federal register - U.S. Government Printing Office

Federal Register / Vol. 62, No. 28 / Tuesday, February 11, 1997 / Rules and Regulations6351§ 361.38 Protection, use, and release ofpersonal information.(a) General provisions. (1) The Stateplan must assure that the State agencyand the State unit will adopt andimplement policies and procedures tosafeguard the confidentiality of allpersonal information, includingphotographs and lists of names. Thesepolicies and procedures must assurethat—(i) Specific safeguards protect currentand stored personal information;(ii) All applicants and eligibleindividuals and, as appropriate, thoseindividuals’ representatives, serviceproviders, cooperating agencies, andinterested persons are informed throughappropriate modes of communication ofthe confidentiality of personalinformation and the conditions foraccessing and releasing thisinformation;(iii) All applicants or theirrepresentatives are informed about theState unit need to collect personalinformation and the policies governingits use, including—(A) Identification of the authorityunder which information is collected;(B) Explanation of the principalpurposes for which the State unitintends to use or release theinformation;(C) Explanation of whether providingrequested information to the State unitis mandatory or voluntary and theeffects of not providing requestedinformation;(D) Identification of those situationsin which the State unit requires or doesnot require informed written consent ofthe individual before information maybe released; and(E) Identification of other agencies towhich information is routinely released;(iv) An explanation of State policiesand procedures affecting personalinformation will be provided to eachindividual in that individual’s nativelanguage or through the appropriatemode of communication; and(v) These policies and proceduresprovide no fewer protections forindividuals than State laws andregulations.(2) The State unit may establishreasonable fees to cover extraordinarycosts of duplicating records or makingextensive searches and shall establishpolicies and procedures governingaccess to records.(b) State program use. All personalinformation in the possession of theState agency or the designated State unitmust be used only for the purposesdirectly connected with theadministration of the vocationalrehabilitation program. Informationcontaining identifiable personalinformation may not be shared withadvisory or other bodies that do nothave official responsibility foradministration of the program. In theadministration of the program, the Stateunit may obtain personal informationfrom service providers and cooperatingagencies under assurances that theinformation may not be furtherdivulged, except as provided underparagraphs (c), (d), and (e) of thissection.(c) Release to applicants and eligibleindividuals. (1) Except as provided inparagraphs (c)(2) and (c)(3) of thissection, if requested in writing by anapplicant or eligible individual, theState unit shall make all requestedinformation in that individual’s recordof services accessible to and shallrelease the information to the individualor the individual’s representative in atimely manner.(2) Medical, psychological, or otherinformation that the State unitdetermines may be harmful to theindividual may not be released directlyto the individual, but must be providedto the individual through a third partychosen by the individual, which mayinclude, among others, an advocate, afamily member, or a qualified medicalor mental health professional, unless arepresentative has been appointed by acourt to represent the individual, inwhich case the information must bereleased to the court-appointedrepresentative.(3) If personal information has beenobtained from another agency ororganization, it may be released only by,or under the conditions established by,the other agency or organization.(4) An applicant or eligible individualwho believes that information in theindividual’s record of services isinaccurate or misleading may requestthat the designated State unit amend theinformation. If the information is notamended, the request for an amendmentmust be documented in the record ofservices.(d) Release for audit, evaluation, andresearch. Personal information may bereleased to an organization, agency, orindividual engaged in audit, evaluation,or research only for purposes directlyconnected with the administration ofthe vocational rehabilitation program, orfor purposes that would significantlyimprove the quality of life for applicantsand eligible individuals and only if theorganization, agency, or individualassures that—(1) The information will be used onlyfor the purposes for which it is beingprovided;(2) The information will be releasedonly to persons officially connectedwith the audit, evaluation, or research;(3) The information will not bereleased to the involved individual;(4) The information will be managedin a manner to safeguard confidentiality;and(5) The final product will not revealany personal identifying informationwithout the informed written consent ofthe involved individual or theindividual’s representative.(e) Release to other programs orauthorities. (1) Upon receiving theinformed written consent of theindividual or, if appropriate, theindividual’s representative, the Stateunit may release personal information toanother agency or organization for itsprogram purposes only to the extent thatthe information may be released to theinvolved individual or the individual’srepresentative and only to the extentthat the other agency or organizationdemonstrates that the informationrequested is necessary for its program.(2) Medical or psychologicalinformation that the State unitdetermines may be harmful to theindividual may be released if the otheragency or organization assures the Stateunit that the information will be usedonly for the purpose for which it isbeing provided and will not be furtherreleased to the individual.(3) The State unit shall releasepersonal information if required byFederal law or regulations.(4) The State unit shall releasepersonal information in response toinvestigations in connection with lawenforcement, fraud, or abuse, unlessexpressly prohibited by Federal or Statelaws or regulations, and in response toan order issued by a judge, magistrate,or other authorized judicial officer.(5) The State unit also may releasepersonal information in order to protectthe individual or others if the individualposes a threat to his or her safety or tothe safety of others.(Authority: Secs. 12(c) and 101(a)(6)(A) of theAct; 29 U.S.C. 711(c) and 721(a)(6)(A))§ 361.39 State-imposed requirements.The State plan must assure that thedesignated State unit identifies uponrequest those regulations and policiesrelating to the administration oroperation of its vocational rehabilitationprogram that are State-imposed,including any regulations or policybased on State interpretation of anyFederal law, regulations, or guideline.(Authority: Sect. 17 of the Act; 29 U.S.C. 716)