:
	1.	Oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance; or
	2.	Enforce civil rights laws for which health information is relevant.
The term “health oversight agency” includes the employees or agents of the public agency and its contractors or persons or organizations to which the agency has granted authority.
“Health plan” means an individual or group plan that provides or pays the cost of medical care, as defined at 45 CFR 160.103 as amended to August 14, 2002. In the department, “health plan” means Medicaid or HAWK-I.
“HIPAA” means the Health Insurance Portability and Accountability Act of 1996.
“Law enforcement official” means an officer or employee of any agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe, who is empowered by law to:
	1.	Investigate or conduct an official inquiry into a potential violation of law; or
	2.	Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.
“Legal representative” is a person recognized by law as standing in the place or representing the interests of another for one or more purposes. For example, guardians, conservators, custodians, attorneys, parents of a minor, and executors, administrators, or next of kin of a deceased person are legal representatives for certain purposes.
“Mental health information” means oral, written, or otherwise recorded information which indicates the identity of a person receiving professional services (as defined in Iowa Code section 228.1(8)) and which relates to the diagnosis, course, or treatment of the person’s mental or emotional condition. Mental or emotional conditions include mental illness, mental retardation, degenerative neurological conditions and any other condition identified in professionally recognized diagnostic manuals for mental disorders.
“Open record” means a record other than a confidential record.
“Payment,” with respect to HIPAA rules about protected health information, has the same definition as that stated in 45 CFR 164.501 as amended to August 14, 2002. In the department, “payment” applies to subjects for whom health care coverage is provided under the Medicaid program or the HAWK-I program. “Payment” has the following meanings for these health plans:
	1.	For Medicaid, “payment” includes activities undertaken by this health plan to:
	●	Determine or fulfill its responsibility for coverage and provision of benefits under the health plan.
	●	Obtain or provide reimbursement for the provision of health care.
	●	Determine eligibility, including spenddown for the medically needy program or obtaining premiums for the Medicaid for employed people with disabilities program, or coverage, including coordination of benefits or the determination of cost-sharing amounts, and adjudication or subrogation of health benefit claims.
	●	Perform risk adjustment of amounts due based on enrollee health status and demographic characteristics.
	●	Bill; manage claims; collect; obtain payment under a contract for reinsurance, including stop-loss insurance and excess of loss insurance; and conduct related health care data processing.
	●	Review health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges.
	●	Perform utilization review activities, including precertification and preauthorization of services and concurrent and retrospective review of services.
	2.	For the HAWK-I program, “payment” includes activities undertaken by this health plan to:
	●	Obtain reimbursement or pay for providing health care services.
	●	Obtain premiums or determine or fulfill its responsibility for coverage and providing benefits. Activities include, but are not limited to, determinations of eligibility for coverage, including coordination of benefits or the determination of cost-sharing amounts; billing and collection activities; review of health care services with respect to coverage under a health plan; and utilization review activities.
“Personally identifiable information” means information about or pertaining to the subject of a record which identifies the subject and which is contained in a record system. The incidental mention of another person’s name in a subject’s record (e.g., as employer, landlord, or reference) does not constitute personally identifiable information.
“Personal representative” means someone designated by another as standing in the other’s place or representing the other’s interests for one or more purposes. The term “personal representative” includes, but is not limited to, a legal representative. For disclosure of protected health information, the definition of “personal representative” is more restrictive, as described at rule 441—9.15(17A,22).
“Plan sponsor” has the same definition as that stated in Section 3(16)(B) of ERISA, 29 U.S.C. 1002(16)(B).
“Protected health information” means information that contains a subject’s medical information, including past, present, or future treatment and payment information. “Protected health information” is a composite of multiple fields that grouped together give detailed accumulative information about a subject’s health. When joined together in an accessible record set, the following three distinct areas of health-care-processing file information constitute protected health information:
	1.	Information that identifies the subject.
	2.	Medical information describing condition, treatment, or health care.
	3.	Health care provider information.
Identification information together with any information from one of the other two categories constitutes protected health information. When the information that identifies the subject is present in the record set, any information that ties health care data to the subject’s identification information constitutes protected health information.
“Psychotherapy notes” means notes that are recorded in any medium by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the subject’s medical record. “Psychotherapy notes” excludes medication prescription and monitoring, counseling session start and stop times, the methods of therapy and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.
“Public health authority” means an agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe, or a person or organization acting under a grant of authority from or contract with a public agency that is responsible for public health matters as part of its official mandate. “Public health authority” includes the employees or agents of the public agency and its contractors or persons or organizations to which it has granted authority.
“Record” means the whole or a part of a “public record” as defined in Iowa Code section 22.1, that is owned by or in the physical possession of the department.
“Record system” means any group of records under the control of the department from which a record may be retrieved by a personal identifier such as the name of a subject, number, symbol, or other unique identifier assigned to a subject.
“Required by law” means a mandate contained in federal law, federal regulation, state law, state administrative rule, case law, or court order that is enforceable in a court of law. For the purposes of this chapter, “required by law” includes statutes or regulations that require the production of information, such as statutes or regulations that require the information if payment is sought under a government program that provides public benefits.
“Research” means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
“Subject” means the person who is the subject of the record, whether living or deceased.
“Substance abuse information” means information which indicates the identity, diagnosis, prognosis, or treatment of any person in an alcohol or drug abuse program.
“Transaction” means the electronic transmission of information between two parties to carry out financial or administrative activities related to health care. The term includes the following defined HIPAA standard transactions:
	●	Health care claims or equivalent encounter information.
	●	Health care payment and remittance advice.
	●	Coordination of benefits.
	●	Health care claim status.
	●	Enrollment and disenrollment in a health plan.
	●	Eligibility for a health plan.
	●	Health plan premium payments.
	●	Referral certification and authorization.
	●	Other transactions that the Secretary of Health and Human Services may prescribe by regulation.
“Treatment,” with respect to HIPAA rules about protected health information, means the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation among health care providers about a patient; and the referral of a patient from one health care provider to another.
“Use,” with respect to protected health information, means the sharing, application, utilization, examination, or analysis of the information within an organization that maintains the protected health information.
“Workforce” means employees, volunteers, trainees, and other people whose conduct, in the performance of work for the covered entity, is under the direct control of the covered entity, whether or not these people are paid by the covered entity.
441—9.2(17A,22) Statement of policy. The purpose of this chapter is to facilitate broad public access to open records. It also seeks to facilitate sound department determinations with respect to the handling of confidential records and the implementation of the fair information practices Act. This department is committed to the policies set forth in Iowa Code chapter 22. Department staff shall cooperate with members of the public in implementing the provisions of that chapter.
441—9.3(17A,22) Requests for access to records.
	9.3(1) Location of record. A request for access to a record should be directed to the director or the particular department office where the record is kept.
	a. 	If the location of the record is not known by the requester, the request shall be directed to the Office of Policy Analysis, Department of Human Services, 1305 East Walnut Street, Des Moines, Iowa 50319-0114.
	b. 	If a request for access to a record is misdirected, department personnel will promptly forward the request to the appropriate person within the department.
	9.3(2) Office hours. Open records shall be made available during all customary office hours, which are 8 a.m.	to 4:30 p.m.	daily, excluding Saturdays, Sundays and legal holidays.
	9.3(3) Request for access. Requests for access to open records may be made in writing, in person, or by telephone. Requests shall identify the particular records sought by name or description in order to facilitate the location of the record. Mail or telephone requests shall include the name, address, and telephone number of the person requesting the information. A person shall not be required to give a reason for requesting an open record.
	9.3(4) Response to requests. Access to an open record shall be provided promptly upon request unless the size or nature of the request makes prompt access infeasible. If the size or nature of the request for access to an open record requires time for compliance, the custodian shall comply with the request as soon as feasible. Access to an open record may be delayed for one of the purposes authorized by Iowa Code section 22.8(4) or 22.10(4). The custodian shall promptly give notice to the requester of the reason for any delay in access to an open record and an estimate of the length of that delay and, upon request, shall promptly provide that notice to the requester in writing.
The custodian of a record may deny access to the record by members of the public only on the grounds that such a denial is warranted under Iowa Code sections 22.8(4) and 22.10(4), or that it is a confidential record, or that its disclosure is prohibited by a court order. Access by members of the public to a confidential record is limited by law and, therefore, may generally be provided only in accordance with the provisions of rule 441—9.4(17A,22) and other applicable provisions of law.
	9.3(5) Security of record. No person may, without permission from the custodian, search or remove any record from department files. Examination and copying of department records shall be supervised by the custodian or a designee of the custodian. Records shall be protected from damage and disorganization.
	9.3(6) Copying. A reasonable number of copies of an open record may be made in the department office. If photocopy equipment is not available in the department office where an open record is kept, the custodian shall permit its examination in that office and shall arrange to have copies promptly made elsewhere.
	9.3(7) Fees.
	a. 	When charged. The department may charge fees in connection with the examination or copying of records only if the fees are authorized by law. To the extent permitted by applicable provisions of law, the payment of fees may be waived when the imposition of fees is inequitable or when a waiver is in the public interest.
	b. 	Copying and postage costs. Price schedules for published materials and for photocopies of records supplied by the department shall be prominently posted in department offices. Copies of records may be made by or for members of the public on department photocopy machines or from electronic storage systems at cost as determined and posted in department offices by the custodian. When the mailing of copies of records is requested, the actual costs of such mailing may also be charged to the requester.
	c. 	Supervisory fee. An hourly fee may be charged for actual department expenses in supervising the examination and copying of requested records when the supervision time required is in excess of one-half hour. The custodian shall prominently post in department offices the hourly fees to be charged for supervision of records during examination and copying. That hourly fee shall not be in excess of the hourly wage of a department clerical employee who ordinarily would be appropriate and suitable to perform this supervisory function.
	d. 	Advance deposits.
	(1)	When the estimated total fee chargeable under this subrule exceeds $25, the custodian may require a requester to make an advance payment to cover all or a part of the estimated fee.
	(2)	When a requester has previously failed to pay a fee chargeable under this subrule, the custodian may require advance payment of the full amount of any estimated fee before the custodian processes a new request from that requester.
	e. 	Summary of health information. The department my charge a fee for the cost of preparing an explanation or summary of health information as provided in paragraph 9.9(1)“c.” The department and the subject requesting the information shall agree to the amount of any fee imposed before the department prepares the explanation or summary.
441—9.4(17A,22) Access to confidential records. Under Iowa Code section 22.7 or other applicable provisions of law, the lawful custodian may disclose certain confidential records to one or more members of the public. Other provisions of law authorize or require the custodian to release specified confidential records under certain circumstances or to particular persons. In requesting the custodian to permit the examination and copying of such a confidential record, the following procedures apply and are in addition to those specified for requests for access to records in rule 441—9.3(17A,22).
	9.4(1) Proof of identity. A person requesting access to a confidential record may be required to provide proof of identity or authority to secure access to the record.
	9.4(2) Requests. The custodian may require a request to examine and copy a confidential record to be in writing. A person requesting access to such a record may be required to sign a certified statement or affidavit enumerating the specific reasons justifying access to the confidential record and to provide any proof necessary to establish relevant facts.
	9.4(3) Notice to subject of record and opportunity to obtain injunction.
	a. 	Except as provided in 441—subrule 175.41(2), after receiving a request for access to a confidential record and before releasing the record, the custodian may make reasonable efforts to promptly notify any person:
	(1)	Who is a subject of that record,
	(2)	Who is identified in that record, and
	(3)	Whose address or telephone number is contained in the record.
	b. 	To the extent such a delay is practicable and in the public interest, the custodian may give the notified subject a reasonable time to seek an injunction under Iowa Code section 22.8. The custodian shall inform the subject identified in the record of how much time the subject has to seek an injunction before the information will be released.
	9.4(4) Request denied. When the custodian denies a request for access to a confidential record, the custodian shall promptly notify the requester. If the requester indicates to the custodian that a written notification of the denial is desired, the custodian shall promptly provide such a notification that is signed by the custodian and that includes:
	a. 	The name and title or position of the custodian responsible for the denial; and
	b. 	A citation to the provision of law vesting authority in the custodian to deny disclosure of the record and a brief statement of the reasons for the denial to this requester.
	9.4(5) Request granted. Except as provided in 441—subrule 175.41(2), when the custodian grants a request for access to a confidential record, the custodian shall notify the requester or the person who is to receive the information and include any limits on the examination and copying of the record.
	9.4(6) Records requiring special procedures. Special procedures are required for access to:
	a. 	Child abuse information. Access to child abuse information is obtained according to rules 441—175.41(235A) and 441—175.42(235A).
	b. 	Dependent adult abuse information. Access to adult abuse information is governed by rule 441—176.9(235A).
441—9.5(17A,22) Requests for treatment of a record as a confidential record and its withholding from examinations. The custodian may treat a record as a confidential record and withhold it from examination only to the extent that the custodian is authorized by Iowa Code section 22.7, another applicable provision of law, or a court order, to refuse to disclose that record to members of the public.
	9.5(1) Persons who may request. Any person who would be aggrieved or adversely affected by disclosure of a record and who asserts that Iowa Code section 22.7, another applicable provision of law, or a court order, authorizes the custodian to treat the record as a confidential record, may request the custodian to treat that record as a confidential record and to withhold it from public inspection.
	9.5(2) Request. A request that a record be treated as a confidential record and be withheld from public inspection shall be in writing and shall be filed with the custodian.
	a. 	The request must set forth the legal and factual basis justifying such confidential record treatment for that record, and the name, address, and telephone number of the person authorized to respond to any inquiry or action of the custodian concerning the request.
	b. 	A person requesting treatment of a record as a confidential record may also be required to sign a certified statement or affidavit stating the specific reasons justifying the treatment of that record as a confidential record and to provide any proof necessary to establish relevant facts.
	c. 	Requests to temporarily treat a record as a confidential record shall specify the precise period of time for which that treatment is requested.
	d. 	A person filing such a request shall, if possible, provide a copy of the record in question from which those portions for which such confidential record treatment has been requested have been deleted. If the original record is being submitted to the department by the person requesting confidential treatment at the time the request is filed, the person shall indicate conspicuously on the original record that all or portions of it are confidential.
	9.5(3) Failure to request. Failure of a person to request confidential record treatment for a record does not preclude the custodian from treating it as a confidential record. However, if a person who has submitted business information to the department does not request that it be withheld from public inspection under Iowa Code sections 22.7(3) and 22.7(6), the custodian of records containing that information may proceed as if that person has no objection to its disclosure to members of the public.
