This chapter implements the following: Education Article, §21-307, Annotated Code of Maryland; State Government Article, §§10-611—10-628, Annotated Code of Maryland; Health-General Article, §§4-302 and 4-305, Annotated Code of Maryland; Executive Order 01.01.1983.18; and 34 CFR §361.49 governing the collection, use, and disclosure of personal information about Division clients. The regulations governing the collection, use, and disclosure of personal information by the Disability Determination Service are set forth at 20 CFR 401. In this chapter, the following terms have the meanings indicated. Terms Defined. “Client” has the same meaning as defined in COMAR 13A.11.01.03. “Client's representative” has the same meaning as defined in COMAR 13A.11.01.03. “Disclose” or “disclosure” means the communication of personal information about an applicant or eligible individual or the release of records containing personal information about an applicant or eligible individual. “Division” has the same meaning as defined in COMAR 13A.11.01.03. As used in this chapter, the term “Division” includes employees of the Division. “Person” means an individual, receiver, trustee, guardian, personal representative, fiduciary, or representative of any kind and any partnership, firm, association, corporation, agency, or other organization. “Personal information” means any information about an individual and includes, but is not limited to, name, address, identification number, and financial, educational, employment, family, or medical information. “Record” or “record of services” means the original or copy of any documentary material that is made or received by the Division in connection with the operation or administration of the program. Personal information about an applicant or eligible individual, whether obtained directly from the applicant or eligible individual or from another person, shall be kept confidential and may not be disclosed except in accordance this chapter. The Division shall notify each applicant or eligible individual who is requested to provide personal information about: The authority under which the information is collected; The principal purpose for which the information is intended to be used; Whether provision of the information is mandatory or voluntary and the specific consequences of not providing the information; The individual's right to: Inspect and obtain copies of records which contain personal information about the individual, and Amend or correct any records which contain inaccurate or incomplete information; and The requirements of this chapter regarding obtaining written consent from the individual before personal information is disclosed to another person and the circumstances under which written consent is not required. The notice under §A of this regulation shall be given in writing and explained in the applicant or eligible individual's primary language or mode of communication, including braille. Subject to Regulation .06 of this chapter, when requested by an applicant or eligible individual or an individual's representative, the Division shall permit the individual or the individual's representative to inspect and obtain copies of any records in the custody of the Division which contain personal information about the individual. A request to inspect and obtain copies of records shall be in writing, signed by the applicant or eligible individual or the individual's representative, and identify the records which are the subject of the request. Records of minors, that is, individuals younger than 18 years old, which relate to or reveal substance abuse diagnosis or treatment may not be released to the individual's representative, including a parent or guardian, without the explicit written consent of the individual, in accordance with federal alcohol and drug abuse confidentiality regulations, 42 CFR 2. The Division shall comply with a request to inspect and obtain copies of records within a reasonable period, but not to exceed 30 days after receipt of the request. If the requested records are unavailable or have been destroyed or lost, the Division shall notify the applicants or eligible individual or the individual's representative within 10 working days after receipt of the request. Medical, psychological, or other personal information which the Division believes may be harmful to an applicant or eligible individual may not be disclosed directly to the individual but shall be provided to a person chosen by the individual or, if applicable, pursuant to Health-General Article, §4-302, Annotated Code of Maryland. Persons preparing reports which contain information which may be harmful to the applicant or eligible individual should clearly identify this on the face of the report. When the Division has obtained personal information from another person, the information shall be disclosed only by, or under the conditions established by, the other person. If the Division is not permitted to disclose the information, the Division shall inform the individual of the identity of the person who provided the information and any procedure for contacting the person directly to obtain the information. An applicant or eligible individual or an individual's representative may request the Division to amend or correct any records in the custody of the Division which contain inaccurate or incomplete information about the individual. A request to amend or correct records shall be in writing, signed by the applicant or eligible individual or the individual's representative, and: Identify the records which are the subject of the request; Describe the requested change precisely; and State the reasons for the change. Within 30 days after receiving a request to amend or correct records, the Division shall: Make or refuse to make the requested change; Give the applicant or eligible individual or the individual's representative written notice of the action taken; and If the requested change is refused, state the reasons for the refusal. The Division may refuse to amend or correct records because, among other reasons, the records were not created by the Division. If the Division refuses to make the requested change and the applicant or eligible