N.Y. Comp. Codes R. & Regs. tit. 18 § 423.7

Current through Register Vol. 46, No. 45, November 2, 2024

Section 423.7 - Confidentiality

(a) At the time of application for mandated or nonmandated preventive services, before individual identifiable information is collected and recorded, the local social services district or other authorized agency providing services shall notify the applicant for preventive services in writing of:

(1) the funding of preventive services through public revenues;

(2) the applicable statutes and regulations regarding the collection and disclosure of individual identifiable preventive services records; and

(3) the service provider's procedures and practices in regard to record maintenance and access to client specific records.

(b) All records established and maintained pursuant to titles 4 and 4-a of article 6 of the Social Services Law of applicants for and recipients of preventive services shall be confidential and shall be open to the inspection of only:

(1) the New York State Department of Social Services;

(2) the social services district;

(3) a preventive service agency, as defined in section 423.2(a) of this Part, or an authorized agency, as defined in subdivision (a) of section 371.10 of the Social Services Law, providing services to the child or other family members;

(4) any person or entity upon an order of a court of competent jurisdiction; or

(5) any other person or entity providing or agreeing to provide services to the child or the child's family upon the execution of a written consent by the child or the child's parent in accordance with subdivision (e) of this section.

(c) In addition to those granted access pursuant to subdivision (b) of this section, records relating to the provision of preventive services pursuant to title 4 of article 6 of the Social Services Law, other than those established and maintained pursuant to section 409-f of the Social Services Law, shall be available at any reasonable time to an employee or official of a Federal, State or local agency for the purpose of conducting a fiscal audit where said records are necessary for the conducting of the fiscal audit.

(d) An agency or person given access pursuant to subdivisions (b) and (c) of this section to the names or other information identifying the applicants for and recipients of preventive services shall not divulge or make public such information except where authorized by a court of competent jurisdiction or upon the execution of a written consent by a parent or a child in accordance with the provisions of subdivision (e) of this section.

(e)

(1) A child with the capacity to consent or such child's parent may authorize the disclosure of client identifiable preventive services information to a person or entity providing or agreeing to provide services to the child or such child' s family by executing a written consent.

(2) A parent may consent to the release of client identifiable preventive services information concerning the parent and the parent's family, including any children in the family. A child may consent to the release of client identifiable preventive services information about himself or herself where the child's parent is unavailable or lacks the capacity to consent and the child is determined to have the capacity to consent.

(3) A consent authorizing disclosure of client identifiable preventive services information in accordance with this subdivision must satisfy the following procedural requirements:

(i) The consent must be in writing and voluntarily executed.

(ii) The consent must be dated any specify the person or entity to which disclosure is authorized, and whether or not redisclosure of the information by such person or entity is permitted. If redisclosure is permitted, any limitations on redisclosure must be specified.

(iii) The consent must specify what information may be disclosed.

(iv) The consent must identify the purpose of the disclosure and any limitations on the use of the information by the person or entity.

(v) The consent must specify a time period during which the consent is to be effective or a date or event certain upon which the consent will expire.

(vi) The consent must state that the person executing the consent may terminate his or her authorization at any time.

(vii) A copy of the consent must be given to the person who executed it.

(4) For the purpose of this subdivision, the capacity to consent means an individual's ability, determined without regard to such individual's age, to understand and appreciate the nature and consequence of a proposed action, treatment or procedure and to make an informed decision concerning such action, treatment or procedure.

(5) For the purpose of this subdivision, a parent includes a natural parent, adoptive parent, stepparent, guardian, or caretaker with whom a child resides.

N.Y. Comp. Codes R. & Regs. Tit. 18 § 423.7