	9.5(4) Timing of decision. A decision by the custodian with respect to the disclosure of a record to members of the public may be made when a request for its treatment as a confidential record that is not available for public inspection is filed, or when the custodian receives a request for access to the record by a member of the public.
	9.5(5) Request granted or deferred. If a request for such confidential record treatment is granted, or if action on such a request is deferred, a copy of the record from which the matter in question has been deleted and a copy of the decision to grant the request or to defer action upon the request will be made available for public inspection in lieu of the original record. If the custodian subsequently receives a request for access to the original record, the custodian will make reasonable and timely efforts to notify any person who has filed a request for its treatment as a confidential record that is not available for public inspection of the pendency of that subsequent request.
	9.5(6) Request denied and opportunity to seek injunction. If a request that a record be treated as a confidential record and be withheld from public inspection is denied, the custodian shall notify the requester in writing of that determination and the reasons therefor. On application by the requester, the custodian may engage in a good faith, reasonable delay in allowing examination of the record so that the requester may seek injunctive relief under the provisions of Iowa Code section 22.8, or other applicable provision of law. However, such a record shall not be withheld from public inspection for any period of time if the custodian determines that the requester had no reasonable grounds to justify the treatment of that record as a confidential record. The custodian shall notify requester in writing of the time period allowed to seek injunctive relief or the reasons for the determination that no reasonable grounds exist to justify the treatment of that record as a confidential record. The custodian may extend the period of good faith, reasonable delay in allowing examination of the record so that the requester may seek injunctive relief only if no request for examination of that record has been received, or if a court directs the custodian to treat it as a confidential record, or to the extent permitted by another applicable provision of law, or with the consent of the person requesting access.
	9.5(7) Rights to request privacy protection for protected health information. When the subject is requesting a restriction or confidential communication of protected health information, the department shall follow the provisions of this subrule, as applicable, in addition to the provisions of subrules 9.5(1) through 9.5(6).
	a. 	Restriction of uses and disclosures.
	(1)	The subject may request that the department restrict uses or disclosures of the subject’s protected health information:
	1.	To carry out treatment, payment, or health care operations; and
	2.	To persons involved in the subject’s care or for notification purposes as permitted under subrule 9.7(3).
	(2)	The subject shall submit a request to the department on Form 470-3953, Request to Restrict Use or Disclosure of Health Information. If applicable, the subject shall provide verification that it is reasonable to anticipate the use or disclosure will endanger the subject.
	(3)	The department is not required to agree to a restriction. The department shall deny any restriction when the restriction would adversely affect the quality of the subject’s care or services, the restriction would limit or prevent the department from making or obtaining payment for services, or federal or state law requires the use or disclosure. The department shall approve the request for restriction only when the use or disclosure would endanger the subject and none of the above reasons for denial apply.
	(4)	The department shall send the subject a written notice to accept or deny the restriction.
	(5)	If the department agrees to a restriction, it may not use or disclose protected health information in violation of the restriction. Exception: The department may use restricted protected health information or disclose the information to a health care provider when needed for the emergency treatment of the subject who requested the restriction. If restricted protected health information is disclosed to a health care provider for emergency treatment, the department shall request that the health care provider not further use or disclose the information.
	(6)	A restriction agreed to by the department under paragraph 9.5(7)“a” shall not prevent disclosures of protected health information to the Secretary of Health and Human Services to investigate or determine the department’s compliance with federal HIPAA regulations. Also, a restriction shall not prevent uses or disclosures permitted or required for the categories listed in subparagraphs 9.14(5)“a”(1) through (11).
	(7)	The department may terminate its agreement to a restriction in writing if:
	1.	The subject agrees to or requests the termination in writing;
	2.	The subject orally agrees to the termination and the oral agreement is documented; or
	3.	The department informs the subject that it is ending its agreement to a restriction for protected health information created or received after it has so informed the subject.
	b. 	Confidential communications. Subjects may ask to receive communications of protected health information by alternative means or at alternative locations. The department shall accommodate reasonable requests. For Medicaid and HAWK-I, the subject is required to clearly indicate the reason for requesting the confidential communication. Facilities shall not require the subject to explain the basis for the request as a condition of providing confidential communications.
	(1)	The subject shall request a confidential communication from the department using Form 470-3947, Request to Change How Health Information Is Provided.
	(2)	The department may require the subject to provide:
	1.	When appropriate, information as to how payment, if any, will be handled; and
	2.	An alternative address or other method of contact.
441—9.6(17A,22) Procedure by which additions, dissents, or objections may be entered into certain records.
	9.6(1) All programs. Except as otherwise provided by law, a subject may file a request with the custodian to review, and to have a written statement of additions, dissents, or objections entered into, a record containing personally identifiable information pertaining to that subject. However, the subject is not authorized to alter the original copy of the record or to expand the official record of any department proceeding.
	a. 	The subject shall send the request to review such a record or the written statement of additions, dissents, or objections to the custodian or to the office of policy analysis.
	b. 	The request to review such a record or the written statement of additions, dissents, or objections must be dated and signed by the subject, and shall include the current address and telephone number of the subject or the subject’s representative.
	9.6(2) Additional procedures for protected health information.
	a. 	Right to amend. A subject may request that the department amend protected health information or a record about the subject in a designated record set for as long as the protected health information is maintained in the designated record set. A subject shall submit a request to the department using Form 470-3950, Request to Amend Health Information. The subject shall provide a reason to support the requested amendment.
	b. 	Timely action.
	(1)	The department shall act on a subject’s request for an amendment no later than 60 days after receipt of the request.
	(2)	If the department is unable to act on the amendment within 60 days, the department may extend the due date one time, for a period not to exceed 30 days. In order to extend the due date, the department shall provide the subject with a written statement of the reasons for the delay and the date by which the department will complete its action on the request. The department shall provide this written statement within the 60-day period after receipt of the request.
	c. 	Action on amendment. If the department grants the requested amendment, in whole or in part, the department shall comply with the following requirements.
	(1)	The department shall timely inform the subject that the amendment is accepted. The subject shall identify relevant persons with whom the amendment needs to be shared and agree to have the department share the amendment with these persons.
	(2)	The department shall make the appropriate amendment to the protected health information or record by, at a minimum, identifying the records in the designated record set that are affected by the amendment and appending or otherwise providing a link to the location of the amendment.
	(3)	The department shall make reasonable efforts to inform and provide the amendment to:
	1.	Persons identified by the subject as having received protected health information about the subject and as needing the amendment; and
	2.	Persons, including business associates, that the department knows have the subject’s protected health information and that may have relied, or could foreseeably rely, on the information to the detriment of the subject.
	d. 	Denial of amendment. The department may deny a subject’s request for amendment, if the department determines that the protected health information or record that is the subject of the request:
	(1)	Was not created by the department, unless the subject provides a reasonable basis for the department to find that the originator of the protected health information is no longer available to act on the requested amendment;
	(2)	Is not part of the designated record set;
	(3)	Would not be available for inspection under rule 441—9.9(17A,22); or
	(4)	Is accurate and complete.
	e. 	Action on denial of amendment. If the department denies the requested amendment, in whole or in part, the department shall provide the subject with a timely, written denial.
	(1)	The subject may submit to the department a written statement of disagreement with the denial of all or part of a requested amendment and the basis of the disagreement, in accordance with 45 CFR 164.526 as amended to August 14, 2002. The subject shall submit the statement of disagreement by filing an appeal request under subrule 9.14(7). The appeal request constitutes the statement of disagreement.
	(2)	The department shall prepare a written rebuttal to the subject’s statement of disagreement, in accordance with 45 CFR 164.526 as amended to August 14, 2002. The appeal decision constitutes the rebuttal statement. The department shall provide a copy of the appeal decision to the subject who submitted the appeal request.
	f. 	Record keeping of disputed amendments. The department shall, as appropriate, identify the record or protected health information in the designated record set that is the subject of the disputed amendment. The department shall append or otherwise link the subject’s request for an amendment, the department’s denial of the request, and the subject’s appeal and the final decision, if any, to the designated record set.
	g. 	Future disclosures regarding disputed amendments.
	(1)	If an appeal has been submitted by the subject, the department shall include the material appended in accordance with paragraph 9.6(2)“f” or, at the election of the department, an accurate summary of the information, with any subsequent disclosure of the protected health information to which the disagreement relates.
	(2)	If the subject has not submitted an appeal, the department shall include the subject’s request for amendment and its denial, or an accurate summary of the information, with any subsequent disclosure of the protected health information only if the subject has requested this action.
	(3)	When a subsequent disclosure is made using a standard transaction that does not permit the additional material to be included with the disclosure, the department may separately transmit the material required by subparagraph 9.6(2)“g”(1) or (2), as applicable, to the recipient of the standard transaction.
	h. 	Actions on notices of amendment. When the department is informed by another covered entity of an amendment to a subject’s protected health information, the department shall amend the protected health information in designated record sets as provided by subparagraph 9.6(2)“c”(2).
441—9.7(17A,22,228) Consent to disclosure by the subject of a confidential record. To the extent permitted by any applicable provision of law, the subject of a confidential record may have a copy of the portion of that record concerning the subject disclosed to a third party. A request for such a disclosure must be in writing and must identify the particular record or records to be disclosed, the particular person or class of persons to whom the record may be disclosed, and the time period during which the record may be disclosed. The subject of the record and, where applicable, the person to whom the record is to be disclosed may be required to provide proof of identity.
No confidential information about clients of the department shall be released without the client’s consent, except as provided in rule 441—9.10(17A,22). Release of information includes:
	1.	Granting access to or allowing the copying of a record,
	2.	Providing information either in writing or orally, or
	3.	Acknowledging information to be true or false.
	9.7(1) Forms.
	a. 	General. Department staff shall use Form 470-2115, Authorization for the Department to Release Information, for releases by the subject that do not involve health information requiring use of the authorization form described in paragraph 9.7(1)“c.”
	b. 	Obtaining information from a third party. The department is required to obtain information to establish eligibility, determine the amount of assistance, and provide services. Requests to third parties for this information involve release of confidential identifying information about clients. Except as provided in rule 441—9.9(17A,22), the department may make these requests only when the client has authorized the release on one of the following forms.
	(1)	Form 470-0461, Authorization for Release of Information.
	(2)	Form 470-1630, Household Member Questionnaire.
	(3)	Form 470-1631, Bank or Credit Union Information.
	(4)	Form 470-4670, Addendum for Application and Review Forms for Release of Information.
	(5)	Form 470-1638, Request for School Verification.
	(6)	Form 470-2844, Employer’s Statement of Earnings.
	(7)	Form 470-1640, Verification of Educational Financial Aid.
	(8)	Form 470-3742, Financial Institution Verification.
	(9)	Form 470-3951, Authorization to Obtain or Release Health Care Information.
	c. 	Health information.
	(1)	When consent or authorization for use or disclosure of health information is required, facilities and department staff responding to third-party requests for health information shall use Form 470-3951, Authorization to Obtain or Release Health Care Information, or a form from another source that meets HIPAA requirements.
The department shall not require a subject to sign a HIPAA authorization form as a condition of treatment, payment, enrollment in a health plan, or eligibility for benefits. The department as a health care provider may require a subject to sign a HIPAA authorization form for the use or disclosure of protected health information for research, as a condition of the subject’s receiving research-related treatment.
A subject may revoke a HIPAA authorization provided under subparagraph 9.7(1)“c”(1) at any time, provided that the revocation is in writing using Form 470-3949, Request to End an Authorization, except to the extent that the department has taken action in reliance thereon.
	(2)	Except as provided in subparagraph 9.7(1)“c”(1), department staff shall release mental health or substance abuse information only with authorization on Form 470-0429, Consent to Obtain and Release Information, or a form from another source that meets requirements of law.
	d. 	Photographs and recordings. The department uses Form 470-0060, Authorization to Take and Use Photographs, and Form 470-0064, Authorization to Take and Use Photographs of Minor or Ward, for permission to use photographs in department publications. The department shall obtain authorization from the subject or person responsible for the subject (such as a guardian, custodian, or personal representative) before taking photographs or making any type of recording for any purpose other than those specifically allowed by law or for internal use within an institution.
	9.7(2) Exceptions to use of forms.
	a. 	Counsel. Appearance of counsel before the department on behalf of the subject of a confidential record is deemed to constitute consent for the department to disclose records about the subject to the subject’s attorney.
	b. 	Public official. A letter from the subject to a public official which seeks the official’s intervention on behalf of the subject in a matter that involves the department shall be treated as an authorization to release information. The department shall release sufficient information about the subject to the official to resolve the matter.
	c. 	Medical emergency. Department staff may authorize release of confidential information to medical personnel in a medical emergency if the subject is unable to give or withhold consent. As soon as possible after the release of information, the subject shall be advised of the release.
	d. 	Abuse information. Consent to release information is not required to gather information for investigations of child abuse or dependent adult abuse.
	9.7(3) Opportunity for subject to agree or object. This subrule describes when the department may use or disclose protected health information, without a written authorization, to persons involved in the subject’s care and for notification purposes. However, the department shall give the subject an opportunity to agree or object, unless this requirement is waived as specified in paragraph 9.7(3)“e.”
	a. 	Involvement in the subject’s care. The department may disclose protected health information that is directly relevant either to a subject’s care or to payment related to the subject’s care, provided payment is relevant to the person’s involvement in the subject’s care. The person involved must be:
	(1)	A family member;
	(2)	Another relative;
	(3)	A close personal friend of the subject; or
	(4)	Any other person identified by the subject.
	b. 	Notification purposes. The department may use or disclose protected health information to notify, or assist in notifying, identifying or locating a family member, a personal representative of the subject, or another person responsible for the care of the subject of the subject’s location, general condition or death. For disaster relief purposes, the use or disclosure shall be in accordance with paragraph 9.7(3)“f.”
	c. 	Uses and disclosures with the subject present. If the subject is present for, or available before, a use or disclosure permitted by this subrule and has the capacity to make health care decisions, the department may use or disclose the protected health information if the department:
	(1)	Obtains the subject’s agreement;
	(2)	Provides the subject with the opportunity to object to the disclosure, and the subject does not express an objection; or
	(3)	Reasonably infers from the circumstances, based on the exercise of professional judgment, that the subject does not object to the disclosure.
	d. 	Informing the subject. The department may orally inform the subject of and obtain the subject’s oral agreement or objection to a use or disclosure permitted by this subrule.
	e. 	Limited uses and disclosures when the subject is not present. When the subject is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the subject’s incapacity or an emergency circumstance, the department may, in the exercise of professional judgment, determine that disclosure is in the best interest of the subject.
