​​​​​​​​​​​​​​​​Chapter 1.1 Contents:
DRS Policy Manu​al Main

Chapter 1.1. - CONFIDENTIALITY

1. Collection, Use and Disclosure of Consumer Personal Information

A. DRS Collection, Use and Disclosure of Personal Information                                                                                                                                                                ​

A1. DRS Authority to Collect and Use Personal Information

 [REVISED: 4/1/10]

  1. Definition.
    Personal information means all information that describes, locates, or indexes anything about a DRS client, including real or personal property holdings derived from tax returns, education records, financial transactions, medical records, ancestry, criminal record, employment record, or that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual: and the record of the individual presence, registration, or membership in an organization or activity, or admission to an institution (per Government Data Collection and Dissemination Practices Act and § 2.2-3808 of the Code of Virginia).

  2. Format.
    Formats for personal information may include, but are not limited to, written records, photographs, audiotapes, videotapes, electronic data, or other media reproductions.

  3. Collection and Use. ​

a.  DRS has authority under federal and state law to collect, maintain, use and disseminate only that personal information permitted or required by law, or necessary to accomplish a proper purpose of the agency (per § 2.2-3808 of the Code of Virginia; P.L. 102-569 Rehabilitation Act of 1973 as amended in 1998 Title I sections 13, 14, 101(a)(10), 101(a)(15), 101(a)(18), 105(c)(3), 106(b), and 107.  See also2016 Federal Regulation 34 CFR § 361.38.

b.  Personal information shall be used only for the purposes directly connected with the administration of the Vocational Rehabilitation Program and case management.  The VR counselor primarily collects, maintains, uses, and disseminates personal information needed for case management (e.g., take a referral and application, determine eligibility, plan and provide services (including evaluating client progress and assisting the client in receiving services or benefits from DRS vendors or other agencies), referral to other agencies and organizations, close a case, etc.) 

c.  DRS medical consultants and dental consultants shall have access to confidential information in vocational rehabilitation files and have authority to copy this information when necessary within the context of specific, assigned job duties or when necessary for case management and service delivery purposes.​

  1. Impact of not providing information to DRS.
    If the client chooses not to provide personal information, this may limit the type of vocational rehabilitation services the client may receive.  See the specific service policy.  Some examples include: financial information to determine financial participation in service cost, financial aid and education records to receive support for education, medical insurance and vendor information for physical or mental restoration assessment and treatment services, training vendor reports for training services, information needed to identify and use comparable benefits, etc.

  2. SSN.
    The client is not legally required to provide the social security number to DRS (per § 2.2-3808 of the Code of Virginia).

Best Practice: When the client does not have a social security number, refer the client to the local Social Security office to apply for a social security number, which will be needed to obtain employment.

​

Back to Chapter Index

A2. Disclosure to Third Parties

 [REVISED: 12/3/18]

  1. Consent for disclosure. 
    Personal information in which the identity of the client is or may be readily ascertained shall not be disclosed to, exchanged with, or requested from another person or entity unless the client (or representative, as appropriate) gives informed written consent or unless federal or state law or regulations permit or require release without consent (per § 2.2-3803 of the Code of Virginia and 2016 Federal Regulation 34 CFR § 361.38).  For use of DRS or consent forms from other entities, see Policy 1: Section D of this chapter.
                                                                                                                                                                                                                            
  2. Information from another entity.
    Personal information in the case record that DRS obtains from another agency or organization may be released only by, or under the conditions established by, the originating information source (per 2016 Federal Regulation 34 CFR § 361.38), unless specifically requested by judicial order.  If the originating information source does not place conditions on re-release, the information may be released to the client (or representative) and with client informed written consent may be re-released to others.  

  3. Individuals Referred from the Virginia Department for the Blind and Vision Impaired (DBVI).
    Individuals referred to DARS by DBVI are considered new referrals for DARS. With the individual's written consent, DARS shall request case information from the referring DBVI counselor. For additional information about individuals jointly served by DARS and DBVI, see Chapter 16 INDIVIDUALS JOINTLY SERVED BY DARS AND THE DEPARTMENT FOR THE BLIND AND VISION IMPAIRED (DBVI), Policy 2, Policy 3, and Policy 4.​
  1. Parents.
    For disclosure to parents, See Policy 1: Section A6 of this chapter.                                                                                                                                                                                                                                                             
  2. Law enforcement.
    DRS has the authority to disclose requested personal information without consent in response to investigations on connection with law enforcement, fraud, or abuse, unless expressly prohibited by federal or state law or regulations (per 2016 Federal Regulation 34 CFR § 361.38).                                                                                                                                                                                                                                                                        
  3. Child support enforcement.
    DRS has the authority to disclose requested personal information without consent in response to a request from the Child Support Enforcement Office as long as it is requested in accordance with its state plan (per P.L. 93-647, and 42 USC 653).                                                                                                                                                                                                                                                                                                                                   
  4. Judicial order.
    DRS has the authority to disclose requested personal information without consent in response to a judicial order signed by a judge or a Deputy of the Workers Compensation Commission.  The following procedures shall apply:
a.  DRS staff shall not respond directly to any judicial order. 
 
