281—56.34 (259) Personally identifiable information. This rule describes the nature and extent of the personally identifiable information collected, maintained, and retrieved by the agency by personal identifier in record systems as defined herein. The record systems maintained by the division include the following:
	 56.34(1) Personnel records. These records contain information relating to initial application, job performance and evaluation, reprimands, grievances, notes from and reports of investigations of allegations related to improper employee behavior, and reports of hearings and outcomes of reprimands and grievances. Pursuant to Iowa Code section 22.7(11), some of the information in personnel records may be confidential.
	 56.34(2) Client case records. An individual file is maintained for each person who has been referred to or has applied for the services of the division. The file contains a variety of personal information about the client, which is used in the establishment of eligibility and the provision of agency services. All information is personally identifiable and is confidential.
	 56.34(3) Client service record computer database. This database contains personal data items about individual clients. Data identifying the client is confidential. Data in the aggregate is not personally identifiable and thus is not confidential.
	 56.34(4) Vendor purchase records. These are records of purchases of goods or services made for the benefit of clients. If the record contains the client’s name or other personal identifiers, the record is confidential. Lists of nonclient vendors, services purchased, and the costs of those services are not confidential when retrieved from a data processing system without personally identifiable information.
	 56.34(5) Records and transcripts of hearings or client appeals. These contain personally identifiable information about a client’s case, appeal from or for some action, and the decision that has been rendered. The personally identifiable information is confidential. Some of the information is maintained in an index provided for in Iowa Code subsection 17A.3(1)“d.” Information is available after confidential personally identifiable information is deleted.
	 56.34(6) All computer databases of client and applicant names and other identifiers. The data processing system contains client status records organized by a variety of personal identifiers. These records are confidential as long as any personally identifiable information is present.
	 56.34(7) All computer-generated reports that contain personally identifiable information. The division may choose to draw or generate from a data processing system reports that contain information or an identifier which would allow the identification of an individual client or clients. This material is for internal division use only and is confidential.