CHAPTER 9
PUBLIC RECORDS AND FAIR INFORMATION PRACTICES
441—9.1(17A,22) Statement of policy, purpose and scope of chapter.
	9.1(1) The purpose of this chapter is to facilitate public access to open records. It also seeks to facilitate department determinations with respect to the handling of confidential records and the implementation of the fair information practices Act. The department is committed to the policies set forth in Iowa Code chapter 22; department staff shall cooperate with members of the public in implementing the provisions of that chapter.
These rules also implement the federal Health Insurance Portability and Accountability Act (HIPAA) regulations at 45 CFR Parts 160 and 164 as amended to March 26, 2013. These rules set forth the standards the department must meet to protect the privacy of protected health information. The department is a hybrid entity for purposes of HIPAA. The rules on protected health information apply only to those parts of the department that are considered part of the covered entity.
	9.1(2) This chapter does not:
	a. 	Require the agency to index or retrieve records which contain information about individuals by that person’s name or other personal identifier.
	b. 	Make available to the general public records which would otherwise not be available under the public records law, Iowa Code chapter 22.
	c. 	Govern the maintenance or disclosure of, notification of, or access to records in the possession of the agency which are governed by the rules of another agency.
	d. 	Apply to grantees, including local governments or subdivisions thereof, administering state-funded programs.
	e. 	Make available records compiled by the agency in reasonable anticipation of court litigation or formal administrative proceedings. The availability of such records to the general public or to any subject individual or party to such litigation or proceedings shall be governed by applicable constitutional principles, statutes, rules of discovery, evidentiary privileges, and applicable rules of the agency.
	f. 	Require the agency to create, compare or procure a record solely for the purpose of making it available.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.2(17A,22) Definitions. As used in this chapter:
“Business associate” means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Client” means a person who has applied for or received services or assistance from the department.
“Confidential record” in these rules means a record which is not available as a matter of right for examination and copying by members of the public under applicable provisions of law. Confidential records include records or information contained in records that the agency is prohibited by law from making available for examination by members of the public, and records or information contained in records that are specified as confidential by Iowa Code section 22.7, or other provision of law, but that may be disclosed upon order of a court, the lawful custodian of the record, or by another person duly authorized to release the record. Mere inclusion in a record of information declared confidential by an applicable provision of law does not necessarily make that entire record a confidential record.
“Covered entity” means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Custodian” means the director of the department or the director’s designee.
“Data aggregation” is the same as defined in 45 CFR §164.501 as amended to March 26, 2013.
“Designated record set” is the same as defined in 45 CFR §164.501 as amended to March 26, 2013, including:
	1.	The medical records about subjects that are maintained for facilities;
	2.	The enrollment, payment, and eligibility record systems maintained for Medicaid; or
	3.	The enrollment, payment, and eligibility record systems maintained for the hawki program that are used, in whole or in part, by the hawki program to make decisions about subjects.
For purposes of this definition, the term “record” means the same as defined in 45 CFR §164.501 as amended to March 26, 2013.
“Disclosure” means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Facility” or “facilities” means, with respect to HIPAA rules about health information, one or more of these department institutions: Cherokee Mental Health Institute, Glenwood Resource Center, Independence Mental Health Institute, and Woodward Resource Center.
“Health care” means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Health care clearinghouse” means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Health care operations” for covered entities in the department has the same definition as that stated in 45 CFR §164.501 as amended to March 26, 2013.
“Health care provider” means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Health information” means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Health oversight agency” means the same as defined in 45 CFR §164.501 as amended to March 26, 2013.
“Health plan” means an individual or group plan that provides or pays the cost of medical care, as defined at 45 CFR §160.103 as amended to March 26, 2013. In the department, “health plan” means Medicaid or hawki.
“HIPAA” means the Health Insurance Portability and Accountability Act of 1996.
“Law enforcement official” means an officer or employee of any agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe, who is empowered by law to:
	1.	Investigate or conduct an official inquiry into a potential violation of law; or
	2.	Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.
“Legal representative” is a person recognized by law as standing in the place or representing the interests of another for one or more purposes.
“Mental health information” means oral, written, or otherwise recorded information which indicates the identity of a person receiving professional services (as defined in Iowa Code section 228.1(8)) and which relates to the diagnosis, course, or treatment of the person’s mental or emotional condition.
“Open record” means a record other than a confidential record.
“Payment,” with respect protected health information, has the same definition as that stated in 45 CFR §164.501 as amended to March 26, 2013. In the department, “payment” applies to subjects for whom health care coverage is provided under the Medicaid program or the hawki program.
“Personally identifiable information” means information about or pertaining to the subject of a record which identifies the subject and which is contained in a record system.
“Personal representative” means someone designated by another as standing in the other’s place or representing the other’s interests for one or more purposes. The term “personal representative” includes, but is not limited to, a legal representative. For disclosure of protected health information, the definition of “personal representative” is more restrictive, as described at rule 441—9.15(17A,22).
“Protected health information” means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Psychotherapy notes” means the same as defined in 45 CFR §164.501 as amended to March 26, 2013.
“Public health authority” means the same as defined in 45 CFR §164.501 as amended to March 26, 2013.
“Record” means the whole or a part of a “public record” as defined in Iowa Code section 22.1 that is owned by or in the physical possession of the department.
“Record system” means any group of records under the control of the department from which a record may be retrieved by a personal identifier such as the name of a subject, number, symbol, or other unique identifier assigned to a subject.
“Subject” means the person who is the subject of the record, whether living or deceased.
“Substance abuse information” means information which indicates the identity, diagnosis, prognosis, or treatment of any person in an alcohol or drug abuse program.
“Transaction” means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Treatment” means the same as defined in 45 CFR §164.501 as amended to March 26, 2013.
“Use,” with respect to protected health information, means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
“Workforce,” with respect to protected health information, means the same as defined in 45 CFR §160.103 as amended to March 26, 2013.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.3(17A,22) Requests for access to records.
	9.3(1) Location of record. A request for access to a record should be directed to the Director’s Office, 321 East 12th Street, Des Moines, Iowa 50319. If a request for access to a record is misdirected, department personnel will promptly forward the request to the department’s records officer.
	9.3(2) Office hours. Open records shall be made available during all customary office hours, which are 8 a.m.	to 4:30 p.m.	daily, excluding Saturdays, Sundays and legal holidays.
	9.3(3) Request for access. Requests for access to open records may be made in writing, in person, or by telephone. Requests shall identify the particular records sought by name or description. Mail or telephone requests shall include the name, address, and telephone number of the person requesting the information.
	9.3(4) Response to requests. Access to an open record will be provided upon request unless the size or nature of the request makes prompt access infeasible. If the size or nature of the request for access to an open record requires time for compliance, the custodian shall comply with the request as soon as feasible. Access to an open record may be delayed for one of the purposes authorized by Iowa Code section 22.8(4) or 22.10(4).
The custodian of a record may deny access to the record by members of the public only on the grounds that such a denial is warranted under Iowa Code sections 22.8(4) and 22.10(4), or that it is a confidential record, or that its disclosure is prohibited by a court order. Access by members of the public to a confidential record is limited by law and, therefore, may generally be provided only in accordance with the provisions of rule 441—9.4(17A,22) and other applicable provisions of law.