	(1)	When the department determines that disclosure is in the subject’s best interest, the department may disclose only the protected health information that is directly relevant to the person’s involvement with the subject’s health care.
	(2)	The department may use professional judgment and its experience with common practice to make reasonable inferences of the subject’s best interest in allowing a person to act on behalf of the subject to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of protected health information.
	f. 	For disaster relief purposes. The department may use protected health information or disclose protected health information to a public or private organization authorized by law or by its charter to assist in disaster relief efforts for the purpose of coordinating with these organizations the uses or disclosures permitted by paragraph 9.7(3)“b.” The requirements in paragraphs 9.7(3)“c” and “d” apply to these uses and disclosures to the extent that the department, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.
[ARC 0420C, IAB 10/31/12, effective 1/1/13]
441—9.8(17A,22) Notice to suppliers of information. When the department requests a person to supply information about that person, the department shall notify the person of how the information will be used, which persons outside the department might routinely be provided this information, which parts of the requested information are required and which are optional, and the consequences of a failure to provide the information requested.
	9.8(1) This notice may be given in these rules, on the written form used to collect the information, on a separate fact sheet or letter, in brochures, in formal agreements, in contracts, in handbooks, in manuals, verbally, or by other appropriate means.
	9.8(2) The notice shall generally be given at the first contact with the department and need not be repeated. Where appropriate, the notice may be given to a person’s legal or personal representative. Notice may be withheld in an emergency or where it would compromise the purpose of a department investigation.
	9.8(3) In general, the department requests information to determine eligibility and benefit levels for assistance, to provide appropriate services or treatment, and to perform regulatory and administrative functions. Information is routinely shared outside the department when required by rules or law. Consequences of failure to provide information include ineligibility for public assistance, denial of licensure or regulatory approval, or inadequate service provision.
441—9.9(17A,22) Release to subject.
	9.9(1) Access by subjects to protected health information.
	a. 	Right of access. Except as otherwise provided in paragraphs 9.9(1)“f” and “g,” a subject has a right of access to inspect or to obtain a copy of the protected health information about the subject that is maintained in a designated record set. Subjects shall submit all requests for access to the department using Form 470-3952, Request for Access to Health Information.
If the department does not maintain the protected health information that is the topic of the subject’s request for access, and the department knows where the requested information is maintained, the department shall inform the subject where to direct the request for access.
	b. 	Timely action.
	(1)	The department shall act on a request for access no later than 30 days after receipt of the request unless the protected health information is not maintained or accessible to the department on site.
	(2)	If the requested information is not maintained or accessible to the department on site, the department shall take action no later than 60 days from the receipt of the request.
	(3)	If the department is unable to act within 30 days or 60 days as appropriate, the department may extend the time for the action by no more than 30 days. Within the applicable time limit, the department shall provide the subject with a written statement of the reasons for the delay and the date by which the department will complete its action on the request. The department shall have only one extension of time for action on a request for access.
	c. 	Action on providing access. If the department grants the request, in whole or in part, the department shall inform the subject that the request is accepted and shall provide the access requested. Access includes inspecting the protected health information about the subject in designated record sets, obtaining a copy of the information, or both. If the same protected health information that is the subject of a request for access is maintained in more than one designated record set or at more than one location, the department need only produce the protected health information once in response to a request for access.
	(1)	The department shall provide the subject with access to the protected health information in the form or format requested by the subject, if the requested format is readily producible. If the requested format is not readily producible, the department shall provide the information in a readable hard-copy form or other format as agreed to by the department and the subject.
	(2)	The department may provide the subject with a summary of the protected health information requested instead of providing access to the protected health information. The department may provide an explanation of the protected health information to which access has been provided. The subject must agree in advance to a summary or explanation and to any fees imposed by the department for the summary or explanation.
	d. 	Time and manner of access. The department shall provide the access as requested by the subject in a timely manner as described in paragraph 9.9(1)“b.” The department shall arrange with the subject for a time and place to inspect or obtain a copy of the protected health information that is convenient for both the subject and the department, or shall mail the copy of the protected health information at the subject’s request. The department may discuss the scope, format, and other aspects of the request for access with the subject as necessary to facilitate the timely provision of access.
	e. 	Fees for access. If the subject requests a copy of the protected health information or agrees to a summary or explanation of the information, the department may impose a reasonable, cost-based fee, as set forth in subrule 9.3(7).
	f. 	Mandatory reasons for denial of access. The department shall deny a subject access to protected health information when the requested information is:
	(1)	Psychotherapy notes;
	(2)	Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding; or
	(3)	Protected health information maintained by the department that is:
	1.	Subject to the Clinical Laboratory Improvements Amendments of 1988, 42 U.S.C. Section 263a, to the extent the provision of access to the subject would be prohibited by law; or
	2.	Exempt from the Clinical Laboratory Improvements Amendments of 1988, pursuant to 42 CFR 493.3(a)(2).
	g. 	Optional reasons for denial of access. The department may deny a subject access in the following circumstances.
	(1)	The department may temporarily suspend a subject’s access to protected health information created or obtained by a covered health care provider in the course of research that includes treatment. The subject must have agreed to the denial of access when consenting to participate in the research that includes treatment. The suspension may last for as long as the research is in progress. The department shall inform the subject that the right of access will be reinstated upon completion of the research.
	(2)	The department may deny a subject’s access to protected health information that is contained in records that are subject to the Privacy Act, 5 U.S.C. Section 552a, if the denial of access under the Privacy Act would meet the requirements of that law.
	(3)	The department may deny a subject’s access if the protected health information was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.
	(4)	State or federal law prohibits a subject’s access to protected health information, such as the state law limitations described in subrule 9.9(2).
	(5)	The department may deny a subject access, provided that the subject is given a right to have the denials reviewed as required by paragraph 9.9(1)“i,” in the following circumstances:
	1.	A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the subject or another person;
	2.	The protected health information makes reference to another person (unless the other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to the other person; or
	3.	The request for access is made by the subject’s personal representative, subject to the more restrictive definition of personal representative for protected health information, and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to the personal representative is reasonably likely to cause substantial harm to the subject or another person.
	h. 	Action on denial of access. If the department denies access, in whole or in part, to protected health information, the department shall comply with the following requirements.
	(1)	The department shall, to the extent possible, give the subject access to any other protected health information requested, after excluding the protected health information to which the department has a reason to deny access.
	(2)	The department shall provide a timely, written denial to the subject, in accordance with paragraph 9.9(1)“b.”
	i. 	Review of denial of access. If access is denied for a reason permitted under subparagraph 9.9(1)“g”(5), a subject may submit a written request for a review of a denial. If the subject requests a review, the department shall promptly refer the request to a licensed health care professional who is designated by the department to act as a reviewing official and who did not participate in the original decision to deny.
	(1)	The designated reviewing official shall determine, within 30 days, whether or not to deny the access requested based on the standards in subparagraph 9.9(1)“g”(5).
	(2)	The department shall promptly provide written notice to the subject of the determination made by the designated reviewing official and shall take other action as required to carry out the designated reviewing official’s determination.
	9.9(2) Access by subjects to other confidential information. The department shall release confidential records to the subject of the record. However, when a record has multiple subjects with interest in the confidentiality of the record, the department may take reasonable steps to protect confidential information relating to another subject. The department need not release the following records to the subject:
	a. 	Records need not be disclosed to the subject when they are the work product of an attorney or are otherwise privileged.
	b. 	The identity of a person reporting suspected abuse to the department need not be disclosed to the subject. (See 441—subrule 175.41(2) and Iowa Code section 235A.19.)
	c. 	The identity of a person providing information to the department need not be disclosed directly or indirectly to the subject of the information when that information is authorized to be held confidential pursuant to Iowa Code section 22.7(18).
	d. 	Peace officers’ investigative reports may be withheld from the subject, pursuant to Iowa Code section 22.7(5).
	e. 	The department may withhold disclosure of confidential information when the department has reason to believe that disclosure of the information would cause substantial and irreparable harm and would not be in the public interest. The department may withhold disclosure to seek an injunction to restrain examination of the record according to procedures in Iowa Code section 22.8 or to notify the person who would be harmed to allow that person to seek an injunction.
	f. 	The department may withhold information as otherwise authorized by law.
441—9.10(17A,22) Use and disclosure without consent of the subject. Open records are routinely disclosed without the consent of the subject. To the extent allowed by law, the department may also use and disclose confidential information without the consent of the subject or the subject’s representative.
	9.10(1) Internal use. Confidential information may be disclosed to employees and agents of the department as needed for the performance of their duties. The custodian of the record shall determine what constitutes legitimate need to use confidential records.
People affected by this rule include:
	1.	County-paid staff, field work students, and volunteers working under the direction of the department.
	2.	Council and commission members.
	3.	Policy review and advisory committees.
	4.	Consultants to the department.
	9.10(2) Audits and health oversight activities.
	a. 	Audits. Information concerning program expenditures and client eligibility is released to staff of the state executive and legislative branches who are responsible for ensuring that public funds have been managed correctly. Information is also released to auditors from federal agencies when those agencies provide program funds.
	b. 	Health oversight activities. The department shall disclose protected health information to the Secretary of Health and Human Services to investigate or determine the department’s compliance with federal HIPAA regulations.
	(1)	Except as specified in paragraph 9.10(2)“c,” the department may also use protected health information, or disclose it to a health oversight agency, for other health oversight activities authorized by law. Health oversight activities include audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of:
	1.	The health care system;
	2.	Government benefits programs for which protected health information is relevant to client eligibility;
	3.	Organizations subject to government regulatory programs for which protected health information is necessary for determining compliance with program standards; or
	4.	Organizations subject to civil rights laws for which protected health information is necessary for determining compliance.
	(2)	If a health oversight activity or investigation is conducted in conjunction with an oversight activity or investigation relating to a claim for public benefits not related to health, the joint activity or investigation shall be considered a health oversight activity for purposes of subrule 9.10(2).
	c. 	Exception to health oversight activities. For the purpose of the disclosures permitted by paragraph 9.10(2)“b,” a health oversight activity shall not include an investigation or other activity in which the subject is also the subject of the investigation or activity, unless the investigation or other activity directly relates to:
	(1)	The receipt of health care;
	(2)	A claim for public health benefits; or
	(3)	Qualification for or receipt of public benefits or services, when a patient’s health is integral to the claim for public benefits or services.
	9.10(3) Program review. Information concerning client eligibility and benefits is released to state or federal officials responsible for determining whether the department is operating a program lawfully. These officials include the ombudsman office under Iowa Code section 2C.9, the auditor of state under Iowa Code section 11.2, the Office of Inspector General in the federal Department of Health and Human Services, and the Centers for Medicare and Medicaid Services.
	9.10(4) Contracts and agreements with agencies and persons.
	a. 	The department may enter into contracts or agreements with public or private agencies, such as the department of inspections and appeals, and business associates, such as, but not limited to, the Iowa Medicaid enterprise units, in order to carry out the department’s official duties. Information necessary to carry out these duties may be shared with these agencies. The department may disclose protected health information to a business associate and may allow a business associate to create or receive protected health information on its behalf, if the department obtains satisfactory assurance that the business associate will appropriately safeguard the information.
	b. 	The department may enter into agreements to share information with agencies administering federal or federally assisted programs which provide assistance or services directly to persons on the basis of need. Only information collected in the family investment program, the child care assistance program, the food assistance program, the refugee resettlement program, or the child support recovery program may be shared under these agreements.
	c. 	To meet federal income and eligibility verification requirements, the department has entered into agreements with the department of workforce development, the United States Internal Revenue Service, and the United States Social Security Administration.
The department obtains information regarding persons whose income or resources are considered in determining eligibility and the amount of benefits for the family investment program, refugee cash assistance, child care assistance, food assistance, Medicaid, state supplementary assistance and foster care. Identifying information regarding clients of these programs is released to these agencies. The information received may be used for eligibility and benefit determinations.
	d. 	To meet federal requirements under the Immigration Reform and Control Act of 1986 (IRCA) relating to the Systematic Alien Verification for Entitlements (SAVE) program, the department has entered into an agreement with the Bureau of Citizenship and Immigration Service (BCIS). Under the agreement, the department exchanges information necessary to verify alien status for the purpose of determining eligibility and the amount of benefits for the family investment program, refugee cash assistance, food assistance, Medicaid, state supplementary assistance and foster care assistance. Identifying information regarding these subjects is released to the BCIS. The information received may be used for eligibility and benefit determinations.
	e. 	The department has entered into an agreement with the department of workforce development to provide services to family investment program clients participating in the PROMISE JOBS program as described at 441—Chapter 93. Information necessary to carry out these duties shall be shared with the department of workforce development, as well as with its subcontractors.
The department has entered into an agreement with the department of human rights to provide services to family investment program clients participating in the family development and self-sufficiency program as described at 441—Chapter 165. Information necessary to carry out these duties shall be shared with the department of human rights, as well as with that agency’s subcontractors.
	f. 	State legislation requires that all emergency assistance households apply for and accept benefits for which they may qualify from the energy assistance, county general relief and veteran’s affairs programs before approval for emergency assistance. To meet this requirement, the department may enter into agreements with the agencies that administer these programs under which they may provide services to emergency assistance households as described at 441—Chapter 58. Information necessary to carry out these duties shall be shared with these agencies.
	g. 	The department has entered into an agreement with the department of education, vocational rehabilitation, disability determination services, to assist with Medicaid disability determinations.
	h. 	The department has entered into an agreement with the department of education to share information that assists both schools and department clients in carrying out the annual verification process required by the United States Department of Agriculture, Food and Nutrition Service. That federal agency requires the department of education and local schools to verify eligibility of a percentage of the households approved for free-meal benefits under the school lunch program.
When a department office receives a written request from the local school, the department office responds in writing with the current family investment program and food assistance program status of each recipient of free meals listed in the request. Other client-specific information is made available only with written authorization from the client.
	9.10(5) Release for judicial and administrative proceedings. Information is released to the court as required in Iowa Code sections 125.80, 125.84, 125.86, 229.8, 229.10, 229.13, 229.14, 229.15, 229.22, 232.48, 232.49, 232.52, 232.71B, 232.81, 232.97, 232.98, 232.102, 232.111, 232.117 and 235B.3.
	a. 	The department may disclose protected health information in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal, provided that the department discloses only the protected health information expressly authorized by the order and the court makes the order knowing that the information is confidential.
	b. 	When a court subpoenas information that the department is prohibited from releasing, the department shall advise the court of the statutory and regulatory provisions against disclosure of the information and shall disclose the information only on order of the court.
