12 Colo. Code Regs. § 2518-1-30.250

Current through Register Vol. 47, No. 20, October 25, 2024

Section 12 CCR 2518-1-30.250 - CONFIDENTIALITY

A. Pursuant to Section 26-3.1-102(7)(a), C.R.S. and except as provided in Section 26-3.1-102(7)(b), C.R.S. and Section 30.250, B, reports of the mistreatment or self-neglect of any at-risk adult, including the name and address of any at-risk adult, member of said adult's family, or informant, or any other identifying information contained in such reports and subsequent cases resulting from the reports, is confidential, and is not public information. The county and state departments shall treat all information related to the report and the case, whether in written or electronic form, as confidential and such information includes, but is not limited to, the following:

1. Identifying information, such as the name, address, relationship to the at-risk adult, Date of Birth, or Social Security Number of the:

a. At-risk adult;

b. At-risk adult's family members;

c. Reporting party;

d. Alleged perpetrator; and,

e. Other persons involved in the case.

2. Allegations, assessment, and investigative findings, including, but not limited to:

a. The initial report of allegations and concerns;

b. The client's safety and risk as determined by the client assessment;

c. Medical and behavioral diagnoses, past medical conditions, and disabilities;

d. Services provided to or arranged for the adult;

e. Information learned as a result of a criminal investigation;

f. Information obtained during the APS investigation and the substantiation or non-substantiation of the allegations; and,

g. Legal protections in place including, but not limited to, wills, advance directives, powers of attorney, guardianship, conservatorship, representative payeeship, and protective orders.

B. Pursuant to Section 26-3.1-102(7)(b), C.R.S., disclosure of a report of the mistreatment or self-neglect of an at-risk adult and information relating to an investigation of such a report and subsequent cases resulting from the report is permitted only when authorized by a court for good cause. A court order is not required, and such disclosure is not prohibited when:

1. A criminal investigation into an allegation of mistreatment is being conducted, when a review of death by a coroner is being conducted when the death is suspected to be related to mistreatment, or when a criminal complaint, information, or indictment is filed and the report and case information is relevant to the investigation, death review, complaint, or indictment.

2. There is a death of a suspected at-risk adult from mistreatment or self-neglect and a law enforcement agency files a formal charge or a grand jury issues an indictment in connection with death.

3. The disclosure is necessary for the coordination of multiple agencies' joint investigation of a report or for the provision of protection services to an at-risk adult, such as, but not limited to:

a. Coordination with law enforcement to conduct a joint investigation;

b. Providing protective services, such as establishing eligibility for, arrangement and implementation of services and benefits, and appointment of a guardian and/or conservator.

c. A review of a power of attorney is requested under the uniform power of attorney act, as outlined at C.R.S. Title 15, Article 14, Part 7 or review of a fiduciary under C.R.S. Title 15, Article 10, Part 5.

d. Reviewing a case with the Adult Protection Team to find solutions to cases with complex service provision needs, in accordance with the Adult Protection Team's by-laws, and when in executive session with members who have signed a confidentiality agreement.

4. The disclosure is necessary for purposes of an audit of a county department of human or social services pursuant to Section 26-1-114.5, C.R.S.

5. The disclosure is made for purposes of the appeals process relating to a substantiated case of mistreatment of an at-risk adult pursuant to Section 26-3.1-108(2), C.R.S.

a. This Subsection is in addition to and not in lieu of other federal and state laws concerning protected confidential information. Disclosures allowed are:

i. Notification made by the county department to substantiated perpetrator(s) of mistreatment pursuant to Section 26-3.1-108, C.R.S.

ii. Disclosure by the State Department for purposes of the appeals process relating to a substantiated case of mistreatment of an at-risk adult pursuant to Section 26-3.1-108(2), C.R.S.

6. The disclosure is made by the State Department to an employer, or to a person or entity conducting employee screening on behalf of the employer, as part of a CAPS check pursuant to Section 26-3.1-111, C.R.S. or by a county department pursuant to Section 26-3.1-107, C.R.S.