	9.3(5) Security of record. No person may, without permission from the custodian, search or remove any record from department files. Examination and copying of department records shall be supervised by the custodian or a designee of the custodian. Records shall be protected from damage and disorganization.
	9.3(6) Copying. A reasonable number of copies of an open record may be made in the department office. If photocopy equipment is not available in the department office where an open record is kept, the custodian shall permit its examination in that office and shall arrange to have copies promptly made elsewhere.
	9.3(7) Fees. The department may charge fees as permitted by Iowa Code chapter 22. The department will publish a fee schedule for open records on its website. The department may charge a fee for the cost of preparing an explanation or summary of health information. The department and the subject requesting the information shall agree to the amount of any fee imposed before the department prepares the explanation or summary.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.4(17A,22) Access to confidential records. Under Iowa Code section 22.7 or other applicable provisions of law, the lawful custodian may disclose certain confidential records to one or more members of the public. Other provisions of law authorize or require the custodian to release specified confidential records under certain circumstances or to particular persons. In requesting the custodian to permit the examination and copying of such a confidential record, the following procedures apply and are in addition to those specified for requests for access to records in rule 441—9.3(17A,22).
	9.4(1) Proof of identity. A person requesting access to a confidential record may be required to provide proof of identity or authority to secure access to the record.
	9.4(2) Requests. The custodian may require a request to examine and copy a confidential record to be in writing. A person requesting access to such a record may be required to sign a certified statement or affidavit enumerating the specific reasons justifying access to the confidential record and to provide any proof necessary to establish relevant facts.
	9.4(3) Notice to subject of record and opportunity to obtain injunction. Except as provided in 441—subrule 175.41(2), after the custodian receives a request for access to a confidential record, and before the custodian releases such a record, the custodian may make reasonable efforts to notify promptly any person who is a subject of that record, is identified in that record, and whose address or telephone number is contained in that record. To the extent such a delay is practicable and in the public interest, the custodian may give the subject of such a confidential record to whom notification is transmitted a reasonable opportunity to seek an injunction under Iowa Code section 22.8, and indicate to the subject of the record the specific period of time during which disclosure will be delayed for that purpose.
	9.4(4) Request denied. When the custodian denies a request for access to a confidential record, the custodian shall promptly notify the requester. If the requester indicates to the custodian that a written notification of the denial is desired, the custodian shall promptly provide such a notification that is signed by the custodian and that includes:
	a. 	The name and title or position of the custodian responsible for the denial; and
	b. 	A citation to the provision of law vesting authority in the custodian to deny disclosure of the record and a brief statement of the reasons for the denial to this requester.
	9.4(5) Request granted. Except as provided in 441—subrule 175.41(2), when the custodian grants a request for access to a confidential record, the custodian shall notify the requester or the person who is to receive the information and include any limits on the examination and copying of the record.
	9.4(6) Records requiring special procedures. Special procedures are required for access to:
	a. 	Child abuse information. Access to child abuse information is obtained according to rules 441—175.41(235A) and 441—175.42(235A).
	b. 	Dependent adult abuse information. Access to adult abuse information is governed by rule 441—176.9(235A).
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.5(17A,22) Requests for treatment of a record as a confidential record and its withholding from examinations. The custodian may treat a record as a confidential record and withhold it from examination only to the extent that the custodian is authorized by Iowa Code section 22.7, another applicable provision of law, or a court order, to refuse to disclose that record to members of the public.
	9.5(1) Persons who may request. Any person who would be aggrieved or adversely affected by disclosure of a record and who asserts that Iowa Code section 22.7, another applicable provision of law, or a court order, authorizes the custodian to treat the record as a confidential record, may request the custodian to treat that record as a confidential record and to withhold it from public inspection.
	9.5(2) Request. A request that a record be treated as a confidential record and be withheld from public inspection shall be in writing and shall be filed with the custodian.
	a. 	The request must set forth the legal and factual basis justifying such confidential record treatment for that record, and the name, address, and telephone number of the person authorized to respond to any inquiry or action of the custodian concerning the request.
	b. 	A person requesting treatment of a record as a confidential record may also be required to sign a certified statement or affidavit stating the specific reasons justifying the treatment of that record as a confidential record and to provide any proof necessary to establish relevant facts.
	c. 	Requests to temporarily treat a record as a confidential record shall specify the precise period of time for which that treatment is requested.
	d. 	A person filing such a request shall, if possible, provide a copy of the record in question from which those portions for which such confidential record treatment has been requested have been deleted. If the original record is being submitted to the department by the person requesting confidential treatment at the time the request is filed, the person shall indicate conspicuously on the original record that all or portions of it are confidential.
	9.5(3) Failure to request. Failure of a person to request confidential record treatment for a record does not preclude the custodian from treating it as a confidential record. However, if a person who has submitted business information to the department does not request that it be withheld from public inspection under Iowa Code section 22.7(3) and 22.7(6), the custodian of records containing that information may proceed as if that person has no objection to its disclosure to members of the public.
	9.5(4) Timing of decision. A decision by the custodian with respect to the disclosure of a record to members of the public may be made when a request for its treatment as a confidential record that is not available for public inspection is filed, or when the custodian receives a request for access to the record by a member of the public.
	9.5(5) Request granted or deferred. If a request for such confidential record treatment is granted, or if action on such a request is deferred, a copy of the record from which the matter in question has been deleted and a copy of the decision to grant the request or to defer action upon the request will be made available for public inspection in lieu of the original record. If the custodian subsequently receives a request for access to the original record, the custodian will make reasonable and timely efforts to notify any person who has filed a request for its treatment as a confidential record that is not available for public inspection of the pendency of that subsequent request.
	9.5(6) Request denied and opportunity to seek injunction. If a request that a record be treated as a confidential record and be withheld from public inspection is denied, the custodian shall notify the requester in writing of that determination and the reasons therefor. On application by the requester, the custodian may engage in a good faith, reasonable delay in allowing examination of the record so that the requester may seek injunctive relief under the provisions of Iowa Code section 22.8, or other applicable provision of law. However, such a record shall not be withheld from public inspection for any period of time if the custodian determines that the requester had no reasonable grounds to justify the treatment of that record as a confidential record. The custodian shall notify requester in writing of the time period allowed to seek injunctive relief or the reasons for the determination that no reasonable grounds exist to justify the treatment of that record as a confidential record. The custodian may extend the period of good faith, reasonable delay in allowing examination of the record so that the requester may seek injunctive relief only if no request for examination of that record has been received, or if a court directs the custodian to treat it as a confidential record, or to the extent permitted by another applicable provision of law, or with the consent of the person requesting access.
	9.5(7) Requesting privacy protection for protected health information.
	a. 	Requesting restrictions on protected health information use or disclosure. Subjects may complete a Request to Restrict Use or Disclosure of Health Information form. The department will follow the requirements of 45 CFR §164.522 as amended to March 26, 2013, in responding to these requests.
	b. 	Requesting the receipt of communications of protected health information by alternative means or at alternative locations. Subjects may complete a Request to Change How Health Information Is Provided form. The department will follow the requirements of 45 CFR §164.522 as amended to March 26, 2013, in responding to these requests. For Medicaid and hawki, the subject is required to clearly indicate the reason for requesting the confidential communication. Facilities shall not require the subject to explain the basis for the request as a condition of providing confidential communications.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.6(17A,22) Procedure by which additions, dissents, or objections may be entered into certain records.