	9.10(6) Fraud. Information concerning suspected fraud or misrepresentation to obtain department services or assistance is disclosed to the department of inspections and appeals and to law enforcement authorities.
	9.10(7) Service referrals. Information concerning clients may be shared with purchase of service providers under contract to the department.
	a. 	Information concerning the client’s circumstances and need for service is shared with prospective providers to obtain placement for the client. If the client is not accepted for service, all written information released to the provider shall be returned to the department.
	b. 	When the information needed by the provider is mental health information or substance abuse information, the subject’s specific consent is required in subrule 9.3(4).
	9.10(8) Medicaid billing. Only the following information shall be released to bona fide providers of medical services in the event that the provider is unable to obtain it from the subject and is unable to complete the Medicaid claim form without it:
	a. 	Patient identification number.
	b. 	Health coverage code as reflected on the subject’s medical card.
	c. 	The subject’s date of birth.
	d. 	The subject’s eligibility status for the month that the service was provided.
	e. 	The amount of spenddown.
	f. 	The bills used to meet spenddown.
	9.10(9) County billing. Information necessary for billing is released to county governments that pay part of the cost of care for intermediate care facility services for the mentally retarded under 441—subrule 82.14(2) or Medicaid waiver services under rule 441—83.70(249A) or 441—83.90(249A). This information includes client names, identifying numbers, provider names, number of days of care, amount of client payment, and amount of payment due.
	9.10(10) Child support recovery. The child support recovery unit has access to information from most department records for the purpose of establishing and enforcing support obligations. Information about absent parents and recipients of child support services is released according to the provisions of Iowa Code chapters 234, 252A, 252B, 252C, 252D, 252E, 252F, 252G, 252H, 252I, 252J, 252K, 598, 600B, and any other support chapter. Information is also released to consumer reporting agencies as specified in rule 441—98.116(252B).
	9.10(11) Refugee resettlement program. Contacts with both sponsor and resettlement agencies are made as a part of the verification process to determine eligibility or the amount of assistance. When a refugee applies for cash or Medicaid, the refugee’s name, address, and telephone number are given to the refugee’s local resettlement agency.
	9.10(12) Abuse investigation. The central abuse registry disseminates child abuse information and dependent adult abuse information as provided in Iowa Code sections 235A.15 and 235B.7, respectively. Reports of child abuse and dependent adult abuse investigations are submitted to the county attorney as required in Iowa Code sections 232.71B and 235B.3. Results of the investigation of a report by a mandatory reporter are communicated to the reporter as required in Iowa Code sections 235A.17(2) and 235A.15(2)“b”(5).
	9.10(13) Foster care. Information concerning a child’s need for foster care is shared with foster care review committees or foster care review boards and persons named in the case permanency plan.
	9.10(14) Adoption. Adoptive home studies completed on families who wish to adopt a child are released to licensed child-placing agencies, to the United States Immigration and Naturalization Service, and to adoption exchanges. Information is released from adoption records as provided in Iowa Code sections 600.16 and 600.24.
	9.10(15) Disclosures to law enforcement.
	a. 	Disclosures by workforce members who are crime victims. The department is not considered to have violated the requirements of this chapter if a member of its workforce who is the victim of a criminal act discloses confidential information to a law enforcement official, provided that:
	(1)	The confidential information disclosed is about the suspected perpetrator of the criminal act and intended for identification and location purposes; and
	(2)	The confidential information disclosed is limited to the following information:
	1.	Name and address.
	2.	Date and place of birth.
	3.	Social security number.
	4.	ABO blood type and Rh factor.
	5.	Type of injury.
	6.	Date and time of treatment.
	7.	Date and time of death, if applicable.
	8.	A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos.
	b. 	Crime on premises. The department may disclose to a law enforcement official protected health information that the department believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the department.
	c. 	Decedents. The department may disclose protected health information to a law enforcement official about a subject who has died when the death resulted from child abuse or neglect or the death occurred in a department facility.
	d. 	Other. The department may disclose confidential information to a law enforcement official when otherwise required or allowed by this chapter, such as disclosures about victims of child abuse or neglect; disclosures to avert a threat to health or safety, or to report suspected fraud; disclosures required by due process of law, such as disclosures for judicial and administrative proceedings; or other disclosures required by law.
	9.10(16) Response to law enforcement. The address of a current recipient of family investment program benefits may be released upon request to a federal, state or local law enforcement officer if the officer provides the name of the recipient, and the officer demonstrates that:
	a. 	The recipient is a fugitive felon who is fleeing prosecution, custody or confinement after conviction under state or federal law, or who is a probation or parole violator under state or federal law, or
	b. 	The recipient has information that is necessary for the officer to conduct the officer’s official duties, and
	c. 	The location or apprehension of the recipient is within the officer’s official duties.
	9.10(17) Research. Information that does not identify individual clients may be disclosed for research purposes with the consent of the division administrator responsible for the records. The division administrator shall investigate the credentials of the researcher.
	a. 	Mental health information may be disclosed for purposes of scientific research as provided in Iowa Code section 228.5, subsection 3, and section 229.25. Requests to do research involving records of a department facility shall be approved by the designated authority.
	b. 	Abuse registry information may be disclosed for research purposes as provided in rules 441—175.42(235A) and 441—176.12(235B) and authorized by Iowa Code sections 235A.15(2)“e”(1) and 235B.6(2)“e”(1).
	c. 	For research relating to protected health information, the researcher shall provide the department with information about the nature of the research, the protocol, the type of information being requested, and any other relevant information that is available concerning the request. If the researcher feels that contact with the subject is needed, the researcher shall demonstrate to the department that the research cannot be conducted without contact with the subject. The researcher shall pay for the costs of obtaining authorizations needed to contact the subjects and for the cost of files and preparation needed for the research.
	9.10(18) Threat to health or safety.
	a. 	All programs. A client’s name, identification, location, and details of a client’s threatened or actual harm to department staff or property may be reported to law enforcement officials. Other information regarding the client’s relationship to the department shall not be released.
When a department staff person believes a client intends to harm someone, the staff person may warn the intended victim or police or both. Only the name, identification, and location of the client and the details of the client’s plan of harm shall be disclosed.
	b. 	Protected health information. The department may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the department, in good faith, believes the use or disclosure:
	(1)	Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or
	(2)	Is necessary for law enforcement purposes as described in this chapter.
	c. 	When the department uses or discloses protected health information pursuant to paragraph 9.10(18)“b,” the department is considered to have acted in good faith if the action is based on the department’s actual knowledge or on a credible representation by a person with apparent knowledge or authority.
	9.10(19) Required by law.
	a. 	Information is shared with other agencies without a contract or written agreement when federal law or regulations require it.
	b. 	The department may use or disclose protected health information to the extent that use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of the law.
	c. 	State law shall preempt rules in this chapter about protected health information when any one of the following conditions exists:
	(1)	Exception granted by Secretary of Health and Human Services. A determination is made by the Secretary of Health and Human Services under 45 CFR 160.204 as amended to August 14, 2002, that the provision of state law:
	1.	Is necessary:
	●	To prevent fraud and abuse related to the provision of or payment for health care;
	●	To ensure appropriate state regulation of insurance and health plans to the extent expressly authorized by statute or regulation;
	●	For state reporting on health care delivery or costs; or
	●	For purposes of serving a compelling need related to public health, safety, or welfare, and, if a requirement under this chapter is at issue, the Secretary of Health and Human Services determines that the intrusion into privacy is warranted when balanced against the need to be served; or
	2.	Has as its principal purpose, the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances, as defined in 21 U.S.C. 802, or that is deemed a controlled substance by state law.
	(2)	State law more stringent. The provision of state law relates to the privacy of protected health information and is more stringent than a requirement of this chapter, within the meaning of “more stringent” found at 45 CFR 160.202 as amended to August 14, 2002.
	(3)	Reporting requirements. The provision of state law, including state procedures established under the law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention.
	(4)	Requirements related to audits, monitoring, evaluation, licensing, and certification. The provision of state law requires a health plan to report, or to provide access to, information for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities and persons.
	9.10(20) Reserved.
	9.10(21) Treatment, payment, or health care operations.
	a. 	The department may use or disclose protected health information for treatment, payment, or health care operations, as described in this paragraph, except for psychotherapy notes, which are subject to the limits described in paragraph 9.10(21)“b.” The use or disclosure shall be consistent with other applicable requirements of this chapter.
	(1)	The department may use or disclose protected health information for its own treatment, payment, or health care operations.
	(2)	The department may disclose protected health information for treatment activities of a health care provider.
	(3)	The department may disclose protected health information to another covered entity or a health care provider for the payment activities of the person or organization that receives the information.
	(4)	The department may disclose protected health information to another covered entity for health care operations activities of the covered entity that receives the information, if each covered entity either has or had a relationship with the person who is the subject of the protected health information being requested, the protected health information pertains to the relationship, and the disclosure is:
	1.	For a purpose listed in numbered paragraph “1” or “2” of the definition of health care operations in 45 CFR 164.501 as amended to August 14, 2002; or
	2.	For the purpose of health care fraud and abuse detection or compliance.
	b. 	The department may use or disclose psychotherapy notes without an authorization for any one of the following reasons:
	(1)	To carry out the following treatment, payment, or health care operations:
	1.	Use by the originator of the psychotherapy notes for treatment.
	2.	Use or disclosure by the department for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling.
	3.	Use or disclosure by the department to defend itself in a legal action or other proceeding brought by the subject.
	(2)	When required by the Secretary of Health and Human Services to investigate or determine the department’s compliance with federal HIPAA regulations.
	(3)	For health oversight activities, as described at subrule 9.10(2), with respect to the oversight of the originator of the psychotherapy notes.
	(4)	When necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public as described at subrule 9.10(18).
	(5)	When required by law as described at subrule 9.10(19).
	(6)	To disclose protected health information in the designated record set to a coroner or medical examiner as described at subrule 9.10(24).
	9.10(22) Public health activities. The department may disclose protected health information for the public health activities and purposes described in this subrule. This disclosure is in addition to any other disclosure to a public health authority allowed by this chapter, such as a disclosure to report child abuse or neglect. For the purposes of this subrule, a public health authority includes state and local health departments, the Food and Drug Administration (FDA), and the Centers for Disease Control and Prevention.
	a. 	The department may disclose protected health information to a public health authority that is authorized by law to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability.
	(1)	The information that may be disclosed includes, but is not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions.
	(2)	At the direction of a public health authority, the department may also report this information to an official of a foreign government agency that is acting in collaboration with a public health authority.
	b. 	The department may disclose protected health information to a person or organization that is subject to the jurisdiction of the FDA for public health purposes related to the quality, safety, or effectiveness of an FDA-regulated product or activity for which that person or organization has responsibility. These purposes include:
	(1)	To collect or report adverse events (or similar activities with respect to food or dietary supplements), product defects or problems (including problems with the use or labeling of a product).
	(2)	To track FDA-regulated products.
	(3)	To enable product recalls, repairs, or replacement, or lookback (including locating and notifying subjects who have received products that have been recalled, withdrawn, or are the subject of lookback).
	(4)	To conduct postmarketing surveillance.
	c. 	The department may disclose protected health information to a person who is at risk of contracting or spreading a disease or condition. The disclosure must be necessary to carry out public health interventions or investigations or to notify a person that the person has been exposed to a communicable disease to prevent or control the spread of the disease.
	9.10(23) Victims of domestic violence. The department shall disclose confidential information about an individual whom the department reasonably believes to be a victim of domestic violence when required by state law.
	9.10(24) Disclosures to coroners, medical examiners, and funeral directors.
	a. 	Coroners and medical examiners. The department may disclose protected health information about a subject that is contained in the designated record set to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law.
	b. 	Funeral directors. The department may disclose protected health information about a subject that is contained in the designated record set to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent. If necessary for funeral directors to carry out their duties, the department may disclose the protected health information before, and in reasonable anticipation of, the subject’s death.
	9.10(25) Disclosures for cadaveric organ, eye or tissue donation purposes. The department may disclose protected health information about a subject that is contained in the designated record set to organ procurement organizations or other organizations engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation. The department shall make a disclosure only when the disclosure has been approved by the deceased subject’s authorized legal representative and there is evidence that the decedent had given approval for organ, eye, or tissue donation procedures before the decedent’s death.
	9.10(26) Specialized government functions. Protected health information may be shared under the circumstances described at 45 CFR 164.512, paragraph “k,” as amended to August 14, 2002, if otherwise allowable under state law, such as sharing protected health information with the Social Security Administration in determining Medicaid eligibility for supplemental security income applicants and recipients.
	9.10(27) Whistle blowers. The department is not considered to have violated the requirements of this chapter when a member of its workforce or a business associate discloses protected health information, provided that:
	a. 	The workforce member or business associate has a good-faith belief that the department or a business associate has engaged in conduct that is unlawful or otherwise violates professional or clinical standards, or has provided care, services, or conditions that potentially endanger one or more patients, workers, or the public; and
	b. 	The disclosure is made to one of the following:
	(1)	A health oversight agency or public health authority authorized by law to investigate or oversee conduct or conditions for the purpose of reporting the allegation of failure to meet professional standards or misconduct.
	(2)	An appropriate health care accreditation organization.
	(3)	An attorney retained by or on behalf of the workforce member or business associate for the purpose of determining the legal options of the workforce member or business associate.
	9.10(28) Secondary to a use or disclosure of protected health information. The department may use or disclose protected health information that is secondary to a use or disclosure otherwise permitted or required by these rules, such as when a visitor in a facility overhears a doctor speaking to a subject about the subject’s health.
	9.10(29) De-identified data or a limited data set.
	a. 	De-identified information. The department may use or disclose protected health information to create information that is de-identified under the conditions specified in 45 CFR 164.514, paragraphs “a” through “c,” as amended to August 14, 2002.
	b. 	Limited data set. The department may use or disclose a limited data set under the conditions specified at 45 CFR 164.514, paragraph “e,” as amended to August 14, 2002, when the department enters into a data use agreement for research, public health, or health care operations.
[ARC 5417C, IAB 2/10/21, effective 4/1/21]
441—9.11(22) Availability of records. This rule lists the department records which are open to the public, those which are confidential, and those which are partially open and partially confidential.
Department records are listed by category according to the legal basis for confidential treatment (if any). A single record may contain information from several categories.
The department administers several federally funded programs and is authorized by Iowa Code section 22.9 to enforce confidentiality standards from federal law and regulation as required for receipt of the funds. Where federal authority is cited in this rule, the department has determined that the right to examine and copy public records under Iowa Code section 22.2 would cause the denial of funds, services, or essential information from the United States government that would otherwise be available to the department.