b.  Within three calendar days of receipt, DRS staff shall fax the judicial order to the policy director or designee in the DARS Central Office and to the custodian of records.  For list of custodian of records, see Chapter 1.3, CASEFILE, Policy 3. 

c.  The custodian of records shall release the appropriate records as directed by the policy director or designee.  The response must note any requested documents that are not being provided; this usually occurs when DRS does not possess the records.

d.  There is no copying charge if the judicial order is issued by or on behalf of the VR client.  For other judicial orders, unless it states there are to be no copying charges, DRS shall charge 50 cents per page for up to 50 pages and 25 cents per additional page for a copy from paper or other hard copy generated from computerized or other electronic storage (per § 8.01-413 of the Code of Virginia).  The check is made payable to Virginia Department for Aging and Rehabilitative Services.

e.  The counselor shall keep a copy of the judicial order with a notation of the date of release and a copy of the DRS written response (per § 2.2-3803 of the Code of Virginia)
  1. Subpoena or subpoena duces tecum issued by a clerk of the court, clerk of the Workers Compensation Commission or an attorney. 
a. DRS staff shall not respond directly to any subpoena or subpoena duces tecum.

b. Immediately fax the subpoena or subpoena duces tecum to the policy director or designee in the DARS Central Office.

c. Within three calendar days of receipt notify the custodian or records.  For a list of custodians of records, see Chapter 1.3, CASEFILE, Policy 3.

d. The policy director or designee will advise the custodian of records of the actions to occur.

e. The counselor shall keep in the case record the subpoena/subpoena duces tecum with a notation of the date any information was released and a copy of the DRS written response to document the disclosure (per § 2.2-3803 of the Code of Virginia). 

f. There is no copying charge if the subpoena or subpoena duces tecum is issued by or on behalf of the Vocational Rehabilitation Program client.  Otherwise, unless it states there are to be no copying charges, DRS shall charge 50 cents per page for up to 50 pages and 25 cents per additional page for a copy from paper or other hard copy generated from computerized or other electronic storage (per § 8.01-413 of the Code of Virginia).  The check is made payable to Virginia Department for Aging and Rehabilitative Services.
  1. RSA.
    DRS has the authority to disclose requested client personal information without consent in response to requirements of the Rehabilitation Services Administration (RSA) as allowed by law.  DRS program staff are not required to record these disclosures in the case record (per § 2.2-3808.1 of the Code of Virginia). 

  2. Emergency.
​a.  DRS staff may disclose personal information pertinent to the nature of the emergency in the event that the client poses a threat to his or her safety, safety of others, or a situation in which it is reasonable to believe that a delay would result in death, serious physical injury, or other danger to the client or others (per2016 Federal Regulation 34 CFR § 361.38).  Examples of emergency include, but are not limited to: inquiry by law enforcement regarding an emergency situation, emergency or commitment to a hospital, inquiry from an acute care hospital, etc.

b.  Consent is not required to disclose any alcohol or substance abuse records, including information that the person abuses alcohol or substances, to qualified medical personnel in a medical emergency (per federal regulation 42 CFR § 2.64). ​
  1. Suspected child or adult abuse or neglect.
a. For reporting suspected child abuse or neglect, See Policy 1: Section C1 of this chapter. 

b. For reporting suspected abuse or neglect of an adult with disabilities, See Policy 1: Section C2 of this chapter.    

c. Even with informed written consent, DRS shall not release any information that the Department of Social Services has indicated shall not be re-released (per § 63.2-105 of the Code of Virginia, and 2016 Federal Regulation 34 CFR § 361.38).
  1. Audit, evaluation, or research.

​a.  DRS program staff shall not respond directly to a request by non-DRS staff.  Staff shall refer the requester to the policy director in the DARS Central Office.  

b.  DARS Central Office staff may disclose client personal information without consent for audit, evaluation, or research subject to these guidelines: 

    1. The information must be used only for purposes directly connected with the administration of the Vocational Rehabilitation Program or for purposes that would significantly improve the quality of life for DRS VR client (per 2016 Federal Regulation 34 CFR § 361.38).
       