	9.6(1) All programs. Except as otherwise provided by law, a subject may file a request with the custodian to review, and to have a written statement of additions, dissents, or objections entered into, a record containing personally identifiable information pertaining to that subject. However, the subject is not authorized to alter the original copy of the record or to expand the official record of any department proceeding.
	a. 	The subject shall send the request to review such a record or the written statement of additions, dissents, or objections to the department.
	b. 	The request to review such a record or the written statement of additions, dissents, or objections must be dated and signed by the subject, and shall include the current address and telephone number of the subject or the subject’s representative.
	9.6(2) Additional procedures for protected health information. The department will follow the protected health information right to amend standards as outlined in 45 CFR §164.526 as amended to March 26, 2013. A subject shall submit a request for amendment to the department on a Request to Amend Health Information form published on the department’s website. The subject shall provide a reason to support the requested amendment.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.7(17A,22,228) Consent to disclosure by the subject of a confidential record. To the extent permitted by any applicable provision of law, the subject of a confidential record may have a copy of the portion of that record concerning the subject disclosed to a third party. A request for such a disclosure must be in writing and must identify the particular record or records to be disclosed, the particular person or class of persons to whom the record may be disclosed, and the time period during which the record may be disclosed. The subject of the record and, where applicable, the person to whom the record is to be disclosed may be required to provide proof of identity. Appearance of counsel before the department on behalf of a person who is the subject of a confidential record is deemed to constitute consent for the department to disclose records about that person to the person’s attorney. No confidential information about clients of the department shall be released without the client’s consent, except as otherwise provided by law. Release of confidential information includes granting access to or allowing the copying of a record, providing information either in writing or orally, or acknowledging information to be true or false.
	9.7(1) Release forms.
	a. 	Releases allowing the department to provide confidential information. Subjects should complete the Authorization for the Department to Release Information for releases that do not involve protected health information.
	b. 	Releases allowing the department to provide confidential information, including protected health information. When consent or authorization for use or disclosure of health information is required, the department shall use Form 470-3951, Authorization to Obtain or Release Health Care Information, or a HIPAA authorization form from another source that meets HIPAA requirements. The department shall not require a subject to sign a HIPAA authorization form as a condition of treatment, payment, enrollment in a health plan, or eligibility for benefits. The department as a health care provider may require a subject to sign a HIPAA authorization form for the use or disclosure of protected health information for research, as a condition of the subject’s receiving research-related treatment. A subject may revoke a HIPAA authorization at any time, provided that the revocation is in writing using the Request to End an Authorization form, except to the extent that the department has taken action in reliance thereon.
	(2)	Except as provided in subparagraph 9.7(1)“c”(1), department staff shall release mental health or substance abuse information only with authorization on the Consent to Obtain and Release Information form, a form from another source that meets requirements of law, or as otherwise allowed by law.
	c. 	Releases allowing the department to obtain confidential information from a third party. The department is required to obtain confidential information from third parties. The department may make these requests only when the client has authorized the release on one of the following forms or when otherwise provided by law:
	(1)	Authorization for Release of Information.
	(2)	Household Member Questionnaire.
	(3)	Bank or Credit Union Information.
	(4)	Addendum for Application and Review Forms for Release of Information.
	(5)	Request for School Verification.
	(6)	Employer’s Statement of Earnings.
	(7)	Verification of Educational Financial Aid.
	(8)	Financial Institution Verification.
	(9)	Authorization to Obtain or Release Health Care Information.
	d. 	Releases for photographs and recordings. The department uses Authorization to Take and Use Photographs, and Authorization to Take and Use Photographs of Minor or Ward forms, for permission to use photographs in department publications. The department shall obtain authorization from the subject or person responsible (such as a guardian, custodian, or personal representative) for the subject before taking photographs or making any type of recording for any purpose other than those specifically allowed by law or for internal use within an institution.
	9.7(2) Exceptions to use of release forms.
	a. 	Public official. A letter from the subject to a public official which seeks the official’s intervention on behalf of the subject in a matter that involves the department shall be treated as an authorization to release information upon receipt of appropriate authorization from the client to do so. The department shall release only the minimum amount of information necessary about the subject to the official to resolve the matter.
	b. 	Medical emergency. Department staff may authorize release of confidential information to medical personnel in a medical emergency if the subject is unable to give or withhold consent. As soon as possible after the release of information, the subject shall be advised of the release.
	c. 	Abuse information. Consent to release information is not required to gather information for investigations of child abuse or dependent adult abuse.
	9.7(3) Opportunity for subject to agree or object. This subrule describes when the department may use or disclose protected health information, without a written authorization, to persons involved in the subject’s care and for notification purposes. However, the department shall give the subject an opportunity to agree or object, unless this requirement is waived as specified in paragraph 9.7(3)“e.”
	a. 	Involvement in the subject’s care. The department may, in accordance with paragraphs 9.7(3)“c,”“e,” and “f,” disclose protected health information that is directly relevant either to a subject’s care or to payment related to the subject’s care, provided payment is relevant to the person’s involvement in the subject’s care. The person involved must be:
	(1)	A family member;
	(2)	Another relative;
	(3)	A close personal friend of the subject; or
	(4)	Any other person identified by the subject.
	b. 	Notification purposes. The department may use or disclose protected health information to notify, or assist in notifying, identifying or locating a family member, a personal representative of the subject, or another person responsible for the care of the subject of the subject’s location, general condition or death. For disaster relief purposes, the use or disclosure shall be in accordance with paragraph 9.7(3)“f.”
	c. 	Uses and disclosures with the subject present. If the subject is present for, or available before, a use or disclosure permitted by this subrule and has the capacity to make health care decisions, the department may use or disclose the protected health information if the department:
	(1)	Obtains the subject’s agreement;
	(2)	Provides the subject with the opportunity to object to the disclosure, and the subject does not express an objection; or
	(3)	Reasonably infers from the circumstances, based on the exercise of professional judgment, that the subject does not object to the disclosure.
	d. 	Informing the subject. The department may orally inform the subject of and obtain the subject’s oral agreement or objection to a use or disclosure permitted by this subrule.
	e. 	Limited uses and disclosures when the subject is not present. When the subject is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the subject’s incapacity or an emergency circumstance, the department may, in the exercise of professional judgment, determine that disclosure is in the best interest of the subject.
	(1)	When the department determines that disclosure is in the subject’s best interest, the department may disclose only the protected health information that is directly relevant to the person’s involvement with the subject’s health care.