The chart indicates whether the records in this category contain personally identifiable information and indicates the legal authority for confidentiality and for the collection of personally identifiable information.
Abbreviations are used in the chart as follows:

Code	 	Meaning	
O	 	The records are open for public inspection.	
C	 	The records are confidential and are not open to public inspection.	
O/C	 	The record is partly open and partly confidential.	
PI	 	Personally identifiable information	
NA	 	Not applicable	

DESCRIPTION OF RECORD	TYPE
OF
RECORD	LEGAL AUTHORITY
FOR
CONFIDENTIALITY	PERSONALLY
IDENTIFIABLE
INFORMATION	LEGAL AUTHORITY
FOR PI
INFORMATION	
Records of council, commission and
statutory committees	O/C	Iowa Code 21.5(4)	No	NA	
Pharmaceutical and therapeutics committee
records (including information related to the prices manufacturers or wholesalers charge for pharmaceuticals)	O/C	42 U.S.C. §1396r(8)(b)(3)(D)
and Iowa Code 550	No	NA	
Rule making	O	NA	No	NA	
Declaratory order records	O/C	Iowa Code 217.30	No	NA	
Rules and policy manuals	O	NA	No	NA	
State plans	O	NA	No	NA	
Publications	O	NA	No	NA	
Statistical reports	O	NA	No	NA	
Financial and administrative records	O	NA	No	NA	
Personnel records	O/C	Iowa Code 22.7(11)	Yes	Iowa Code 217.1	
Contracts and interagency agreements	O	NA	No	NA	
Grant records	 	 	 	 	
• Child abuse prevention	O	NA	No	NA	
• Mental health/mental retardation
general allocation	O	NA	No	NA	
• Mental health/mental retardation
special allocation	O	NA	No	NA	
• Developmental disabilities basic	O	NA	No	NA	
• Alcohol/drug abuse/mental health block	O	NA	No	 	
• National Institute of Mental Health	O	NA	No	 	
• Pregnancy prevention	O	NA	No	NA	
• Juvenile community-based services	O	NA	No	NA	
• Runaway prevention	O	NA	No	NA	
Collection service center payment records	C	Iowa Code 252B.9(2); 42 U.S.C. §654a(d); 45 CFR §307.13	Yes	Iowa Code 252B.9, 252B.13A, 252B.16	
Licensing, registration and approval	 	 	 	 	
• Juvenile detention and shelter care
facilities	O/C	Iowa Code 217.30	No	NA	
• Adoption investigators	O	NA	Yes	Iowa Code 600.2	
• Supervised apartment living arrangement	O	NA	No	NA	
• Mental health providers	O	NA	No	NA	
• Family-life homes	O/C	Iowa Code 217.30	Yes	Iowa Code 234.6	
• Foster care facilities	O/C	Iowa Code 237.9	Yes	Iowa Code 237	
• Child care facilities	O/C	Iowa Code 237A.7	Yes	Iowa Code 237A	
• Child-placing agencies	O/C	Iowa Code 238.24	No	NA	
• Health care facilities	O/C	Iowa Code 135C.19	No	NA	
Appeal records	O/C	Iowa Code 217.30	Yes	Iowa Code 217.1	
Litigation files	O/C	Iowa Code 217.30,
22.7(4), 622.10	Yes	Iowa Code 217.1	
Service provider records	 	 	 	 	
• Purchase of service providers	O/C	Iowa Code 217.30	Yes	Iowa Code 234.6	
• Medicaid providers	O/C	Iowa Code 217.30,
42 U.S.C. §1396a(7), 42
CFR 431.300 to 307
as amended to
November 13, 1996	Yes	Iowa Code 249A.4	
• Residential care facilities	O/C	Iowa Code 217.30	No	NA	
All service or assistance client records	C	Iowa Code 217.30	Yes	Iowa Code 217.1	
• Family investment program	C	Iowa Code 217.30;
42 U.S.C. §602(a)(1) and §1306a	Yes	Iowa Code 239B	
• Child care assistance	C	Iowa Code 237A.13	Yes	Iowa Code 237A	
• State Supplementary Assistance	C	Iowa Code 217.30	Yes	Iowa Code 249	
• Medicaid	C	Iowa Code 217.30;
42 U.S.C. §1396a(7);
42 CFR 431.300 to 307
as amended to November 13, 1996	Yes	Iowa Code 249A.4	
• HAWK-I	C	Iowa Code 514I; 42 CFR 457.1110 as amended to January 11, 2001	Yes	Iowa Code 514I.4	
• Food assistance	C	Iowa Code 217.30;
7 U.S.C. §2020(e)8
and 7 CFR 272.1 (c)
and (d) as amended to
January 1, 1987	Yes	Iowa Code 234.6	
• Foster care	C	Iowa Code 237.9	Yes	Iowa Code 237.3
to 237.5	
• Title IV-E foster care and adoption
assistance	C	Iowa Code 217.30;
42 U.S.C. §671(a)(8);
45 CFR 1355.30(1) as
amended to November
23, 2001	Yes	Iowa Code 217.1, Iowa Code 600.17
to 600.22	
• Refugee resettlement	C	Iowa Code 217.30;
45 CFR 400.27 as
amended to March 22,
2000	Yes	Iowa Code 217.1	
• Substance abuse	C	Iowa Code 125.37 and 125.93; 42 U.S.C. §29
dd. 3 and ee. 3; 42
CFR Part 2 as amended
to October 1, 2002; 38
U.S.C. §4132	Yes	Iowa Code 125, 218, 219 and 234.6 and 249A.4	
• State institution resident records	C	Iowa Code 218.22,
229.24 and 229.25	Yes	Iowa Code 218.1	
Program records	 	 	 	 	
• Child support recovery	C	Iowa Code 252B.9 and 252G.5; 42 U.S.C. §654(26), 42 U.S.C. §654a(d); 45 CFR §303.21 and 307.13	Yes	Iowa Code 252A, 252B, 252C, 252D, 252E, 252F, 252G, 252H, 252I, 252J, 252K, and 144.13, 144.26, 232.147, 234.39, 595.4, 598.22B, and 600.16A	
• Child abuse	C	Iowa Code 235A.13,
235A.15, 235A.16, and
235A.17	Yes	Iowa Code 235A.14	
• Dependent adult abuse	C	Iowa Code 235B.1, par
4(a)	Yes	Iowa Code 235B.1	
• Adoption	C	Iowa Code 600.16 and
600.24	Yes	Iowa Code 600.8
and 600.16	
Client records may contain information
from restricted sources:	 	 	 	 	
• Federal tax returns	C	Iowa Code 422.20(2);
26 U.S.C. §6103	Yes	Iowa Code 217.1,
234.6(7), 239B,
249A, 252B	
• Department of revenue	C	Iowa Code 421.17,
422.20(1)	Yes	Iowa Code 252B.5 and 252B.9	
• Department of workforce development	C	Iowa Code 217.30; 42
U.S.C. §503(d) and
(e)	Yes	Iowa Code 217.1,
234.6(7), 239B,
249A, 249C, 252B.9	
• Income and eligibility verification
system	C	Iowa Code 217.30;
42 U.S.C. §1230b-7	Yes	Iowa Code 217.1,
234.6(7), 239B, 249A	
• Department of public safety	C	Iowa Code 692.2, 692.3,
692.8 and 692.18	Yes	Iowa Code 237.8,
237A.5, 252B.9	
• United States Department of
Health and Human Services	C	Iowa Code 217.30;
42 CFR Part 401.134(c) as amended to October 1, 2002	Yes	Iowa Code 217.1,
234.6(7), 239B,
249, 249A, 252B	
• Peer review organization	C	Iowa Code 217.30;
42 U.S.C. §1320c-9	Yes	Iowa Code 249A.4	
• Juvenile court	C	Iowa Code 232.48,
232.97 and 232.147 to
232.151	Yes	Iowa Code 232 and
234.6	
Other information	 	 	 	 	
• Mental health information	C	Iowa Code 228.2(1)	Yes	Iowa Code 217,
219, 222, 229	
• Information received by a
licensed social worker	C	Iowa Code 154C.5	Yes	Iowa Code 217.1	
• Debtors to the department	C	Iowa Code 537.7103(3)	Yes	Iowa Code 217.1	
• Health care facility complaint and
citation records	C	Iowa Code 135C.19	No	Iowa Code 249A.4,
135C.19	
• Hospital records, medical records,
and professional counselor records	C	Iowa Code 22.7(2)	Yes	Iowa Code 218,
219, 222, 229	
• Privileged communication and work
products of attorneys representing
the department	C	Iowa Code 22.7(4),
Iowa Code of Professional Responsibility
for Lawyers, Canon 4	No	NA	
• Identity of volunteer informant
who does not consent to release	C	Iowa Code 22.7(18)	No	Iowa Code 217.1	
• School records	C	Iowa Code 22.7(1)	Yes	Iowa Code 218.1
and 234.6	
• Library circulation records	C	Iowa Code 22.7(13) and
(14)	No	Iowa Code 217.1	
• Sealed bids prior to public opening	C	Iowa Code 72.3	No	NA	
• Protected health information	C	HIPAA	Yes	Iowa Code 218.1, 249A.4, 514I.4	
[ARC 1262C, IAB 1/8/14, effective 3/1/14]
441—9.12(22,252G) Personally identifiable information. The confidentiality provisions affecting records described in this rule are addressed in rule 441—9.11(22).
	9.12(1) Nature and extent. The personally identifiable information collected by the department in its administration of human services programs varies by the type of record. The nature and extent of personally identifiable information is described below:
	a. 	Recipients of assistance. Several different types of department records contain personally identifiable information about recipients of assistance programs such as food assistance, Medicaid, the family investment program, child care assistance, state supplementary assistance, refugee cash and medical assistance, and commodity supplemental foods.
	(1)	Client case file. Local office case files contain identifying information, demographic information, household composition, and income and resource information about applicants for and recipients of assistance, as well as any other persons whose circumstances must be considered in determining eligibility. Records may contain information about employment, disability, or social circumstances. Records identify the kind and amount of benefits received and what proof was obtained to verify the recipient’s eligibility. Case files contain correspondence, appeal requests and decisions, and documentation of department actions.
	(2)	Local office administrative records. Client names and program data are kept in card files, appointment logs, worker case lists, and issuance records.
	(3)	Data processing systems. Client identifying information, eligibility data, and payment data are kept in the following systems. Some of these records are also kept on microfiche.

System	Function	
Automated Benefit Calculation System	Determines eligibility for FIP, food assistance, Medicaid	
Automated Child Abuse and Neglect System	Inactive child abuse/neglect system	
Appeals Logging and Tracking System	Tracks client appeals	
BCCT Program	Establishes Medicaid eligibility for breast and cervical cancer clients	
Change Reporting System	Tracks client-reported changes and produces forms needed for client-reported changes	
Diversion System	Tracks clients using diversion benefits	
Electronic Payment Processing and Inventory
Control System	Electronically issues food assistance	
Eligibility Tracking System	Tracks clients’ FIP eligibility and hardship status	
Family and Children’s Services System	Tracks foster care, adoption, family-centered and family preservation services	
Food Stamps Case Reading Application	Food assistance accuracy tool used to record case reading information	
Health Insurance Premium Payment System	Health insurance premium payment	
Iowa Collection and Reporting System	Tracks child support recovery processes	
Iowa Central Employee Registry	Child support new hire reporting system	
Iowa Eligibility Verification System	Federal social security number verification and benefits	
 	 	
Individualized Services Information System	Used to establish facility eligibility, process data to and from ABC and Medicaid fiscal agent, establish waiver services, providers, and eligibility	
Issuance History	Displays benefit issuances for FIP and food assistance	
KACT System	Authorizes foster care service units	
MEPD Premium Payment Program	Accounting system for billing and payment for Medicaid for employed people with disabilities program	
Managed Health Care Program	Assigns managed health care providers to clients	
Medicaid Management Information Systems	Process clients’ Medicaid claims and assign Medicaid coverage to clients	
Overpayment Recoupment System	Used to recover money from FIP, food assistance, Medicaid, child care assistance, PROMISE JOBS, and hawki clients	
Public Information Exchange	Data exchange between states	
PJCASE	Iowa workforce development interface with PROMISE JOBS	
Purchase of Social Services System	Purchased services (mostly child care and in-home health clients)	
Presumptive Eligibility Program	Establishes Medicaid eligibility for presumptive eligibility clients	
Quality Control System	Selects sample for quality control review of eligibility determination	
RTS Claims Processing System	Processes rehabilitative treatment claims for federal match	
State Data Exchange Display	State data exchange information for supplemental security income recipients	
Social Security Buy-In System	Medicare premium buy-in	
Social Services Reporting System	Services reporting system for direct and purchased services	
Statewide Tracking of Assessment Reports	Tracks child abuse reports	
	(4)	Quality control records. Files are developed containing data required to verify the correctness of department eligibility and benefit decisions for selected clients.
	(5)	Appeals. Records containing client eligibility and payment information are created by the department of inspections and appeals when a client (or, for Medicaid, a provider) requests a hearing on a department action.
	(6)	Fraud. When a client is suspected of fraud, the department of inspections and appeals generates an investigative record containing information pertinent to the circumstances of the case.
	(7)	Recoupment. When benefits have been overpaid, a record is established by the department of inspections and appeals concerning the circumstances of the overpayment and the client’s repayment.
	b. 	Recipients of social services. Several kinds of department records contain personally identifiable information about applicants for and recipients of direct or purchased social services.
	(1)	Client case records. Local offices create client case files containing identifying information and demographic information; income data; information substantiating the need for services, which may include medical, psychological or psychiatric reports; social history; the department evaluation of the client’s situation; documentation of department actions; and provider reports. Records may contain court orders and reports.
	(2)	Local office administrative records. Client names and services data appear in records such as card files, case lists, and appointment logs.
	(3)	Data processing systems. Client identifying information, demographic data, and services eligibility data are stored in the service reporting system. The purchase of services system contains invoice and service payment data. The child and adult protection system contains information from abuse reports and investigations. Some of these records are also kept on microfiche.
	(4)	Appeals. Records containing client identifying information and eligibility information are created by the department of inspections and appeals when a client requests a hearing on a department action.
	(5)	Adoption records. The department keeps a master card file on all adoptions in Iowa as required in Iowa Code section 235.3, subsection 7. This record is also kept on microfilm.
The Iowa Adoption Exchange contains records on special needs children available for adoption and on families that have indicated an interest in adopting special needs children.