7. The disclosure is made to the at-risk adult who is the subject of the report, or if the at-risk adult is otherwise incompetent at the time of the request, to the guardian or guardian ad litem for the at-risk adult who is the subject of the report, with the following conditions:

a. The disclosure shall not be made until after investigation is complete; and,

b. The disclosure shall not include any identifying information related to the reporting party or any other appropriate persons, as follows:

i. The county or state department shall redact any and all identifying information related to the reporting party; and,

ii. The county or state department must redact Personal Identifying Information (PII) related to the client, any minor children, and alleged or substantiated perpetrators; and,

iii. The county or state department may redact PII related to the supports and collaterals as deemed necessary by the county or state department; and,

c. The county or state department shall redact all Personal Health Information (PHI) of the reporting party, supports, collaterals, and alleged or substantiated perpetrator that is protected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as incorporated by reference in Section 30.100, above, state and/or federal law, and,

d. The county or state department shall obtain from the guardian a copy of the guardianship order or guardian ad litem appointment, independently verify that the order or appointment remains valid, and attach the order or appointment to the client's case in CAPS; and,

e. If the guardian is a substantiated perpetrator in a case of mistreatment of an at-risk adult, the disclosure must not be made without authorization by a court for good cause, unless the disclosure is being made for the purposes of the guardian's appeal process pursuant to Section 26-3.1-102(7)(b)(V), C.R.S. If the request for disclosure is not part of the appeal process, the county or state department shall require the guardian to obtain a court order and the county or state department shall obtain a copy of the court order from the guardian and attach the order to the case in CAPS.

8. The disclosure is made to a county department that assesses or provides protective services for children when the information is necessary to adequately assess for safety and risk or to provide protective services for a child. A county department that assesses or provides protective services for at-risk adults is similarly permitted to access information from a county department that assesses or provides protective services for children pursuant to Section 19-1-307(2)(X), C.R.S.

a. Information must be limited to information regarding prior or current reports, assessments, investigations, or case information related to an at-risk adult or an alleged perpetrator.

b. The provisions of this Subsection 30.250.B.8 are in addition to and not in lieu of other federal and state laws concerning protected or confidential information.

i. The county department may not share Personal Identifying Information (PII) or Personal Health Information (PHI) protected by HIPAA, as incorporated by reference in Section 30.100, above, that is not necessary to the child welfare investigation, assessment, or provision of services for the child(ren).

ii. Information provided to child welfare staff must be the minimum necessary for worker safety concerns for child welfare staff, the investigation, assessment, and provision of services for the child(ren).

iii. County department APS staff may share information with any county department's child welfare staff.

iv. The county department's child welfare staff shall not be provided access to CAPS, unless that child welfare staff person is also the county department's APS staff person.

9. The disclosure is made to an employer required to request a CAPS check pursuant to Section 26-3.1-111 or to the State Department agency that oversees the employer when the information is necessary to ensure the safety of other at-risk adults under the care of the employer. The information must be the minimum information necessary to ensure the safety of other at-risk adults under the care of the employer or oversight of the State Department agency.

10. The disclosure is made pursuant to Section 26-3.1-111(12), C.R.S. to a health oversight agency, as defined in 45 CFR 164.501 incorporated by reference in Section 30.100,^[1], within the Department of Regulatory Agencies or a regulator within such a health oversight agency, as defined in Section 12-20-102(14), C.R.S.

a. The State Department, not county departments, shall provide this information to DORA.

b. County departments must observe all confidentiality requirements in the event DORA contacts them during an investigation.

11. The disclosure is made to the court pursuant to Section 26-3.1-111(3)(b) and (8.5)(b), C.R.S.

C. Whenever there is a question about the legality of releasing information the requestor shall be advised to submit a written request to the appropriate court to order the county department to produce the desired records or information within the custody or control of the county department.

D. Information released under Section 30.250.B, shall be the minimum information necessary to secure the services, conduct the investigation, or otherwise respond to the court order. The county department shall:

1. Provide the information only to persons deemed essential to the court order, criminal or APS investigation, adult protection team activities, or the provision of services;

2. Edit the information prior to its release to physically remove or redact information not essential to the court order, criminal or APS investigation, adult protection team activities, or provision of services and benefits;

3. Redact all information that would identify the reporting party unless ordered by the court, the reporting party has given written consent, or when sharing the report with law enforcement, per Section 26-3.1-102(3), C.R.S;

4. Always redact all HIPAA protected information, as incorporated by reference in Section 30.100, above, and any other confidential information which is protected by law unless specifically ordered by a court; and,

5. Redact all other report and case information not directly related to the court order.

E. In a criminal or civil proceeding or in any other circumstance in which the APS report and/or case record is subpoenaed or any request for disclosure has been made, or any county department or State Department representative is ordered to testify concerning an APS report or case, the court shall be advised, through proper channels, of the statutory provisions, rules, and policies concerning disclosure of information.