	(2)	The department may use professional judgment and its experience with common practice to make reasonable inferences of the subject’s best interest in allowing a person to act on behalf of the subject to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of protected health information.
	f. 	For disaster relief purposes. The department may use protected health information or disclose protected health information to a public or private organization authorized by law or by its charter to assist in disaster relief efforts for the purpose of coordinating with these organizations the uses or disclosures permitted by paragraph 9.7(3)“b.” The requirements in paragraphs 9.7(3)“c” and “d” apply to these uses and disclosures to the extent that the department, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.8(17A,22) Notice to suppliers of information. When the department requests a person to supply information about that person, the department shall notify the person of how the information will be used, which persons outside the department might routinely be provided this information, which parts of the requested information are required and which are optional, and the consequences of a failure to provide the information requested. This notice may be given in these rules, on the written form used to collect the information, on a separate fact sheet or letter, in brochures, in formal agreements, in contracts, in handbooks, in manuals, verbally, or by other appropriate means. The notice shall generally be given at the first contact with the department and need not be repeated. Where appropriate, the notice may be given to a person’s legal or personal representative. Notice may be withheld in an emergency or where it would compromise the purpose of a department investigation.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.9(17A,22) Release to subject.
	9.9(1) Access by subjects to protected health information. The department will follow the access of individuals to protected health information standards as outlined in 45 CFR §164.524 as amended to February 6, 2014. Subjects shall submit all requests for access to the department using the Request for Access to Health Information form. If the department does not maintain the protected health information that is the topic of the subject’s request for access, and the department knows where the requested information is maintained, the department shall inform the subject where to direct the request for access.
	9.9(2) Reserved.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.10(17A,22) Use and disclosure without consent of the subject. Open records are routinely disclosed without the consent of the subject. To the extent allowed by law, the department may also use and disclose confidential information without the consent of the subject or the subject’s representative.
	9.10(1) Internal use. Confidential information may be disclosed to employees and agents of the department as needed for the performance of their duties. The custodian of the record shall determine what constitutes legitimate need to use confidential records.
	9.10(2) Audits and health oversight activities.
	a. 	Audits. Information concerning program expenditures and client eligibility is released to staff of the state executive and legislative branches who are responsible for ensuring that public funds have been managed correctly. Information is also released to auditors from federal agencies when those agencies provide program funds.
	b. 	Health oversight activities. The department will follow the uses and disclosures standards for health oversight activities as outlined in 45 CFR §164.512 as amended to January 6, 2016.
	9.10(3) Program review. Information concerning client eligibility and benefits is released to state or federal officials responsible for determining whether the department is operating a program lawfully. These officials include the ombudsman office under Iowa Code section 2C.9, the auditor of state under Iowa Code section 11.2, the Office of Inspector General in the federal Department of Health and Human Services, and the Centers for Medicare and Medicaid Services.
	9.10(4) Contracts and agreements with agencies and persons.
	a. 	The department may enter into contracts or agreements with public or private agencies to carry out the department’s official duties or as necessary to administer a program within the other agency. Information necessary to carry out these duties may be shared with these agencies. The department may disclose protected health information to a business associate and may allow a business associate to create or receive protected health information on its behalf if the department obtains satisfactory assurance that the business associate will appropriately safeguard the information.
	b. 	The department may enter into agreements to share information with agencies administering federal or federally assisted programs which provide assistance or services directly to persons on the basis of need. Only information collected in the family investment program, the child care assistance program, the food assistance program, the refugee resettlement program, or the child support recovery program may be shared under these agreements.
	c. 	To meet federal income and eligibility verification requirements, the department has entered into agreements with the department of workforce development, the United States Internal Revenue Service, and the United States Social Security Administration. The department obtains information regarding persons whose income or resources are considered in determining eligibility and the amount of benefits for the family investment program, refugee cash assistance, child care assistance, food assistance, Medicaid, state supplementary assistance and foster care. Identifying information regarding clients of these programs is released to these agencies. The information received may be used for eligibility and benefit determinations.
	d. 	To meet federal requirements under the Immigration Reform and Control Act of 1986 (IRCA) relating to the Systematic Alien Verification for Entitlements (SAVE) program, the department has entered into an agreement with the Bureau of Citizenship and Immigration Service (BCIS). Under the agreement, the department exchanges information necessary to verify alien status for the purpose of determining eligibility and the amount of benefits for the family investment program, refugee cash assistance, food assistance, Medicaid, state supplementary assistance and foster care assistance. Identifying information regarding these subjects is released to the BCIS. The information received may be used for eligibility and benefit determinations.
	e. 	The department has entered into an agreement with the department of workforce development to provide services to family investment program clients participating in the PROMISE JOBS program as described at 441—Chapter 93. Information necessary to carry out these duties shall be shared with the department of workforce development, as well as with its subcontractors.
	f. 	The department has entered into an agreement with the department of education, vocational rehabilitation, disability determination services, to assist with Medicaid disability determinations.
	g. 	The department has entered into an agreement with the department of education to share information that assists both schools and department clients in carrying out the annual verification process required by the United States Department of Agriculture, Food and Nutrition Service. That federal agency requires the department of education and local schools to verify eligibility of a percentage of the households approved for free-meal benefits under the school lunch program. When a department office receives a written request from the local school, the department office responds in writing with the current family investment program and food assistance program status of each recipient of free meals listed in the request. Other client-specific information is made available only with written authorization from the client.
	9.10(5) Release for judicial and administrative proceedings. Information is released to the court as required in Iowa Code sections 125.80, 125.84, 125.86, 229.8, 229.10, 229.13, 229.14, 229.15, 229.22, 232.48, 232.49, 232.52, 232.71B, 232.81, 232.97, 232.98, 232.102, 232.111, 232.117 and 235B.3.
	a. 	The department may disclose protected health information in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal, provided that the department discloses only the protected health information expressly authorized by the order and the court makes the order knowing that the information is confidential.
	b. 	When a court subpoenas information that the department is prohibited from releasing, the department shall advise the court of the statutory and regulatory provisions against disclosure of the information and shall disclose the information only on order of the court.
	9.10(6) Fraud. Information concerning suspected fraud or misrepresentation to obtain department services or assistance is disclosed to the department of inspections, appeals, and licensing and to law enforcement authorities.
	9.10(7) Service referrals. Information concerning clients may be shared with purchase of service providers under contract to the department.
	a. 	Information concerning the client’s circumstances and need for service is shared with prospective providers to obtain placement for the client. If the client is not accepted for service, all written information released to the provider shall be returned to the department.
	b. 	When the information needed by the provider is mental health information or substance abuse information, the subject’s specific consent is required.
	9.10(8) Medicaid billing. Only the following information shall be released to bona fide providers of medical services in the event that the provider is unable to obtain it from the subject and is unable to complete the Medicaid claim form without it:
	a. 	Patient identification number.
	b. 	Health coverage code as reflected on the subject’s medical card.
	c. 	The subject’s date of birth.
	d. 	The subject’s eligibility status for the month that the service was provided.
	e. 	The amount of spenddown.
	f. 	The bills used to meet spenddown.
	9.10(9) Reserved.
	9.10(10) Child support recovery. The child support recovery unit has access to information from most department records for the purpose of establishing and enforcing support obligations. Information about absent parents and recipients of child support services is released according to the provisions of Iowa Code chapters 234, 252A, 252B, 252C, 252D, 252E, 252F, 252G, 252H, 252I, 252J, 252K, 598, and 600B and any other support chapter. Information is also released to consumer reporting agencies as specified in rule 441—98.116(252B).
	9.10(11) Refugee resettlement program. Contacts with both sponsor and resettlement agencies are made as a part of the verification process to determine eligibility or the amount of assistance. When a refugee applies for cash or Medicaid, the refugee’s name, address, and telephone number are given to the refugee’s local resettlement agency.