The department also keeps records on adoptions in which it has provided services. These files include the home study, information about the child, and legal documents. These records are also kept on microfiche.
	(6)	Abuse registry. Child and dependent adult abuse records contain names and information of the alleged victim and the victim’s family, data on the reported abuse, details of injury, investigative data, name of alleged perpetrator, names of reporters, collateral contacts and findings.
	(7)	Interstate compact records. The department maintains records on placement of children across state lines. These records contain identifying information about the children and the conditions of their placement, as well as progress reports. Some of the records are kept on microfiche.
	(8)	Guardianship records. The department maintains records on all children under its guardianship. The records concern the children’s characteristics and placements. Some of these records are kept on microfiche.
	c. 	Institutions. Institution resident records may contain identifying and demographic information, medical and social histories, treatment records, treatment plans, educational information, admission procedures, financial accounts, county billings, residential unit notes, vocational information, economic data and information about personal effects. Some of this information is kept on microfiche.
Automated data processing systems associated with institutional client records include admission and discharge systems for the juvenile institutions and for the mental health and mental retardation institutions, institutional billing systems, client banking systems, and client data systems.
	d. 	Child support recovery unit (CSRU) records. These records contain information such as client identifiers, demographic information, divorce decrees, child support orders, absent parent identifiers, employment history and physical characteristics of absent parents, payment history records, and termination of parental rights.
	e. 	Collection services center. The collection services center maintains records of support orders issued or filed in Iowa that have been converted to the collection services center system. These records identify the person paying and the person receiving support, specify the support obligations, and contain a record of payments made. Most records are on an automated data processing system. Paper records may also be kept, including conversion documents, orders, and correspondence.
	f. 	Contractor records for individual providers. Records of individual purchase of service and Medicaid providers contain information such as names of owners and employees, names of clients served, eligibility data, amounts of payment for clients, and kinds of services received by clients.
	g. 	Regulatory files on individual providers. Files on persons who apply to be licensed, certified, registered, or approved by the department contain identifying information, a description of the person’s operation or premises, and a department evaluation of the information collected. Files may contain data on criminal records and abuse registry records on the person and any employees. Files may contain information naming clients served (for example, in complaints or incident reports). Some of these records are also kept on microfilm.
	h. 	Personnel files. The department maintains files containing information about employees, families and dependents, and applicants for paid or volunteer positions within the department. The files contain payroll records, biographical information, medical information pertaining to disability, performance reviews and evaluations, disciplinary information, information required for tax withholding and information concerning employee benefits, affirmative action reports, and other information concerning the employer-employee relationship.
	9.12(2) Data processing matching.
	a. 	Internal. All data processing systems operated by the department which have comparable personally identifiable data elements permit the matching of personally identifiable information. (See subrule 9.12(1) for a description of these systems.) Matches which are routinely done include the following:
	(1)	Data from the service reporting system is matched with data from the purchase of service payment system for service eligibility and with the activity reporting system for cost allocation. Matches are also done with the state identification portion of the automated benefit calculation system.
	(2)	The automated benefit calculation system matches with the Medicaid eligibility system, the facility payment system, the child support collections system, the employment and training systems, the electronic payment processing and inventory control system, the eligibility tracking system, the Medicare buy-in system, the individualized services information system-waiver payment system, and the income eligibility and verification system.
	(3)	The Medicaid eligibility system matches information with the Medicaid management information system and the collection and recovery system.
	b. 	External.
	(1)	The state data exchange matches information on department clients with records on recipients of supplemental security income.
	(2)	The Medicare buy-in system matches information with the Social Security Administration.
	(3)	The income and eligibility verification system matches information on department clients with income records from department of workforce development records on unemployment compensation and wages, tax records from the Internal Revenue Service, wage records and social security benefit records from the Social Security Administration, and public assistance records from other states.
	(4)	Data from the collections and reporting system is matched with state and federal tax records, and with client records on the automated benefit calculation system.
	(5)	Data on department clients is matched with the administering agency for the Workforce Investment Act and with private agencies working to help employers collect benefits under the work opportunity tax credit program.
	(6)	Reports on disqualified food stamp recipients from other states are received from the United States Department of Agriculture to ensure that recipients are not evading penalties by reapplying in Iowa.
	(7)	A list of recipients of benefits under the family investment program is released annually to the Internal Revenue Service for matching with records of dependents claimed.
	(8)	A list of applicants for and recipients of the family investment program (FIP), the Medicaid program, and the food assistance program is matched with records on Iowa motor vehicle registration files to assist in the identification of countable resources.
	(9)	The Medicaid management information system matches data on medical assistance recipients against data on insureds that is submitted by insurance carriers under rule 441—76.13(249A) in order to identify third-party payers for medical assistance recipients.
	c. 	Centralized employee registry (CER) database. The CER receives data concerning employees and contractors who perform labor in Iowa. Information reported by Iowa employers about employees includes the employee’s name, address, social security number, date of birth, beginning date of employment, whether health insurance is available, and when it may be available. Information reported by Iowa income payers about contractors is limited to the contractor’s name, address, social security number, and date of birth, if known.
State agencies accessing the CER shall participate in proportionate cost sharing for accessing and obtaining information from the registry. Cost sharing shall include all costs of performing the match including costs for preparing the tapes and central processing unit time. Costs shall be specified in a 28E agreement with each agency. CER matches include the following data matches with:
	(1)	The child support collections and reporting system for the establishment and enforcement of child and medical support obligations.
	(2)	Other department of human services systems for the purpose of gathering additional information and verification for use in the determination of eligibility or calculation of benefits.
	(3)	The department of employment services for the determination of eligibility or calculation of unemployment benefits, and to monitor employer compliance with job insurance tax liability requirements.
	(4)	The department of workforce development to verify employment of participants in the PROMISE JOBS program.
	(5)	The department of revenue for the recoupment of debts to the state.
	(6)	The department of inspections and appeals for the recoupment of debts owed to the department of human services.
[ARC 5305C, IAB 12/2/20, effective 2/1/21; ARC 7711C, IAB 3/6/24, effective 4/10/24]
441—9.13(217) Distribution of informational materials.
	9.13(1) Requirements for distribution. All material sent or distributed to clients, vendors, or medical providers shall:
	a. 	Directly relate to the administration of the program.
	b. 	Have no political implications.
	c. 	Contain the names only of persons directly connected with the administration of the program.
	d. 	Identify them only in their official capacity with the agency.
	9.13(2) Distribution prohibited. The department shall not distribute materials such as holiday greetings, general public announcements, voting information, and alien registration notices.
	9.13(3) Distribution permitted. The department may distribute materials directly related to the health and welfare of clients, such as announcements of free medical examinations, availability of surplus food, and consumer protection information.
441—9.14(17A,22) Special policies and procedures for protected health information.
	9.14(1) Minimum necessary. When using or disclosing protected health information or when requesting protected health information from another covered entity, the department shall make reasonable efforts, as described in paragraphs 9.14(1)“a” through “e,” to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.
	a. 	This requirement does not apply in the following circumstances:
	(1)	Disclosures to or requests by a health care provider for treatment.
	(2)	Uses or disclosures made to the subject.
	(3)	Uses or disclosures made pursuant to an authorization.
	(4)	Disclosures made to the Secretary of Health and Human Services.
	(5)	Uses or disclosures that are required by law.
	(6)	Uses or disclosures that are required for compliance with this chapter.
	b. 	The department shall take the following actions:
	(1)	Identify those persons or classes of persons, as appropriate, in its workforce who need access to protected health information to carry out their duties.
	(2)	For each person or class of persons, identify the category or categories of protected health information to which access is needed and any conditions appropriate to the access.
	(3)	Make reasonable efforts to limit the access of these persons or classes.
	c. 	For any type of disclosure that it makes on a routine and recurring basis, the department shall implement policies and procedures (which may be standard protocols) that limit the amount of the protected health information disclosed to that reasonably necessary to achieve the purpose of the disclosure.
For all other disclosures, the department shall develop criteria designed to limit the protected health information disclosed to the information reasonably necessary to accomplish the purpose for which disclosure is sought. The department shall review requests for disclosure on an individual basis in accordance with the criteria.
The department may rely, if reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose when:
	(1)	Making permitted disclosures to a public official, provided the public official indicates that the information requested is the minimum necessary for the stated purposes;
	(2)	The information is requested by another covered entity; or
	(3)	The information is requested for the purpose of providing professional services to the department by a professional who is a workforce member or business associate of the department if the professional indicates that the information requested is the minimum necessary for the stated purpose.
	d. 	Minimum necessary requests.
	(1)	When requesting information from other covered entities, the department shall limit any request for protected health information to that which is reasonably necessary to accomplish the purpose for which the request is made.
	(2)	For a request that is made on a routine and recurring basis, the department shall implement policies and procedures (which may be standard protocols) that limit the protected health information requested to the amount reasonably necessary to accomplish the purpose for which the request is made.
	(3)	For all other requests, the department shall develop criteria designed to limit the request for protected health information to the information reasonably necessary to accomplish the purpose for which the request is made and to review requests for disclosure on an individual basis in accordance with the criteria.
	e. 	For all uses, disclosures, or requests to which the minimum necessary requirements apply, the department shall not use, disclose or request an entire medical record, except when the entire medical record is specifically justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request.
	9.14(2) Uses and disclosures for premium rating and related purposes. If a health plan receives protected health information for the purpose of premium rating or other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits, and if the health insurance or health benefits are not placed with the health plan, the health plan shall not use or disclose the protected health information for any other purpose, except as may be required by law.
	9.14(3) Verification and documentation.
	a. 	Before any disclosure of protected health information, the department shall obtain verification or documentation as follows:
	(1)	Verify the identity of a person requesting protected health information and the person’s authority to access protected health information, if the department does not know the identity or authority of the person. This requirement is waived for disclosures to persons involved in the subject’s care or for notification purposes, as described at subrule 9.7(3).
	(2)	Obtain any oral or written documentation, including statements and representations, from the person requesting the protected health information when this is a condition of the disclosure under this chapter.
	b. 	The following constitute appropriate verification or documentation, if reasonable under the circumstances:
	(1)	Documentation, statements, or representations. The department may rely on documentation, statements, or representations that, on their face, meet the applicable requirements.
	(2)	Identity of public officials. When disclosure of protected health information is requested by a public official or a person acting on behalf of the public official, the department may rely on any of the following to verify identity:
	1.	In-person presentation of an agency identification badge, other official credentials, or other proof of government status.
	2.	A written request on the appropriate government letterhead.
	3.	A written statement on appropriate government letterhead that the person is acting under the government’s authority or other evidence or documentation of agency, such as a contract for services, memorandum of understanding, or purchase order, that establishes the person is acting on behalf of the public official.
	(3)	Authority of public officials. When the disclosure of protected health information is requested by a public official or a person acting on behalf of the public official, the department may rely on any of the following to verify authority:
	1.	A written statement of the legal authority under which the information is requested.
	2.	If a written statement would be impracticable, an oral statement of the legal authority.
	3.	An order issued by a judicial or administrative tribunal.
	(4)	Exercise of professional judgment. The requirements of this subrule are met if the department relies on the exercise of professional judgment in use or disclosure to persons involved in the subject’s care or for notification purposes, in accordance with subrule 9.7(3), or acts on a good-faith belief in making a disclosure to avert a serious threat to health or safety, in accordance with subrule 9.10(18).
	9.14(4) Notice of privacy practices for protected health information. A subject has a right to adequate notice of the uses and disclosures of protected health information that may be made by the department, and of the subject’s rights and the department’s legal duties with respect to protected health information.
	9.14(5) Right to receive an accounting of disclosures. Within the limits described in this subrule, a subject has a right to receive an accounting of the disclosures of protected health information listed in paragraph 9.14(5)“a,” including disclosures to or by business associates of the department. A subject shall request an accounting using Form 470-3985, Request for a List of Disclosures.
	a. 	Disclosures that may be included in an accounting. A subject’s right to receive an accounting of disclosures made by the department, or to or by business associates of the department, is limited to the following disclosures that do not require an authorization or an opportunity for the subject to agree or object:
	(1)	For health oversight activities described at subrule 9.10(2).
	(2)	For judicial and administrative proceedings described at subrule 9.10(5).
	(3)	For law enforcement purposes described at subrule 9.10(15).
	(4)	For averting a threat to health or safety described at subrule 9.10(18).
	(5)	To meet requirements of law described at subrule 9.10(19).
	(6)	For public health activities described at subrule 9.10(22).
	(7)	For disclosures about suspected victims of domestic violence described at subrule 9.10(23).
	(8)	For disclosures about suspected victims of abuse or neglect described in 441—Chapter 9.
	(9)	To coroners, medical examiners, and funeral directors described at subrule 9.10(24).
	(10)	For cadaveric organ, eye, or tissue donation described at subrule 9.10(25).
	(11)	For specialized government functions described at subrule 9.10(26), except those made for national security or intelligence purposes.
	(12)	By whistle blowers as described at subrule 9.10(27).
	b. 	Content of the accounting. The department shall provide the subject who submits Form 470-3985, Request for a List of Disclosures, with a written accounting of disclosures that meets the following requirements.
	(1)	The accounting shall include disclosures of protected health information that occurred during the six years (or the shorter time requested by the subject) before the date of the request. However, disclosures that occurred before April 14, 2003, are not included in an accounting.
	(2)	Except for limitations regarding multiple disclosures to the same person or organization, the accounting shall include for each disclosure:
	1.	The date of the disclosure.
	2.	The name of the organization or person who received the protected health information and, if known, the address of the organization or person.
	3.	A brief description of the protected health information disclosed.
	4.	A brief statement of the purpose of the disclosure that reasonably informs the subject of the basis for the disclosure or, instead of the statement, a copy of a written request for a disclosure.
	(3)	If, during the period covered by the accounting, the department has made multiple disclosures of protected health information to a person or organization requesting a disclosure, the accounting may, with respect to the multiple disclosures, provide:
	1.	The information required by subparagraph 9.14(5)“b”(2), for the first disclosure during the accounting period;
	2.	The frequency, periodicity, or number of the disclosures made during the accounting period; and
	3.	The date of the last disclosure during the accounting period.
	c. 	Time limits for providing the accounting. The department shall act on the subject’s request for an accounting no later than 60 days after receipt of a request, as follows:
	(1)	The department shall provide the subject with the accounting requested; or
	(2)	If the department is unable to provide the accounting within these 60 days, the department may extend the due date one time, for a period not to exceed 30 days. In order to extend the due date, the department shall provide the subject with a written statement of the reasons for the delay and the date by which the department shall provide the accounting. The department shall provide this written statement within the 60-day period after receipt of the request for an accounting.
	d. 	Fee for accounting. The department shall provide to a subject one accounting without charge in any 12-month period. The department may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same subject within the 12-month period, as set forth in subrule 9.3(7), provided that the department:
	(1)	Informs the subject in advance of the fee; and
	(2)	Provides the subject with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee.
	e. 	Suspension of right. The department shall temporarily suspend a subject’s right to receive an accounting of disclosures made to a health oversight agency or law enforcement official, as permitted in this chapter, if the agency or official provides the department with a statement that the accounting would likely impede the agency’s activities and specifies the time for which a suspension is required.