    2. The information may only be released if the organization, agency, or individual assures that i) the information will be used only for the purposes for which it is provided; will be released only to those officially connected with the audit, evaluation or research; will not be released to the participants; and will be managed in a manner to safeguard confidentiality, and ii) the final product will not reveal any confidential identifying information without participant informed written consent (per 2016 Federal Regulation 34 CFR § 361.38). 

    3. The audit, evaluation or research may also be subject to pre-approval by the DARS Human Research Review Committee (per § 32.1-162.16 of the Code of Virginia, and State Regulation 22 VAC 30-40-10).

    4. No disclosure case note is required (per § 2.2-3808.1 of the Code of Virginia). 
  1. Alcohol, drug, or substance abuse information.
    Information regarding alcohol or substance abuse diagnosis, treatment, care, or rehabilitation records for federally-funded or state programs shall not be released unless with informed written consent, judicial order, or other legal requirement (per federal regulation 42 CFR § 2.31, federal regulation 42 CFR §  2.32, federal regulation 42 CFR § 2.33). For example, see subsection i above which allows disclosure in a medical emergency.

  2. Non-VR Program staff.  
    Informed written consent shall be required for other DARS divisions and staff of DRS who do not have responsibility for administering the Vocational Rehabilitation Program.

  3. Advisory bodies.
    Information that does not contain identifiable personal information may be shared with the State Rehabilitation Council and other advisory bodies.  Redacted hearing decisions shall be shared with the State Rehabilitation Council as required (per Rehabilitation Act of 1973, as amended, § 101(a)(21)(A)). 
     
  4. Potential employers.

a. Informed written consent shall be required and shall routinely relate only to the job abilities and reasonable accommodation needs (per P.L. 101-336 Americans with Disabilities Act of 1990), unless the client notes on the consent form other information that may be disclosed.  

b.  ​The consent may be a blanket consent for all potential employers or a separate form for each potential employer.

  1. Service providers.
    Informed written consent shall be required.   

Back to Chapter Index


​A3. Client Access to Case Record

[Revised: 4/1/10]

  1. Age 18.
    The client must be at least 18 years of age to request a copy of the case file or to review it. For exceptions, See Policy 1: Section A6 of this chapter.  

  2. Case record information available to client.
    When requested in writing by the client (or representative, as appropriate), DRS shall make all information in the case file (i.e., case notes, DRS forms, AWARE screens, letters) accessible to the client or release a copy to the client in a timely manner (per Virginia Freedom of Information Act in § 2.2-3700 of the Code of Virginia, and 2016 Federal Regulation 34 CFR § 361.38, and § 63.2-1509 of the Code of Virginia). However, information that originated from another agency or organization shall not be disclosed to the  client or another party if the originating source has stipulated in writing that disclosure is prohibited, even when the client consents to release (per 2016 Federal Regulation 34 CFR § 361.38, and § 63.2-1509 of the Code of Virginia, and § 63.2-1606 of the Code of Virginia, and RSA Manual Chapter 0550.04 issued September 9, 1991.  See also Policy 1: Section A2 of this chapter).

  3. Challenges to case record.
    For client right  to challenge the accuracy or completeness of information in the case file, see Chapter 1.3, CASEFILE, Policy 1, Section B.

  4. Procedure to review case record.
    If the client is reviewing the original case file rather than a copy, the custodian of records shall take all necessary precautions for the preservation and safekeeping of the case file. The case file may be viewed only during normal business hours. One or more people of the client's choosing may accompany the client. DRS staff may require proper identification. The counselor must obtain informed written consent, if not already on file, to discuss confidential information in the presence of the client's guest. A DRS staff member shall remain with the case file to ensure information is not removed, changed, added, defaced, etc. (per Government Data Collections and Dissemination Practices Act, § 2.2-3806 of the Code of Virginia).

 

Back to Chapter Index

​A4. Copying Charges for Case Record

[Revised: 7/1/12]

There is no copying charge for the VR case record if the informed written consent form is issued by or on behalf of the Vocational Rehabilitation Program client.  Otherwise, unless a judicial order states there are to be no copying charges, DRS shall charge 50 cents per page for up to 50 pages and 25 cents per additional page for a copy from paper or other hard copy generated from computerized or other electronic storage (per § 8.01-413 of the Code of Virginia).  The check is made payable to Virginia Department for Aging and Rehabilitative Services.

cross reference: For procedure for individual (or authorized representative) to review (not copy) his or her own case record, See Policy 1: Section A3 of this chapter.