	9.10(12) Abuse investigation. The central abuse registry disseminates child abuse information and dependent adult abuse information as provided in Iowa Code sections 235A.15 and 235B.7, respectively. Reports of child abuse and dependent adult abuse investigations are submitted to the county attorney as required in Iowa Code sections 232.71B and 235B.3. Results of the investigation of a report by a mandatory reporter are communicated to the reporter as required in Iowa Code sections 235A.17(2) and 235A.15(2)“b”(5).
	9.10(13) Foster care. Information concerning a child’s need for foster care is shared with foster care review committees or foster care review boards and persons named in the case permanency plan.
	9.10(14) Adoption. Adoptive home studies completed on families who wish to adopt a child are released to licensed child-placing agencies, to the United States Immigration and Naturalization Service, and to adoption exchanges. Information is released from adoption records as provided in Iowa Code sections 600.16 and 600.24.
	9.10(15) Disclosures to law enforcement.
	a. 	Disclosures by workforce members who are crime victims. The department is not considered to have violated the requirements of this chapter if a member of its workforce who is the victim of a criminal act discloses confidential information to a law enforcement official, provided that:
	(1)	The confidential information disclosed is about the suspected perpetrator of the criminal act and intended for identification and location purposes; and
	(2)	The confidential information disclosed is limited to the following information:
	1.	Name and address.
	2.	Date and place of birth.
	3.	Social security number.
	4.	ABO blood type and Rh factor.
	5.	Type of injury.
	6.	Date and time of treatment.
	7.	Date and time of death, if applicable.
	8.	A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos.
	b. 	Crime on premises. The department may disclose to a law enforcement official protected health information that the department believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the department.
	c. 	Decedents. The department may disclose protected health information to a law enforcement official about a subject who has died when the death resulted from child abuse or neglect or the death occurred in a department facility.
	d. 	Other. The department may disclose confidential information to a law enforcement official when otherwise required or allowed by this chapter, such as disclosures about victims of child abuse or neglect; disclosures to avert a threat to health or safety, or to report suspected fraud; disclosures required by due process of law, such as disclosures for judicial and administrative proceedings; or other disclosures required by law.
	9.10(16) Response to law enforcement. The address of a current recipient of family investment program benefits may be released upon request to a federal, state or local law enforcement officer if the officer provides the name of the recipient, and the officer demonstrates that:
	a. 	The recipient is a fugitive felon who is fleeing prosecution, custody or confinement after conviction under state or federal law, or who is a probation or parole violator under state or federal law, or
	b. 	The recipient has information that is necessary for the officer to conduct the officer’s official duties, and
	c. 	The location or apprehension of the recipient is within the officer’s official duties.
	9.10(17) Research. Disclosure is made to employees of federal, state and local agencies and other researchers for purposes of bona fide research. The department shall not release data or information pursuant to this paragraph unless the department and the researcher have executed an agreement that includes the conditions under which the confidential data or information may be used and restrictions on further disclosure of the data or information.
	a. 	Mental health information may be disclosed for purposes of scientific research as provided in Iowa Code sections 228.5 and 229.25. Requests to do research involving records of a department facility shall be approved by the designated authority.
	b. 	Abuse registry information may be disclosed for research purposes as provided in rules 441—175.42(235A) and 441—176.12(235B) and authorized by Iowa Code sections 235A.15(2)“e”(1) and 235B.6(2)“e”(1).
	c. 	For research relating to protected health information, the researcher shall provide the department with information about the nature of the research, the protocol, the type of information being requested, and any other relevant information that is available concerning the request. If the researcher feels that contact with the subject is needed, the researcher shall demonstrate to the department that the research cannot be conducted without contact with the subject. The researcher shall pay for the costs of obtaining authorizations needed to contact the subjects and for the cost of files and preparation needed for the research.
	9.10(18) Threat to health or safety.
	a. 	All programs. A client’s name, identification, location, and details of a client’s threatened or actual harm to department staff or property may be reported to law enforcement officials. Other information regarding the client’s relationship to the department shall not be released. When a department staff person believes a client intends to harm someone, the staff person may warn the intended victim or police or both. Only the name, identification, and location of the client and the details of the client’s plan of harm shall be disclosed.
	b. 	Protected health information. The department will follow the disclosure standards in 45 CFR §164.512 as amended to January 6, 2016.
	9.10(19) Required by law.
	a. 	Information is shared with other agencies without a contract or written agreement when federal law or regulations require it.
	b. 	The department may use or disclose protected health information to the extent that use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of the law.
	c. 	State law shall preempt rules in this chapter about protected health information when any one of the following conditions exists:
	(1)	Exception granted by Secretary of Health and Human Services under 45 CFR §160.204 as amended to March 26, 2013.
	(2)	State law more stringent. The provision of state law relates to the privacy of protected health information and is more stringent than a requirement of this chapter, within the meaning of “more stringent” found at 45 CFR §160.202 as amended to March 26, 2013.
	(3)	Reporting requirements. The provision of state law, including state procedures established under the law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention.
	(4)	Requirements related to audits, monitoring, evaluation, licensing, and certification. The provision of state law requires a health plan to report, or to provide access to, information for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities and persons.
	9.10(20) Treatment, payment, or health care operations.
	a. 	The department may use or disclose protected health information for treatment, payment, or health care operations, as permitted by 45 CFR §164.506 as amended to January 25, 2013, except for psychotherapy notes, which are subject to the limits described in paragraph 9.10(21)“b.” The use or disclosure shall be consistent with other applicable requirements of this chapter.
	b. 	The department may use or disclose psychotherapy notes without an authorization for any one of the following reasons:
	(1)	To carry out the following treatment, payment, or health care operations:
	1.	Use by the originator of the psychotherapy notes for treatment.
	2.	Use or disclosure by the department for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling.
	3.	Use or disclosure by the department to defend itself in a legal action or other proceeding brought by the subject.
	(2)	When required by the Secretary of Health and Human Services to investigate or determine the department’s compliance with federal HIPAA regulations.
	(3)	For health oversight activities with respect to the oversight of the originator of the psychotherapy notes.
	(4)	When necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public as described in this chapter.
	(5)	When required by law as described in this chapter.
	(6)	To disclose protected health information in the designated record set to a coroner or medical examiner as described in this chapter.
	9.10(21) Other uses and disclosures for which an authorization or opportunity to agree or object is not required. The department may use or disclose protected health information for which an authorization or opportunity to agree or object is not required, as permitted by 45 CFR §164.512 as amended to January 25, 2013.
	9.10(22) Victims of domestic violence. The department shall disclose confidential information about an individual whom the department reasonably believes to be a victim of domestic violence when required by state law.
	9.10(23) Whistle blowers. The department is not considered to have violated the requirements of this chapter when a member of its workforce or a business associate discloses protected health information, provided that:
	a. 	The workforce member or business associate has a good-faith belief that the department or a business associate has engaged in conduct that is unlawful or otherwise violates professional or clinical standards, or has provided care, services, or conditions that potentially endanger one or more patients, workers, or the public; and
	b. 	The disclosure is made to one of the following:
	(1)	A health oversight agency or public health authority authorized by law to investigate or oversee conduct or conditions for the purpose of reporting the allegation of failure to meet professional standards or misconduct.