	(1)	If the agency or official statement is submitted in writing, the department shall suspend the right to receive accounting for the time specified by the agency or official.
	(2)	If the agency or official statement is made orally, the department shall:
	1.	Document the statement, including the identity of the agency or official making the statement;
	2.	Temporarily suspend the subject’s right to an accounting of disclosures subject to the statement; and
	3.	Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless the agency or official statement is submitted in writing during that time.
	9.14(6) Complaint procedure. A person who believes the department is not complying with the rules on protected health information or with the applicable requirements of 45 CFR Part 160 as amended to August 14, 2002, or with the applicable standards, requirements, and implementation specifications of 45 CFR of Subpart E of Part 164 as amended to August 14, 2002, may file a complaint with the department’s privacy office or with the Secretary of Health and Human Services.
	a. 	Complaints to the department’s privacy office shall be in writing and may be delivered personally or by mail to the DHS Privacy Office, 1305 E. Walnut Street, First Floor, Des Moines, Iowa 50319-0114. Complaints regarding facilities may be sent to the applicable facility.
	b. 	Complaints to the Secretary of Health and Human Services shall be made using the procedures set forth in 45 CFR 160.306 as amended to August 14, 2002.
	9.14(7) Appeal rights.
	a. 	If the subject disputes a decision by the privacy officer, the department’s designated licensed health care professional, or the facility administrator on any of the following requests, the subject may appeal the decision in accordance with 441—Chapter 7.
	(1)	A request for restriction on use or disclosure of protected health information.
	(2)	A request for confidential communication of protected health information.
	(3)	A request for access to protected health information.
	(4)	A request to amend protected health information.
	(5)	A request for accounting of disclosures.
	b. 	The privacy officer or facility shall assist the subject in making the appeal, if needed.
	c. 	Appeals shall be:
	(1)	Mailed to the Appeals Section, Fifth Floor, Iowa Department of Human Services, 1305 E. Walnut Street, Des Moines, Iowa 50319-0114; or
	(2)	Submitted electronically at dhs.iowa.gov/appeals.
	9.14(8) Record retention. Notwithstanding any other department rule to the contrary, protected health information shall be retained for at least six years from the date of creation or the date when the information last was in effect, when required by 45 CFR 164.530, paragraph “j,” as amended to August 14, 2002.
441—9.15(17A,22) Person who may exercise rights of the subject.
	9.15(1) Adults. When the subject is an adult, including an emancipated minor, the subject’s rights under this rule may also be exercised by the subject’s legal or personal representative, except as provided in subrule 9.15(3).
	9.15(2) Minors. Within the limits of subrule 9.15(3), when the subject is an unemancipated minor, the subject’s rights under this rule shall be exercised only by the subject’s legal representative, except as follows:
	a. 	When the department otherwise deals with the minor as an adult, as in the case of minor parents under the family investment program.
	b. 	When otherwise specifically provided by law. However, minor subjects shall be granted access to their own records upon request, subject to the limits in rule 441—9.9(17A,22).
	9.15(3) Exceptions.
	a. 	Scope of authority. Legal and personal representatives may act only within the scope of their authority. For protected health information, the designation must reflect the subject’s ability to make health care decisions and receive protected health information. For example, court-appointed conservators shall have access to and authority to release only the following information:
	(1)	Name and address of subject.
	(2)	Amounts of assistance or type of services received.
	(3)	Information about the economic circumstances of the subject.
	b. 	Mental health information. Only an adult subject or a subject’s legal representative may consent to the disclosure of mental health information. Records of involuntary hospitalization shall be released only as provided in Iowa Code section 229.24. Medical records of persons hospitalized under Iowa Code chapter 229 shall be released only as provided in Iowa Code section 229.25.
	c. 	Substance abuse information. Only the subject may consent to the disclosure of substance abuse information, regardless of the subject’s age or condition.
	d. 	Failure to act in good faith. If the department has reason to believe that the legal or personal representative is not acting in good faith in the best interests of the subject, the department may refuse to release information on the authorization of the legal or personal representative.
	e. 	Abuse, neglect, and endangerment situations. Notwithstanding a state law or any other requirement of this chapter, the department, in the exercise of professional judgment, may elect not to treat a person as a subject’s personal representative if:
	(1)	The department has reason to believe that the subject has been or may be subjected to domestic violence, abuse, or neglect by the person; or
	(2)	The department has reason to believe that treating the person as a personal representative could endanger the subject.
	f. 	Protected health information. A parent, guardian, or other person acting in place of a parent who does not represent the minor for protected health information may still access protected health information about the minor if required by law.
	g. 	Deceased subjects. If, under applicable law, an executor, administrator, or other person has authority to act on behalf of a deceased subject or of the subject’s estate, the department shall treat that person as a personal representative.
	h. 	Other. If, under applicable law, the subject of a confidential record is precluded from having a copy of a record concerning the subject disclosed to a third party, the department shall not treat the third party as a personal representative.
441—9.16(22) Personally identifiable information—human rights programs. This rule describes the nature and extent of personally identifiable information which is collected, maintained, and retrieved by the agency by personal identifier in record systems as defined in rule 441—9.1(17A,22). For each record system, this rule describes the legal authority for the collection or maintenance of that information; the means of storage of that information and indicates when applicable; if a data processing system matches, collates, or permits the comparison of personally identifiable information in one record system with personally identifiable information in another record system; and when the record system is confidential, indicates the statutory authority. The record systems maintained within the agency are:
	9.16(1) Personnel records.
	a. 	The agency maintains files containing information about employees, families and dependents, and applicants for staff positions within the agency. These files include, but are not limited to, payroll records, biographical information, medical information relating to disability, performance reviews and evaluations, disciplinary information, information required for tax withholding, information concerning employee benefits, affirmative action reports and other information concerning employees and related issues. Some of this information is confidential under Iowa Code section 22.7(11).
	b. 	The legal authority for maintaining the records for state-funded programs is Iowa Code section 8A.106 and chapter 216A. The legal authority for maintaining the records for federally funded programs is the Omnibus Budget Reconciliation Act, P.L.	97-35; Freedom of Information Act, 5 U.S.C. 552a; Juvenile Justice and Delinquency Prevention Act, P.L.	93-415; Victims Compensation and Assistance Act, P.L.	98-473; and other federal statutes from which federal funds are granted.
	c. 	The information is maintained on paper and some parts are on a data processing system that matches, collates or permits the comparison of some personally identifiable information within the state’s automated data processing system.
	d. 	Certain information contained within this record system is confidential under the authority of Iowa Code section 22.7(11).
	9.16(2) Advocacy records.
	a. 	The agency maintains files containing information pertaining to clients receiving advocacy or referral services to help alleviate or solve a problem. Such information may include, but is not limited to, names and addresses of clients, documents or other material relating to advocacy issues, social or economic conditions or circumstances of particular clients, department evaluations of information about clients, medical or psychiatric data provided to the department concerning a client, and legal data related to the client. These files may be indexed by advocacy files, client files, interpreting files or any direct service involving individual client assistance set forth in this rule or by statute.
	b. 	The authority for maintaining these records is Iowa Code chapter 216A; the Omnibus Budget Reconciliation Act, P.L.	97-35; Juvenile Justice and Delinquency Prevention Act, P.L.	93-415; Victims Compensation and Assistance Act, P.L.	98-473; and other federal statutes from which federal funds are granted.
	c. 	Information is maintained on paper, electronically, and in other available mediums.
	d. 	Information contained within this record system is confidential under the authority of Iowa Code sections 22.7(18) and 216A.6.
	9.16(3) Fiscal records.
	a. 	The agency maintains files containing fiscal information for state-funded programs and federally funded grants or contracts that may contain personally identifiable information.
	b. 	The authority for maintaining these records is Iowa Code chapter 216A and federal statutes from which federal funds are granted.
	c. 	These records are stored on paper and on the state’s automated data processing system that matches, collates or permits the comparison of some personally identifiable information.
	d. 	Certain information contained within this record system is confidential under the authority of Iowa Code section 22.7(11).
	9.16(4) General correspondence, mailing lists, and program or grant data.
	a. 	The agency maintains correspondence files, grant notices and applications, conference or committee listings and reports, board and commission meeting minutes, mailing lists, program and grant information including surveys or specialized reports and activities that contain some personally identifiable information that may include names, addresses or other descriptive data.
	b. 	The authority for maintaining these records is Iowa Code chapter 216A; the Omnibus Budget Reconciliation Act, as amended, P.L.	97-35; Juvenile Justice and Prevention Act, P.L.	93-415; Victims Compensation and Assistance Act, P.L.	98-473; and other federal statutes from which federal funds are granted.
	c. 	The information is maintained on paper and in computer systems.
	d. 	These records are generally open to the public unless otherwise authorized to be confidential by law.
	9.16(5) Criminal and juvenile justice information obtained from other agencies.
	a. 	The agency maintains files containing criminal and juvenile justice information obtained from other agencies to conduct research and evaluations, to provide data and analytical information to federal, state and local governments, and to assist other agencies in the use of criminal and juvenile justice data. These files may contain personally identifiable information.
	b. 	The agency maintains these records pursuant to the authority of Iowa Code sections 216A.136 and 216A.138 and by interagency agreements.
	c. 	The information is maintained on paper, some of which is also in computer files, or in computer files and not on paper, or on a data processing system. Some of these files and systems are capable of matching, collating or permitting the comparison of some personally identifiable information.
	d. 	Certain criminal and juvenile justice information contained within these records and record systems is confidential under state or federal law or rule.
[ARC 6101C, IAB 12/29/21, effective 2/2/22; Editorial change: IAC Supplement 6/14/23]
441—9.17(22) Personally identifiable information—child advocacy board. This rule describes the nature and extent of personally identifiable information which is collected, maintained, and retrieved by the agency by personal identifier in record systems. For each record system, this rule describes the legal authority for the collection of that information, the means of storage of that information and indicates whether a data processing system matches, collates, or permits the comparison of personally identifiable information in one record system with personally identifiable information in another record system. The record systems maintained by the agency are:
	1.	Files are maintained by the child’s name in the child advocacy board offices. Those files are kept in locked filing cabinets. (Iowa Code section 237.18(2)“a”)
	2.	The foster care registry (Iowa Code section 237.17) is a computerized tracking system of the children reported to the child advocacy board. The information of each case is personally identifiable by name.
	3.	Personnel files for each employee of the child advocacy board. These may be confidential pursuant to Iowa Code section 22.7(11).
[ARC 1375C, IAB 3/19/14, effective 4/23/14; ARC 6676C, IAB 11/16/22, effective 12/21/22; Editorial change: IAC Supplement 6/14/23]
441—9.18(17A,22) Personally identifiable information—aging programs. This rule describes the nature and extent of personally identifiable information which is collected, maintained, and retrieved by the agency by personal identifier in record systems as defined in rule 441—9.1(17A,22). For each record system, this rule describes the legal authority for collection of that information, the means of storage of that information and indicates whether a data processing system matches, collates, or permits the comparison of personally identifiable information in one record system with personally identifiable information in another record system. Some of the record systems described in the accompanying chart as “open” may contain confidential information under 17—subrule 19.13(2). The record systems maintained by the agency are:
Abbreviations are used in the chart as follows:

 	Code	Meaning	 	
 	O/C	The record is partly open and partly confidential.	 	
 	O	The records are open for public inspection.	 	
 	C	The records are confidential and are not open to the public.	 	
 	PI	Personally identifiable information.	 	
 	NA	Not Applicable.	 	

DESCRIPTION
OF
RECORD	TYPE
OF
RECORD	LEGAL
AUTHORITY
FOR
CONFIDENTIALITY	PERSONALLY
IDENTIFIABLE
INFORMATION	LEGAL
AUTHORITY FOR PI
INFORMATION	
Record of Commission
and Statutory Committees	O/C	Iowa Code 21.5(4)	No	NA	
Rule Making	O	NA	No	NA	
Declaratory Rulings	O	NA	No	NA	
Rules and Policy Manuals	O	NA	No	NA	
State Plans	O	NA	No	NA	
Publications	O	NA	No	NA	
Statistical Reports	O	NA	No	NA	
Financial and Administrative
Records	O	NA	No	NA	
Contracts and Interagency
Agreements	O	NA	No	NA	
Grant Records
●	Title III
●	Title V
●	Discretionary
●	USDA
●	Title IV	O
O
O
O
O	NA
NA
NA
NA
NA	No
No
No
No
No	NA
NA
NA
NA
NA	
Program Records
●	Notice of Grant Awards
●	Senior Community Service Employment	O
O/C	NA
20 CFR
674.203b-3	No
Yes	NA
20 CFR
674.203b-3	
 	 	 	name
address
age
race
eligibility info.
area
medical info.
phone no.	 	
●	Elder Abuse
●	Retired Iowan
Employment
●	Elderlaw
●	Retired Senior Volunteer
●	Elderly Services
●	Insurance Information
●	Alzheimer’s Disease
●	JTPA
●	Long-Term Care
Coordinating Unit
●	Housing
●	Advocacy	O
O
O
O
O
O
O
O
O
O
O	NA
NA
NA
NA
NA
NA
NA
NA
NA
NA
NA	No
No
No
No
No
No
No
No
No
No
Yes	NA
NA
NA
NA
NA
NA
NA
NA
NA
NA
Iowa Code
231.23	
 	 	 	name
address	 	
●	Training Information	O	NA	Yes	Iowa Code
231.23	
 	 	 	name
address	 	
Care Review Committees	O	NA	Yes	Iowa Code 231.44	
 	 	 	name
address
county
PSA
phone no.
training info.	 	
Older Iowan Legislature	O	NA	Yes
name
address
PSA
district
phone no.	Iowa Code 231.23	
State Advisory Council	O	NA	Yes
name
address
phone no.