individual or the individual's representative disagrees with the Division's action, the applicant or eligible individual or the individual's representative may file with the Division a concise statement that, in five pages or less, states the reasons for the requested change and for disagreement with the Division's action. The statement of disagreement shall be attached to the disputed record and the Division shall provide a copy of the statement whenever the disputed record is disclosed to another person. An applicant or eligible individual or an individual's representative may request an appeal hearing if the Division takes any of the following actions with respect to any records in the custody of the Division which contain personal information about the individual: Denies a request to inspect and obtain copies of the records; Denies a request to amend or correct records; Fails to attach a statement of disagreement to a disputed record; or Fails to provide a statement of the disagreement when a disputed record is disclosed to another person. The appeal hearing shall be conducted in accordance with COMAR 13A.11.07. Except as provided in Regulation .11 of this chapter, the Division shall obtain written consent from an applicant or eligible individual or the individual's representative before disclosing personal information to another person. The written consent to disclose personal information shall be dated and signed by the applicant or eligible individual or the individual's representative, and shall: Identify the person to whom the information is to be disclosed; State the purpose of the disclosure; and Identify the information or records to be disclosed (medical, psychological, and other evaluation reports shall be specifically identified in the written consent). The written consent to disclose personal information shall be valid for 45 days from the date consent is given unless otherwise specified in writing or revoked in writing by the applicant or eligible individual. Upon receiving written consent from the applicant or eligible individual or the individual's representative to disclose personal information to another person, the Division shall disclose only the information or records specified in the written consent, subject to the restrictions in Regulation .06 of this chapter. The Division shall maintain a copy of the applicant or eligible individual's written consent in the individual's record of services. The Division shall attach the following statement to each disclosure made with the eligible individual's written consent: This information has been disclosed to you from records whose confidentiality is protected by federal and State law (see COMAR 13A.11.06). Federal regulations prohibit you from making any further disclosure of it without the specific written consent of the person to whom it pertains or as otherwise permitted by such regulations. A general authorization for the release of information is NOT sufficient for this purpose. Medical, psychological, or other information which may be harmful to the individual may not be disclosed directly to the individual but must be provided to a third party chosen by the individual unless a representative has been appointed by a court to represent the individual, in which case the information must be released to the court-appointed representative. Information about individuals who are minors, i.e., under 18 years old, which relates to or reveals substance abuse diagnosis or treatment may not be released to the individual's representative, including a parent or guardian, without the explicit written consent of the individual, in accordance with federal alcohol and drug abuse confidentiality regulations, 42 CFR 2. The information should be managed in a manner to protect confidentiality and to protect against unauthorized disclosure. Any person who willfully and knowingly discloses or uses confidential information in violation of the law may be liable to the individual for actual and punitive damages, attorneys' fees, and litigation costs, and may also be subject to criminal penalties (see State Government Article, §§10-626 and 19-627, Annotated Code of Maryland). The Division may disclose personal information without obtaining written consent from the applicant or eligible individual or the individual's representative when the disclosure is: To agencies, organizations, or individuals with whom the Division has formal cooperative agreements or from whom the individual is requesting or receiving services connected with the individual's rehabilitation program, or both; To an employee of Disability Determination Services and concerns an individual served by both the Division and its component, Disability Determination Services; Subject to Regulation .12 of this chapter, in connection with an administrative or judicial proceeding to review an action of the Division affecting the individual; Subject to Regulation .13 of this chapter, to comply with a judicial order or lawfully issued subpoena; Subject to Regulation .14 of this chapter, in connection with an audit, evaluation, or research; To a third-party resource who initiated the referral for the service and who is responsible for payment; In response to a law enforcement, fraud, or abuse investigation, unless expressly prohibited by federal or State laws or regulations; Necessary to protect an applicant or eligible individual or other persons when the applicant or eligible individual poses a threat to the applicant's or eligible individual's own safety or the safety of the other persons; Required by State or federal law or regulation. Except for disclosures made pursuant to §A(1) and (2) of this regulation, the Division shall maintain a record within the applicant's or eligible individual's record of services of each disclosure made without the written consent of the individual. When personal information is disclosed in connection with an administrative or judicial proceeding to review an action of the Division affecting the applicant or eligible individual, the Division shall: Request that the information be placed under seal when such procedure is available; or Take other appropriate action to protect the confidentiality of the