 

Back to Chapter Index


​A5. Disclosure Record

[Revised: 4/1/10]

  1. Unless a record of disclosure is specifically not required by written policy, each time client personal information is released to a third party, the VR counselor is required to enter into AWARE case note (per § 2.2-3803 of the Code of Virginia): 
a. name, title organization and telephone number of the person receiving the information;

b. type and source of information released;

c. date;  and

d. reason or purpose of the release (including the nature of the exception when disclosure without client written consent is allowed or mandatory under law.
  1. When disclosure without consent is allowed or required, the VR counselor may, but is not required to, notify the client of the disclosure.  However, notification shall not delay the DRS response to the request for information.  The VR counselor shall not notify the client if the party receiving the information advises DRS staff that notification is prohibited by law. 

Back to Chapter Index

 

A6. Parent Access to Child's Case Information

[Revised: 4/1/10]
​

  1. Child under age 18.
    The parent or legal guardian has the right to review the minor child's case record (including information about the child dropping out of school, sexual activity, etc.), discuss the case, or make decisions about the child's vocational rehabilitation (including signing DRS documents for the customer), without the child's informed written consent except: 
​a.  Any information regarding outpatient diagnosis, treatment, care, or rehabilitation for alcohol or other substance abuse, mental illness, or emotional disturbances (§ 54.1-2969 of the Code of Virginia). However, the child's consent is not required for parental access to inpatient treatment, care, or rehabilitation since minors cannot check themselves into an inpatient treatment program, or for parental access to other types of information (e.g., child is sexually active, child has dropped out of school, etc.), or

b  When parental rights have been terminated or a court has restricted or denied parental or representative access to the child's confidential records, or

c.  When the child is emancipated (e.g., married, court order, etc.), or

d.  Any information furnished in confidence to the Virginia Department of Social Services and an investigation is ongoing (e.g., on abuse or neglect charges) and any information Social Services provided to the VR counselor with a stipulation that release of the information is prohibited.
  1. Child age 18 or older.
a.  If the client is 18 years or older and is legally competent, informed written consent is required for the parent to review or obtain a copy of the case file, discuss the case, or make vocational rehabilitation decisions on the client's behalf (including signing DRS documents). Informed written consent is required for parental access to special education records when the child is 18 years or older (per P.L. 105-17 Individuals with Disabilities Education Act, Federal Regulation 34 CFR § 300.613).

b.  The parent cannot make decisions on behalf of a child who is 18 years or older unless the parent is a court-appointed legal guardian. If the counselor does not personally know the legal guardian, the guardian must furnish personal identification (e.g., driver's license) and sign a written statement for the case file that he or she is the legal guardian. The counselor shall keep a copy of the identification document and statement in the case file (per agency mandate).


Back to Chapter Index

 

B. Notification to Client of Right to Confidentiality


[REVISED: 4/1/10]
  1. The VR counselor shall inform all Vocational Rehabilitation program applicants, through the applicant's native language or other appropriate mode of communication to ensure the applicant understands (per § 2.2-3806 of the Code of Virginia and2016 Federal Regulation 34 CFR § 361.38):
a.  DRS' need to collect confidential information,

b.  How the information will be used (See Policy 1: Section A1 of this chapter),

c.  The effects of not providing information that DRS needs (See Policy 1: Section A1 of this chapter),

d.  Other agencies (if any) to which DRS routinely releases customer information (See Policy 1: Section A1 and See Policy 1: Section A2 of this chapter),  

e.  The customer's right to ask what information has been shared with whom and why,

f.   That customer consent is required to obtain or release information in which the customer's identity is or may be readily ascertained except when disclosure without consent is allowed or mandatory under law or regulations (See Policy 1: Section A2 of this chapter).

g.  The purpose and key provisions and protections of the DRS confidentiality release form (per2016 Federal Regulation 34 CFR § 361.38).  This includes disclosure parameters (e.g., types of information to be disclosed, expiration date of release form, parties to be listed on the release), the right to view the information released unless access is prohibited (See Policy 1: Section A3 of this chapter), and the client's right to revoke and amend the release form.  The counselor shall explain the consequences of not signing the release.  If the counselor determines that the client does not understand the form or process, the client's representative must sign the form. The VR counselor cannot sign the release form or serve as the client's legally authorized representative. 
  1. The counselor may disclose the client's right to confidentiality by giving the client printed material (e.g., customer guide for VR program, RS-5a form); discussing this information during the initial meeting, a group orientation, or vocational rehabilitation counseling and guidance session; or informing the client via other mode of communication to enable the client to comprehend and respond to information.