PSA	Iowa Code 231.23	
Ombudsman Complaints	C	Iowa Code
135C.37,
231.42	Yes	Iowa Code
135C.37
231.42	
 	 	name
address
county
facility
level of care lic.
administrator
patient pay status
complainant
complaint description cat.
receiver of complaint
investigator method & date
verification
scope of facility complaint	
Newsletter Mailing Lists,
Conference Lists, Interested
Individuals and Group Lists,
Resource Lists	O	NA	Yes
name
address
telephone no.	Iowa Code
231.23	

Centenarians Registry	O	NA	Yes
name
address
area
county
facility
phone no.
birth date
death date
sex	Iowa Code
231.23	
	9.18(1) Litigation files. These files or records contain information regarding litigation or anticipated litigation, which includes judicial and administrative proceedings. The records include briefs, depositions, docket sheets, documents, correspondence, attorney’s notes, memoranda, research materials, witness information, investigation materials, information compiled under the direction of the attorney, and case management records. The files contain materials which are confidential as attorney work product and attorney-client communications. Some materials are confidential under other applicable provisions of law or because of a court order. Persons wishing copies of pleadings and other documents filed in litigation should obtain them from the clerk of the appropriate court which maintains the official copy.
	9.18(2) Personnel files. The agency maintains files containing information about employees, families and dependents, and applicants for positions with the agency. The files include payroll records, biographical information, medical information relating to disability, performance reviews and evaluations, disciplinary information, information required for tax withholding, information concerning employee benefits, affirmative action reports, and other information concerning the employer-employee relationship. Some of this information is confidential under Iowa Code section 22.7(11).
[ARC 8489B, IAB 1/27/10, effective 1/7/10; Editorial change: IAC Supplement 6/28/23]
441—9.19(17A,22) Availability of records—volunteer service commission. This rule lists the agency records which are open to the public, those which are confidential, and those which are partially open and partially confidential.
Agency records are listed by category, according to the legal basis for confidential treatment (if any). The commission administers federally funded programs to enforce confidentiality standards for federal law and regulations as are required for receipt of the funds. A single record may contain information from several categories.
The chart indicates whether the record contains personally identifiable information and indicates the legal authority for confidentiality and for the collection of personally identifiable information.
Abbreviations used in the chart are defined as follows:

Code	Meaning	Code	Meaning	
O	Open for public inspection	O/C	Partially open and partially confidential	
C	Confidential/Not open to the public	O/E	Partially open to members of the public
and partially exempt from disclosure	
E	Exempt from mandatory disclosure	 		
NA	Not Applicable			

Description
of Record	 	Type of Record	 	Legal Authority
For Confidentiality	 	Personally Identifiable
Information	
 	 	 	 	 	 	 	 	
Records of Commission
and Committees	 	O/E	 	Iowa Code 21.5	 	No	
Rule Making	 	O	 	NA	 	No	
Declaratory Rulings	 	O/C	 	Iowa Code 22.7	 	No	
Policy Manuals	 	O	 	NA	 	No	
General Correspondence	 	O/E/C	 	Iowa Code 22.7	 	Yes	
Publications	 	O	 	NA	 	No	
Financial and Administrative
Records	 	O/E/C	 	Iowa Code 22.7	 	Yes	
 	 	 	 	 	 	 	 	
Contracts and Agreements	 	O/C	 	Iowa Code 22.7(3)	 	Yes	
Appeal Records	 	O/C	 	Iowa Code 22.7	 	Yes	
Litigation Files	 	O/E/C	 	Iowa Code 22.7	 	Yes	
Privileged Communications
and Products of Attorneys	 	E/C	 	Iowa Code 22.7	 	No	
[Editorial change: IAC Supplement 6/14/23]
441—9.20(17A,22) Personally identifiable information—public health programs. This rule describes the nature and extent of personally identifiable information which is collected, maintained, and retrieved by the department by personal identifiers in record systems as defined in rule 441—9.1(17A,22). For each record system, this rule describes the legal authority for the collection of that information and the means of storage of that information. A data processing system does not match, collate, or permit the comparison of personally identifiable information in one record system with personally identifiable information in another record system unless so indicated. The record systems maintained by the department are as follows:
	9.20(1) Public health program records.
	a. 	Records of reportable diseases and other diseases and health conditions collected pursuant to Iowa Code chapter 139A. These records are stored on paper, electronically, or both, depending on the specific type of record. Except for statistical reports, these records are confidential as outlined in 641—paragraph 175.13(2)“a.”
	b. 	Records of reportable sexually transmitted diseases or infections collected pursuant to Iowa Code chapter 139A. These records are stored on paper, electronically, or both, depending on the specific type of record. Except for statistical reports, these records are confidential as outlined in 641—paragraph 175.13(2)“b.”
	c. 	Records of the veterinary public health program collected pursuant to Iowa Code chapter 139A. These records are stored on paper. Certain medical information in these records may be confidential as outlined in 641—paragraph 175.13(2)“a.”
	d. 	Records of the emergency medical services program collected pursuant to Iowa Code chapter 147A. These records are stored on paper, electronically, or both, depending on the specific type of record. Some of these records are confidential as outlined in 641—paragraph 175.13(2)“a.”
	e. 	Records of the AIDS drug reimbursement program collected for purposes of implementing a federal grant program authorized by HR 1827. These records are stored on paper. Certain patient records are confidential as outlined in 641—paragraph 175.13(2)“a.”
	f. 	Personnel records containing information about employees, families and dependents, and applicants for positions with the department. Some of this information is confidential under Iowa Code sections 22.7(11) and 22.7(18).
	g. 	Records of the certificate of need program collected pursuant to Iowa Code sections 135.61 to 135.83. These records are stored on paper.
	h. 	Annual hospital surveys collected pursuant to Iowa Code sections 135.74 and 135.75. These records are stored on paper and electronically.
	i. 	Vital records collected pursuant to Iowa Code chapter 144, including records of births, deaths, fetal deaths, adoptions, marriages, divorces, annulments and related data and correspondence. These records are stored on paper, on microfiche, and electronically. These records are confidential as noted in 641—paragraph 175.13(2)“b.”
	j. 	Licensing records of the professional licensing boards. These records are identified in rules filed by the individual licensing boards (see Professional Licensure Division, IAC 645). They contain information about individuals, some of which is confidential.
	k. 	An electronic inventory of records maintained by the department, which indicates the type of information contained in the record, contact person for the record, how the record is stored, whether the record is confidential, and whether it contains personally identifiable information. This inventory is maintained by the information management bureau.
	l. 	Fiscal records, including itemized vouchers collected from individuals pursuant to Iowa Code section 8A.514. These records are stored on paper and electronically.
	m. 	Records of substance abuse programs of this division are identified in rules adopted by the board of health in 641—Chapter 155.
	n. 	Records of the domestic abuse death review team collected pursuant to Iowa Code section 135.110. These records are stored on paper, electronically, or both. Except for statistical reports, these records are confidential as outlined in 641—paragraph 175.13(2)“c.”
	o. 	Records which identify a person named in a report to the central registry for brain or spinal cord injuries collected pursuant to Iowa Code section 135.22. These records are stored on paper, electronically, or both. Except for statistical reports, these records are maintained as confidential pursuant to Iowa Code section 135.22 and rule 641—21.6(135).
	p. 	Records which identify brain injury service program recipients collected pursuant to Iowa Code section 135.22B. These records are stored on paper, electronically, or both.
	q. 	Records of the environmental health programs collected pursuant to Iowa Code section 135.11(1) and PL 96-510, Section 104(d)(1), 40 CFR 763 effective June 28, 1983, and 40 CFR 761 effective May 31, 1979, dealing with asbestos, PCB and other environmental health factors. These records are stored on paper, electronically, or both, depending on the specific type of record. Certain medical information in the work-related disease program file may be confidential as outlined in 641—paragraph 175.13(2)“d.” Certain asbestos and PCB inspection records are collected under contract with the federal Environmental Protection Agency, and requests for such records will be referred to that agency.
	r. 	Records of the radiological health program collected pursuant to Iowa Code chapters 136B and 136C. These records are stored on paper, electronically, or both, depending on the specific record. Certain of these records are confidential as outlined in 641—paragraph 175.13(2)“d.”
	s. 	Records of reportable diseases and other diseases and health conditions, including lead and other heavy metal poisonings, collected pursuant to Iowa Code chapter 139A. These records are stored on paper, electronically, or both, depending on the specific type of record. Except for statistical reports, these records are confidential as outlined in 641—paragraph 175.13(2)“a.”
	t. 	Records of the childhood lead poisoning prevention program collected pursuant to Iowa Code sections 135.100 to 135.105. These records are stored on paper, electronically, or both. Certain of these records are confidential as outlined in 641—paragraph 175.13(2)“d.” Data processing systems will link certain client data in these programs with client data in the maternal and child health program, WIC program, and refugee health program.
	u. 	Records of the maternal and child health programs collected pursuant to Iowa Code section 135.11(20). These records are stored on paper, electronically, or both, depending on the specific type of record. Data processing systems will link certain client data in these programs with client data in the WIC program.
	v. 	Records of the nutrition and WIC (supplemental food program for women, infants and children) programs collected pursuant to Iowa Code section 135.11(1) and Chapter 17 of the federal Child Nutrition Act of 1966 as amended. These records are stored on paper, electronically, or both, depending on the specific type of record. Data processing systems will link certain client data in this program with client data in maternal and child health programs.
	w. 	Records of the center for congenital and inherited disorders collected pursuant to Iowa Code chapter 136A. These records are stored on paper.
	x. 	Records of the dental health programs collected pursuant to Iowa Code section 135.11(19), funded primarily by maternal and child health funds. These records are stored on paper or electronically, depending on the specific type of record.
	y. 	Records of the newborn and infant hearing screening program collected pursuant to Iowa Code section 135.131. These records are stored on paper, electronically, or both, depending on the specific type of record. Information which identifies an individual patient is confidential as outlined in 641—paragraph 175.13(2)“e.”
	z. 	Refugee health program records collected pursuant to Iowa Code section 135.11(1) and Section 412(c)(3) of the federal Immigration and Naturalization Act. These records are stored on paper, electronically, or both, depending on the specific type of record. Certain medical information in these records is confidential as outlined in 641—paragraph 175.13(2)“f.”
	aa. 	Records of the bureau of chronic disease prevention and management collected pursuant to Iowa Code section 135.11(1), including the Well-Integrated Screening and Evaluation for Women Across the Nation (WISEWOMAN) program and the Breast and Cervical Cancer Early Detection Program (BCCEDP). Certain medical information in these records is confidential as outlined in 641—paragraph 175.13(2)“f.” The medical information from wellness programs and screening programs is stored on paper, electronically, or both, depending on the specific type of record. Data processing systems will link certain client data in these programs with client data in the University of Iowa’s health registries.
	9.20(2) Reserved.
[Editorial change: IAC Supplement 6/28/23]
These rules are intended to implement Iowa Code sections 17A.3, 22.11, 217.6 and 217.30, Iowa Code chapters 228 and 252G, and the Health Insurance Portability and Accountability Act of 1996.
[Filed emergency 11/25/75—published 12/15/75, effective 11/25/75]
[Filed 12/17/76, Notice 11/3/76—published 1/12/77, effective 2/16/77]
[Filed 9/6/79, Notice 7/11/79—published 10/3/79, effective 11/7/79]
[Filed 4/23/81, Notice 3/4/81—published 5/13/81, effective 6/17/81]
[Filed emergency 2/10/84—published 2/29/84, effective 2/10/84]
[Filed 3/4/85, Notice 12/19/84—published 3/27/85, effective 5/1/85]
[Filed 7/25/86, Notice 5/21/86—published 8/13/86, effective 10/1/86]
[Filed 11/14/86, Notice 10/8/86—published 12/3/86, effective 2/1/87]
[Filed emergency 1/15/87—published 2/11/87, effective 1/15/87]
[Filed 4/22/88, Notice 2/10/88—published 5/18/88, effective 7/1/88]
[Filed without Notice 12/8/88—published 12/28/88, effective 2/1/89]
[Filed emergency 6/29/89 after Notice 5/3/89—published 7/26/89, effective 7/1/89]
[Filed 10/10/89, Notice 8/23/89—published 11/1/89, effective 1/1/90]
[Filed 12/15/89, Notice 7/26/89—published 1/10/90, effective 3/1/90]
[Filed emergency 10/12/90 after Notice 8/22/90—published 10/31/90, effective 11/1/90]
[Filed 10/12/90, Notice 8/22/90—published 10/31/90, effective 1/1/91]
[Filed 12/13/90, Notice 10/31/90—published 1/9/91, effective 3/1/91]
[Filed emergency 6/14/91 after Notice 5/1/91—published 7/10/91, effective 7/1/91]
[Filed 8/12/93, Notice 6/23/93—published 9/1/93, effective 11/1/93]
[Filed 1/11/95, Notice 11/23/94—published 2/1/95, effective 4/1/95]
[Filed emergency 6/12/97—published 7/2/97, effective 7/1/97]
[Filed 9/16/97, Notice 7/2/97—published 10/8/97, effective 12/1/97]
[Filed 11/12/97, Notice 9/10/97—published 12/3/97, effective 2/1/98]
[Filed 8/12/98, Notice 6/17/98—published 9/9/98, effective 11/1/98]
[Filed 9/12/00, Notice 7/12/00—published 10/4/00, effective 12/1/00]
[Filed emergency 10/10/03—published 10/29/03, effective 11/1/03]
[Filed emergency 6/14/04—published 7/7/04, effective 7/1/04]
[Filed 9/23/04, Notice 7/7/04—published 10/13/04, effective 11/17/04]
[Filed 9/23/04, Notice 8/4/04—published 10/13/04, effective 11/17/04]
[Filed without Notice 5/4/05—published 5/25/05, effective 7/1/05]
[Filed 8/12/05, Notice 6/8/05—published 8/31/05, effective 11/1/05]
[Filed emergency 1/19/07—published 2/14/07, effective 1/20/07]
[Filed ARC 0420C (Notice ARC 0255C, IAB 8/8/12), IAB 10/31/12, effective 1/1/13]
[Filed ARC 1262C (Notice ARC 1045C, IAB 10/2/13), IAB 1/8/14, effective 3/1/14]
[Filed ARC 5305C (Notice ARC 5167C, IAB 9/9/20), IAB 12/2/20, effective 2/1/21]
[Filed ARC 5417C (Notice ARC 5274C, IAB 11/18/20), IAB 2/10/21, effective 4/1/21]
[Editorial change: IAC Supplement 6/14/23]
[Editorial change: IAC Supplement 6/28/23]
[Filed ARC 7711C (Notice ARC 7062C, IAB 8/23/23), IAB 3/6/24, effective 4/10/24]