information. When the Division receives a judicial order or lawfully issued subpoena to disclose personal information, the Division shall make a reasonable effort to notify the applicant or eligible individual or the individual's representative of the order or subpoena in advance of compliance, and request the individual to consent in writing to disclosure of the information. If the eligible individual consents to disclosure of the information, the Division shall comply with the order or a subpoena. If the eligible individual does not consent to disclosure of the information, the Division may comply with the order or subpoena if the: Individual has been informed of the individual's right to seek a protective order from a court of law; Information requested is relevant to the subject matter involved in the case; Information is not privileged; and Person requesting the information provides written assurance that: The information will be disclosed only to persons directly involved in the preparation or trial of the case, The information will be managed in a manner to protect confidentiality and to prevent unauthorized disclosure, If the information is used in an administrative or judicial proceeding, the information will be placed under seal when this procedure is available, and The information will be destroyed when no longer needed for the case. The applicant or eligible individual is responsible for asserting any privileges which may exist as to any information in the custody of the Division and requesting an appropriate order from the court to prevent disclosure of the information. If the individual files a timely motion with the court to prevent disclosure of any information in the custody of the Division, the Division may not disclose the information until the court rules on the motion. The Division may disclose personal information in connection with an audit or evaluation for purposes directly related to the administration of the Division's programs if the person conducting the audit or evaluation assures that the information will: Be used only for the purposes for which it is provided and will be disclosed only to persons officially connected with the audit or evaluation; Be managed in a manner to protect confidentiality and to prevent unauthorized disclosure; Not be disclosed to the applicant or eligible individual; and Not be disclosed in any report without the informed written consent of the applicant or eligible individual. Disclosure of Personal Information in Connection with Research. The Division may disclose personal information in connection with research which would significantly improve the quality of life for persons with disabilities. The person conducting the research: Shall submit a written request to the Division which describes: The purpose of the research, Whether the findings will be published, The nature of the personal information requested, and The safeguards that shall be taken to protect the confidentiality of the information; May not contact any applicant or eligible individual unless the Division approves and monitors the contact. In addition to giving assurances required under §A of this regulation, the Division shall require the person conducting the research to make an agreement to protect the confidentiality of personal information in accordance with State Government Article, §10-624(c), Annotated Code of Maryland. The Division may charge a reasonable fee for copying records if reproduction is made by a photocopying machine within the Division, or the actual cost of reproduction if reproduction is made by a photocopying machine outside the Division or if the record is not susceptible to photocopying (for example, microfilm, X-rays, etc.). A charge may not be made if the total amount of the fee is $1 or less. The Division may charge a reasonable fee for the time beyond the first 2 hours expended searching for requested records and preparing the records for inspection and copying. The fee may be prorated for fractions of an hour. The Division may charge for the cost of postage to mail copies of records. Before copying records, the Division shall: Estimate the cost of reproduction, including research, preparation time, and postage; and Either obtain the agreement of the person requesting copies of the records to pay the cost or demand prepayment of any estimated fee before reproducing the records. Upon request, the Division may waive or reduce any fee charged pursuant to this regulation if the Division determines that the waiver or reduction is in the public interest. The Division shall consider, among other relevant factors, the ability of the person requesting copies of the records to pay the fee. Records of services shall be maintained for a minimum of 3 years following the closure of a record of services, and then destroyed, except for records held by the Workforce and Technology Center and those approved by the Social Security Administration for reimbursement, which shall maintain records for a minimum of 5 years pursuant to Health-General Article, §4-403, Annotated Code of Maryland. Under State Government Article, §10-626, Annotated Code of Maryland, a person who willfully and knowingly discloses or uses personal information about an applicant or eligible individual in violation of the law may be liable to the individual for actual and punitive damages, attorneys' fees, and litigation costs. Under State Government Article, §10-627, Annotated Code of Maryland, a person who willfully or knowingly discloses or uses personal information about an applicant or eligible individual in violation of the law, or by false pretenses, bribery, or theft gains access to or obtains a copy of a record containing personal information about an applicant or eligible individual whose disclosure is not authorized by law to the person, may be charged with a misdemeanor and upon conviction may be subject to a fine not exceeding $1,000. Education Article, §§21-304—21-306 and 21-308, Annotated Code of Maryland Effective date: August 15, 1990 (17:13 Md. R. 1613) Chapter revised effective August 7, 2000 (27:15 Md. R. 1402) Regulation .16 amended effective October 1, 2001 (28:19 Md. R. 1687); January 21, 2013 (40:1 Md. R. 21)