	(2)	An appropriate health care accreditation organization.
	(3)	An attorney retained by or on behalf of the workforce member or business associate for the purpose of determining the legal options of the workforce member or business associate.
	9.10(24) Secondary to a use or disclosure of protected health information. The department may use or disclose protected health information that is secondary to a use or disclosure otherwise permitted or required by these rules, such as when a visitor in a facility overhears a doctor speaking to a subject about the subject’s health.
	9.10(25) De-identified data or a limited data set. The department may use or disclose protected health information to create information that is de-identified or a limited data set under the conditions specified in 45 CFR §164.514 as amended to August 14, 2002.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.11(22) Availability of records.
	9.11(1) Open records. Department records are open for public inspection and copying unless otherwise provided by rule or law.
	9.11(2) Confidential records. Iowa Code chapters governing the operations of the department establish the confidential nature of many department records. The department also administers several federally funded programs and is authorized by Iowa Code section 22.9 to enforce confidentiality standards from federal law and regulation as required for receipt of the funds where the department has determined that the right to examine and copy public records under Iowa Code section 22.2 would cause the denial of funds, services, or essential information from the United States government that would otherwise be available to the department.
	9.11(3) Authority to release confidential records. The department may have discretion to disclose some confidential records that are exempt from disclosure under Iowa Code section 22.7 or other provision of law.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.12(22,252G) Personally identifiable information. The nature and extent of personally identifiable information collected by the department varies by the type of record. This rule describes personally identifiable information collected, maintained, and retrieved by the department by personal identifiers in record systems and the legal authority for the collection of that information. This rule also identifies the legal authority for keeping some or all of the collected personally identifiable information confidential.
	9.12(1) Department administrative records.
	a. 	Personnel records. These records contain information about employees, families and dependents, and applicants for positions with the department. Some of this information is confidential under Iowa Code section 22.7(11) and 22.7(18).
	b. 	Fiscal records. These records contain itemized vouchers collected from individuals pursuant to Iowa Code section 8A.514. Some of this information is confidential under Iowa Code section 22.7(11) and 22.7(18).
	c. 	Litigation files. These files or records contain information regarding litigation or anticipated litigation, which includes judicial and administrative proceedings. The records include briefs, depositions, docket sheets, documents, correspondence, attorney’s notes, memoranda, research materials, witness information, investigation materials, information compiled under the direction of the attorney, and case management records. The files contain materials that are confidential as attorney work product and attorney-client communications. Some materials are confidential under other applicable provisions of law or because of a court order. Persons wishing copies of pleadings and other documents filed in litigation should obtain them from the clerk of the appropriate court that maintains the official copy. These records are confidential as outlined in Iowa Code sections 217.30, 22.7(4) and 622.10.
	9.12(2) Program records.
	a. 	Adoption investigator certification. These records are collected pursuant to Iowa Code chapter 600.
	b. 	Adoption program records. These records are collected pursuant to Iowa Code sections 600.8 and 600.16. These records are confidential as outlined in Iowa Code sections 600.16 and 600.24.
	c. 	Appeals. These records are collected pursuant to Iowa Code section 217.1. Some of these records are confidential as outlined in Iowa Code section 217.1.
	d. 	AIDS drug reimbursement program. These records are collected for purposes of implementing a federal grant program authorized by HR 1827. Certain patient records are confidential as outlined in Iowa Code section 141A.9.
	e. 	Brain injury service program recipients. These records are collected pursuant to Iowa Code section 135.22B. These records are confidential as outlined in Iowa Code section 135.22(2).
	f. 	Center for congenital and inherited disorders. These records are collected pursuant to Iowa Code chapter 136A. These records are confidential as outlined in Iowa Code section 136A.7.
	g. 	Central registry for brain or spinal cord injuries. These records are collected pursuant to Iowa Code section 135.22. Except for statistical reports, these records are maintained as confidential pursuant to Iowa Code section 135.22.
	h. 	Child abuse program. These records are collected pursuant to Iowa Code section 235A.14. These records are confidential as outlined in Iowa Code sections 235A.13, 235A.15, 235A.16, and 235A.17.
	i. 	Childcare assistance client records. These records are collected pursuant to Iowa Code section 237A. These records are confidential as outlined in Iowa Code section 237A.13.
	j. 	Childcare facility licensing. These records are collected pursuant to Iowa Code chapter 237A. Some of these records are confidential as outlined in Iowa Code section 237A.7.
	k. 	Childhood lead poisoning prevention program. These records are collected pursuant to Iowa Code sections 135.100 to 135.105. Certain of these records are confidential as outlined in Iowa Code chapter 139A.
	l. 	Child support recovery program. These records are collected pursuant to Iowa Code chapters 252A, 252B, 252C, 252D, 252E, 252F, 252G, 252H, 252I, 252J, and 252K and Iowa Code sections 144.13, 144.26, 232.147, 234.39, 595.4, 598.22B and 600.16A. These records are confidential as outlined in Iowa Code sections 252B.9 and 252G.5, 42 U.S.C. §654(26), 42 U.S.C. §654a(d), 45 CFR §303.21 and 307.13.
	m. 	Chronic disease prevention and management programs. These records are collected pursuant to Iowa Code section 135.11(1). Certain medical information in these records is confidential as outlined in Iowa Code section 22.7(2).
	n. 	Collection service center payment. These records are collected pursuant to Iowa Code sections 252B.9, 252B.13A and 252B.16. These records are confidential as outlined in Iowa Code section 252B.9(2), 42 U.S.C. §654a(d) and 45 CFR §307.13.
	o. 	Criminal and juvenile justice information. These records are collected pursuant to Iowa Code sections 216A.136 and 216A.138 and through interagency agreements.
	p. 	Dental health program. These records are collected pursuant to Iowa Code section 135.11(19). Certain medical information in these records is confidential as outlined in Iowa Code section 22.7(2).
	q. 	Dependent adult abuse program. These records are collected pursuant to Iowa Code section 235B.1. These records are confidential as outlined in Iowa Code section 235B.1.
	r. 	Domestic abuse death review team. These records are collected pursuant to Iowa Code section 135.110. These records are confidential as outlined in Iowa Code section 135.11.
	s. 	Emergency medical services. These records are collected pursuant to Iowa Code chapter 147A.
	t. 	Environmental health program. These records are collected pursuant to Iowa Code section 135.11(1) and PL 96-510, Section 104(d)(1), 40 CFR 763 effective June 28, 1983, and 40 CFR 761 effective May 31, 1979, dealing with asbestos, PCB and other environmental health factors. Certain medical information in the work-related disease program file may be confidential as outlined in Iowa Code section 22.7(2). Certain asbestos and PCB inspection records are collected under contract with the federal Environmental Protection Agency, and requests for such records will be referred to that agency.
	u. 	Family investment program client records. These records are collected pursuant to Iowa Code section 234.6. These records are confidential as outlined in Iowa Code section 217.30 and 42 U.S.C. §602(a)(1) and §1306a.
	v. 	Food assistance client files. These records are collected pursuant to Iowa Code section 234.6. These records are confidential as outlined in Iowa Code section 217.30, 7 U.S.C. §2020(e)8 and 7 CFR 272.1(c) and (d) as amended to January 1, 1987.