1. Confidential information shall not be released unless so ordered by the court for good cause, except as outlined in Section 26-3.1-102 (7)(b), C.R.S. and Section 30.250.B.

2. The county department or State Department shall comply within the time frame ordered by the court, unless a motion to quash is pending, or, if there is no stated timeline within the court order, in accordance with county department or State Department policy and provide a written notice with the information to be released regarding the legality of sharing confidential information.

F. Individuals or groups requesting information regarding APS reports and/or investigations shall be informed of the confidential nature of the information and shall be advised that a court order is required to release information held by the county department, except as provided in section 26-3.1-102(7)(b), C.R.S., and at Section 30.250.B above. These persons or groups include, but are not limited to:

1. Federal and state legislators;

2. Members of other governmental authorities or agencies, including county commissioners, city councils, school boards, and other city and county department boards, councils, officials, and employees;

3. Courts;

4. Attorneys, guardians, conservators, agents under powers of attorney, representative payees, and other fiduciaries;

5. Family members, reporting parties, or other interested parties;

6. Any alleged perpetrator; and,

7. Media representatives.

G. Any person who violates any provision of Section 26-3.1-102(7) and/or Subsection 30.250, A through F, is guilty of a civil infraction and, upon conviction thereof, shall be punished by a fine of not more than one hundred dollars as provided in Section 26-3.1-102(7), C.R.S.

H. All confidential APS information and data shall be processed, filed and stored using safeguards that prevent unauthorized personnel from acquiring, accessing, or retrieving the information.

1. Client files created prior to July 1, 2014 when CAPS was implemented shall be kept in a secured area when not in use. All other documents related to APS reports and cases shall be kept in CAPS, as outlined in Section 30.260, B and C.

2. Laptops and other mobile devices used to document in the field shall be protected and encrypted in compliance with HIPAA security requirements, as incorporated by reference in Section 30.100, above.

3. Email correspondence that contains APS confidential information shall be sent through secure encryption programs.

4. The State Department shall ensure that only State Department and county department staff persons with a business need to do so shall have access to CAPS.

a. All CAPS users must electronically sign the CAPS Security and Confidentiality Agreement annually and follow the requirements therein.

b. County departments shall not access information in CAPS that is not necessary to serve the client.

c. Violations of CAPS security and confidentiality requirements may result in loss of access to CAPS, at the discretion of the State Department.

I. Clients shall be referred to the Colorado Address Confidentiality Program (ACP) as appropriate to determine their eligibility for services including the legal substitute mailing address and mail forwarding services. The State Department and county department shall comply with any applicable provisions for APS clients enrolled in the ACP.

¹ Section 26-3.1-111(5)(h), C.R.S. refers to a health oversight agency defined in federal regulation at 42 CFR 164.501. This appears to be a typographical error as no such regulation exists. The definition for health oversight agency can be found at 45 CFR 164.501.

12 CCR 2518-1-30.250

37 CR 15, August 10, 2014, effective 9/1/2014

40 CR 01, January 10, 2017, effective 2/1/2017

41 CR 05, March 10, 2018, effective 4/1/2018

41 CR 09, May 10, 2018, effective 6/1/2018

41 CR 13, July 10, 2018, effective 7/30/2018

42 CR 17, September 10, 2019, effective 10/1/2019

42 CR 23, December 10, 2019, effective 12/30/2019

43 CR 13, July 10, 2020, effective 8/1/2020

43 CR 21, November 10, 2020, effective 11/30/2020

44 CR 11, June 10, 2021, effective 6/30/2021

45 CR 03, February 10, 2022, effective 3/2/2022

45 CR 19, October 10, 2022, effective 11/1/2022

46 CR 23, December 10, 2023, effective 1/1/2024