Section 16-2-8e - Disclosure of employee personal data file system information(a) Any individual may request from the department whether the agency maintains personal data on that individual; the category and location of the personal data maintained on that individual and procedures available to review said information. Within four business days of receipt of said written request, the agency shall mail or deliver to the requesting individual a written response in plain language.(b) Except where prohibited by law, the department shall disclose to any person upon request all personal data concerning that person which is maintained by the department. Such disclosure shall be conducted so as not to disclose any personal data concerning persons other than the individual requesting such information.(c) Agency personnel shall verify the identity of any person requesting access to his or her own personal data.(d) The department may refuse to disclose to a person medical, psychiatric or psychological data regarding that person if it is determined by the agency that such disclosure would be detrimental to the person, or if such nondisclosure is otherwise permitted or required by law. If the department refuses to disclose medical, psychiatric or psychological data to a person, it must inform the person of his or her right to seek judicial relief pursuant to the Personal Data Act.(e) If the department refuses to disclose medical, psychiatric or psychological data to a person based on its determination that disclosure would be detrimental to that person and the nondisclosure is not mandated by law, the department shall, at the written request of such person, permit a qualified medical doctor to review the personal data contained in the person's record to be determined if the personal data should be disclosed. If nondisclosure is recommended by such person's medical doctor, the department shall not disclose the personal data and shall inform such person of the judicial relief provided under the Personal Data Act.(f) A record shall be maintained of each person, individual, agency or organization who has obtained access to or whom disclosure has been made of personal data in accordance with Section 4-193(c) of Connecticut General Statutes, together with a reason for each such disclosure or access. This log must be maintained for not less than five years from the date of such disclosure or access or for the life of the personal data record, whichever is longer.Conn. Agencies Regs. § 16-2-8e
Effective August 22, 1986