	w. 	Foster care client/service files. These records are collected pursuant to Iowa Code sections 237.3 to 237.5. These records are confidential as outlined in Iowa Code section 237.9.
	x. 	Foster care facility licensing. These records are collected pursuant to Iowa Code chapter 237. Some of these records are confidential as outlined in Iowa Code section 237.9.
	y. 	Foster care review board files. These records are collected pursuant to Iowa Code section 237.17. Some of these records are confidential as outlined in Iowa Code section 237.21.
	z. 	Hawki client files. These records are collected pursuant to Iowa Code section 514I.4. These records are confidential as outlined in Iowa Code section 514I.4, and 42 CFR §457.1110 as amended to January 1, 2001.
	aa. 	Human rights advocacy files. These records are collected pursuant to Iowa Code chapter 216A; the Omnibus Budget Reconciliation Act, P.L.	97-35; Juvenile Justice and Delinquency Prevention Act, P.L.	93-415; and the Victims Compensation and Assistance Act, P. L.	98-473. These records are confidential as outlined in Iowa Code section 22.7(18).
	bb. 	Long term and managed care ombudsman complaints. These records are collected pursuant to Iowa Code sections 135C.37 and 231.42. These records are confidential as outlined in Iowa Code sections 135C.37 and 231.42.
	cc. 	Maternal and child health program. These records are collected pursuant to Iowa Code section 135.11(20). Records that contain medical information are confidential pursuant to Iowa Code section 22.7(2).
	dd. 	Medicaid clients. These records are collected pursuant to Iowa Code section 249A.4. These records are confidential as outlined in Iowa Code section 217.30, 42 U.S.C. §1396a(7), and 42 CFR §431.300 to 307 as amended to November 13, 1996.
	ee. 	Medicaid provider information. These records are collected pursuant to Iowa Code section 249A.4. Some of these records are confidential as outlined in Iowa Code section 217.30, 42 U.S.C. §1396a(7), and 42 CFR §431.300 to 307 as amended to November 13, 1996.
	ff. 	Newborn and infant hearing screening program. These records are collected pursuant to Iowa Code section 135.131. Information which identifies an individual patient is confidential as outlined in Iowa Code section 135.131.
	gg. 	Nutrition and WIC (supplemental food program for women, infants and children) program. These records are collected pursuant to Iowa Code section 135.11(1) and Chapter 17 of the federal Child Nutrition Act of 1966 as amended. These records are confidential as outlined in 7 CFR 246 and Iowa Code section 22.7(2).
	hh. 	Radiological health program. These records are collected pursuant to Iowa Code chapters 136B and 136C. Certain of these records are confidential as outlined in 641—39.4(24).
	ii. 	Refugee health program. These records are collected pursuant to Iowa Code section 135.11(1) and Section 412(c)(3) of the federal Immigration and Naturalization Act. Records that contain medical information are confidential pursuant to Iowa Code section 22.7(2).
	jj. 	Refugee resettlement client records. These records are collected pursuant to Iowa Code section 217.1. These records are confidential as outlined in Iowa Code section 217.30, and 45 CFR §400.27 as amended to March 22, 2000.
	kk. 	Reportable diseases and other diseases and health conditions, including lead and other heavy metal poisonings. These records are collected pursuant to Iowa Code chapter 139A. Except for statistical reports, these records are confidential as required by Iowa Code chapter 139A.
	ll. 	Reportable sexually transmitted diseases or infections. These records are collected pursuant to Iowa Code chapter 139A. Except for statistical reports, these records are confidential as required by Iowa Code chapter 139A.
	mm. 	State institution resident records. These records are collected pursuant to Iowa Code section 218.1. These records are confidential as outlined in Iowa Code sections 218.22, 229.24 and 229.25.
	nn. 	State supplementary assistance clients. These records are collected pursuant to Iowa Code chapter 249. Some of these records are confidential as outlined in Iowa Code section 217.30.
	oo. 	Substance abuse client records. These records are collected pursuant to Iowa Code chapters 125 and 218 and sections 234.6 and 249A.4. These records are confidential as outlined in Iowa Code sections 125.37 and 125.93, 42 U.S.C. §29 dd.3 and ee.3, 42 CFR Part 2 as amended to January 1, 2017, and 38 U.S.C. §4132.
	pp. 	Substance abuse program licensing complaints. These records are collected pursuant to Iowa Code chapter 125. Certain information in these records may be confidential as outlined in Iowa Code sections 22.7(2), 22.7(18) and 125.37.
	qq. 	Title IV-E foster care and adoption assistance client files. These records are collected pursuant to Iowa Code sections 217.1 and 600.17 to 600.22. These records are confidential as outlined in Iowa Code section 217.30, 42 U.S.C. §671(a)(8), and 45 CFR 1355.30(1) as amended to November 23, 2001.
	rr. 	Veterinary public health. These records are collected pursuant to Iowa Code chapter 139A. Certain medical information in these records may be confidential as outlined in Iowa Code chapter 139A.
	ss. 	Vital records. These records are collected pursuant to Iowa Code chapter 144, including records of births, deaths, fetal deaths, adoptions, marriages, divorces, annulments and related data and correspondence. These records are confidential as outlined in Iowa Code section 144.43.
	9.12(3) Other restricted data contained in department client records includes:
	a. 	Department of revenue information. These records are collected pursuant to Iowa Code sections 252B.5 and 252B.9. These records are confidential as outlined in Iowa Code sections 421.17 and 422.20(1).
	b. 	Department of workforce development information. These records are collected pursuant to Iowa Code chapters 239B and 249A and section 252B.9. These records are confidential as outlined in Iowa Code section 217.30 and 42 U.S.C. §503(d) and (e).
	c. 	Income and eligibility verification system. These records are collected pursuant to Iowa Code chapters 239B and 249A and sections 217.1 and 234.6(7). These records are confidential as outlined in Iowa Code section 217.30 and 42 U.S.C. §1230b-7.
	d. 	Department of public safety information. These records are collected pursuant to Iowa Code sections 237.8, 237A.5 and 252B.9. These records are confidential as outlined in Iowa Code sections 692.2, 692.3, 692.8 and 692.18.
	e. 	Federal tax return information. These records are collected pursuant to Iowa Code chapters 239B, 249A and 252B and Iowa Code sections 217.1 and 234.6(7). These records are confidential as outlined in Iowa Code section 422.20(2) and 26 U.S.C. §6103.
	f. 	Juvenile court information. These records are collected pursuant to Iowa Code chapter 232 and section 234.6. These records are confidential as outlined in Iowa Code sections 232.48, 232.97 and 232.147 to 232.151.
	g. 	Peer review organization. These records are collected pursuant to Iowa Code section 249A.4. These records are confidential as outlined in Iowa Code section 217.30 and 42 U.S.C. §1320c-9.
	h. 	United States Department of Health and Human Services information. These records are collected pursuant to Iowa Code chapters 239B, 249, 249A and 252B and sections 217.1 and 234.6(7). These records are confidential as outlined in Iowa Code section 217.30 and 42 CFR Part 401.134(c) as amended to October 1, 2002.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.13(17A,22) Special policies and procedures for protected health information. The department will follow all special policies and procedures for using and disclosing protected health information as outlined in 45 CFR Part 164 as amended through December 31, 2023, including the minimum necessary standard, uses and disclosures for premium rating and related purposes, verification and documentation requirements, notice of privacy practices, the right to receive an accounting of disclosures, complaint procedures, appeal rights and record retention.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
441—9.14(17A,22) Person who may exercise rights of the subject.
	9.14(1) Adults. When the subject is an adult, including an emancipated minor, the subject’s rights under this rule may also be exercised by the subject’s legal or personal representative, except as provided in subrule 9.14(3).
	9.14(2) Minors. Within the limits of subrule 9.14(3), when the subject is an unemancipated minor, the subject’s rights under this rule shall be exercised only by the subject’s legal representative, except as follows:
	a. 	When the department otherwise deals with the minor as an adult, as in the case of minor parents under the family investment program.
	b. 	When otherwise specifically provided by law. However, minor subjects shall be granted access to their own records upon request, subject to the limits in rule 441—9.9(17A,22).
	9.14(3) Exceptions.
	a. 	Scope of authority. Legal and personal representatives may act only within the scope of their authority. For protected health information, the designation must reflect the subject’s ability to make health care decisions and receive protected health information. For example, court-appointed conservators shall have access to and authority to release only the following information:
	(1)	Name and address of subject.
	(2)	Amounts of assistance or type of services received.
	(3)	Information about the economic circumstances of the subject.
	b. 	Mental health information. Only an adult subject or a subject’s legal representative may consent to the disclosure of mental health information. Records of involuntary hospitalization shall be released only as provided in Iowa Code section 229.24. Medical records of persons hospitalized under Iowa Code chapter 229 shall be released only as provided in Iowa Code section 229.25.
	c. 	Substance abuse information. Only the subject may consent to the disclosure of substance abuse information, regardless of the subject’s age or condition.
	d. 	Failure to act in good faith. If the department has reason to believe that the legal or personal representative is not acting in good faith in the best interests of the subject, the department may refuse to release information on the authorization of the legal or personal representative.
	e. 	Abuse, neglect, and endangerment situations. Notwithstanding a state law or any other requirement of this chapter, the department, in the exercise of professional judgment, may elect not to treat a person as a subject’s personal representative if:
	(1)	The department has reason to believe that the subject has been or may be subjected to domestic violence, abuse, or neglect by the person; or
	(2)	The department has reason to believe that treating the person as a personal representative could endanger the subject.
	f. 	Protected health information. A parent, guardian, or other person acting in place of a parent who does not represent the minor for protected health information may still access protected health information about the minor if required by law.
	g. 	Deceased subjects. If, under applicable law, an executor, administrator, or other person has authority to act on behalf of a deceased subject or of the subject’s estate, the department shall treat that person as a personal representative.
	h. 	Other. If, under applicable law, the subject of a confidential record is precluded from having a copy of a record concerning the subject disclosed to a third party, the department shall not treat the third party as a personal representative.
[ARC 8045C, IAB 5/29/24, effective 7/3/24]
These rules are intended to implement Iowa Code chapters 17A, 22, 135, 217, 228, and 252G and the Health Insurance Portability and Accountability Act of 1996.
[Filed emergency 11/25/75—published 12/15/75, effective 11/25/75]
[Filed 12/17/76, Notice 11/3/76—published 1/12/77, effective 2/16/77]
[Filed 9/6/79, Notice 7/11/79—published 10/3/79, effective 11/7/79]
[Filed 4/23/81, Notice 3/4/81—published 5/13/81, effective 6/17/81]
[Filed emergency 2/10/84—published 2/29/84, effective 2/10/84]
[Filed 3/4/85, Notice 12/19/84—published 3/27/85, effective 5/1/85]
[Filed 7/25/86, Notice 5/21/86—published 8/13/86, effective 10/1/86]
[Filed 11/14/86, Notice 10/8/86—published 12/3/86, effective 2/1/87]
[Filed emergency 1/15/87—published 2/11/87, effective 1/15/87]
[Filed 4/22/88, Notice 2/10/88—published 5/18/88, effective 7/1/88]
[Filed without Notice 12/8/88—published 12/28/88, effective 2/1/89]
[Filed emergency 6/29/89 after Notice 5/3/89—published 7/26/89, effective 7/1/89]
[Filed 10/10/89, Notice 8/23/89—published 11/1/89, effective 1/1/90]
[Filed 12/15/89, Notice 7/26/89—published 1/10/90, effective 3/1/90]
[Filed emergency 10/12/90 after Notice 8/22/90—published 10/31/90, effective 11/1/90]
[Filed 10/12/90, Notice 8/22/90—published 10/31/90, effective 1/1/91]
[Filed 12/13/90, Notice 10/31/90—published 1/9/91, effective 3/1/91]
[Filed emergency 6/14/91 after Notice 5/1/91—published 7/10/91, effective 7/1/91]
[Filed 8/12/93, Notice 6/23/93—published 9/1/93, effective 11/1/93]
[Filed 1/11/95, Notice 11/23/94—published 2/1/95, effective 4/1/95]
[Filed emergency 6/12/97—published 7/2/97, effective 7/1/97]
[Filed 9/16/97, Notice 7/2/97—published 10/8/97, effective 12/1/97]
[Filed 11/12/97, Notice 9/10/97—published 12/3/97, effective 2/1/98]
[Filed 8/12/98, Notice 6/17/98—published 9/9/98, effective 11/1/98]
[Filed 9/12/00, Notice 7/12/00—published 10/4/00, effective 12/1/00]
[Filed emergency 10/10/03—published 10/29/03, effective 11/1/03]
[Filed emergency 6/14/04—published 7/7/04, effective 7/1/04]
[Filed 9/23/04, Notice 7/7/04—published 10/13/04, effective 11/17/04]
[Filed 9/23/04, Notice 8/4/04—published 10/13/04, effective 11/17/04]
[Filed without Notice 5/4/05—published 5/25/05, effective 7/1/05]
[Filed 8/12/05, Notice 6/8/05—published 8/31/05, effective 11/1/05]
[Filed emergency 1/19/07—published 2/14/07, effective 1/20/07]
[Filed ARC 0420C (Notice ARC 0255C, IAB 8/8/12), IAB 10/31/12, effective 1/1/13]
[Filed ARC 1262C (Notice ARC 1045C, IAB 10/2/13), IAB 1/8/14, effective 3/1/14]
[Filed ARC 5305C (Notice ARC 5167C, IAB 9/9/20), IAB 12/2/20, effective 2/1/21]
[Filed ARC 5417C (Notice ARC 5274C, IAB 11/18/20), IAB 2/10/21, effective 4/1/21]
[Editorial change: IAC Supplement 6/14/23]
[Editorial change: IAC Supplement 6/28/23]
[Filed ARC 7711C (Notice ARC 7062C, IAB 8/23/23), IAB 3/6/24, effective 7/1/24]1
[Filed ARC 8045C (Notice ARC 7358C, IAB 1/24/24), IAB 5/29/24, effective 7/3/24]
1	The effective date of ARC 7711C was corrected to July 1, 2024, in the April 3, 2024, Iowa Administrative Bulletin.