 

Back to Chapter Index

 

C. Mandatory Reporting of Suspected Abuse or Neglect


​C1. Suspected Child Abuse or Neglect

[REVISED: 12/3/18]

  1. If the VR counselor suspects that the client is about to confide abuse, neglect or exploitation, the counselor should tell the client up front that the counselor is required by law to report complaints to the Department of Social Services but that all information relating to the complaint and any forthcoming investigation will remain confidential and will not be released without a judicial order. The counselor may note in the case file the date the report was made and list any documents DRS provided to the Department of Social Services. However, until Social Services substantiates the complaint, this information does not have to be part of the client's official VR case file.

  2. The VR counselor must report, within 24 hours, to Department of Social Services any suspected abuse or neglect of child, even if the client shares the information with the counselor in confidence. The counselor may be subject to a state fine for failing to report the information within 24 hours of first suspicion. The counselor must report the information to the Social Services office in the locality where the customer lives, or where the alleged incident is believed to have occurred. Suspected child abuse and neglect may also be reported through the Social Services toll-free child abuse and neglect hotline. The report may be oral or in writing (per § 63.2-1509 of the Code of Virginia).

C2. Suspected Adult Abuse or Neglect

[REVISED: 4/1/10]

  1. Definition.
    For the purposes of this section, an adult is any person 60 years of age or older, or any person 18 years of age or older who is incapacitated and resides in the State or qualifying nonresidents who are temporarily in the State and who are in need of temporary or emergency protective services.

  2. If the VR counselor suspects that the client is about to confide abuse, neglect or exploitation, the counselor should tell the client up front that the counselor is required by law to report complaints to the Department of Social Services but that all information relating to the complaint and any forthcoming investigation will remain confidential and will not be released without a judicial order.

  3. Matters giving reason to suspect the abuse, neglect or exploitation of an adult, even if the client shares the information with the counselor in confidence, must be reported immediately to the adult protective services hotline or the Department of Social Services office in the locality where the client resides or where the abuse, neglect or exploitation is believed to have occurred. The counselor may note in the case file the date the report was made and list any documents DRS provided to the Department of Social Services. However, until Social Services substantiates the complaint, this information does not have to be part of the client's official VR case file. 

  4. Any VR counselor who has reason to cause to suspect that an adult has died as a result of abuse or neglect must immediately report this suspicion to the appropriate medical examiner and law enforcement agency.

  5. The VR counselor may be subject to a fine for failing to immediately report the information upon reason to suspect and will be subject to a criminal conviction for making or causing to be made a false report (per § 63.2-1606 of the Code of Virginia).

 


​D. Use of Confidentiality Release Forms

D1. Use of Authorization to Release Drug and Alcohol Diagnosis and Treatment Records (RS-3j Form)

[REVISED: 3/1/10]

The RS-3j form shall be used to obtain, exchange, or disclose alcohol and substance abuse information.  For instructions on use and completion, see Chapter 12, FORMS, RS-3j.

D2. Use of Authorization for Use or Disclosure of Protected Health Information (RS-3i Form)

[REVISED: 3/1/10]

The RS-3i form shall be used to obtain, exchange, or disclose protected health information.  For instructions on use and completion, see Chapter 12, FORMS, RS-3i.

D3. Use of Authorization for the Release Of Personal Information (RS-3e Form)

​[REVISED: 3/1/10]

The RS-3e form shall be used to obtain, exchange, or disclose information other than alcohol or substance abuse information or protected health information.  This includes criminal records, educational records, etc.  For instructions on use and completion, see Chapter 12, FORMS, RS-3e.

D4. Other Entity's Release Form

[REVISED: 1/21/99]

If the client is being served by another entity, the client may amend the other entity's release form to include DRS rather than complete a new DRS release form.

Best Practice: It is a Best Practice to give the client the option and explain the customer benefits of amending the existing release. These benefits include: avoiding confusion when the separate release forms do not have identical parameters regarding information exchange and release, the other agency's release may contain information and guidance useful to the client and VR counselor, reducing customer paperwork.


D5. Revoking Consent to Release Information

[REVISED: 4/1/10]​​

The client may revoke at any time the consent to release personal information to a third party.  For procedure, see Chapter 12, FORMS, RS-3e, Chapter 12, FORMS, RS-3i, or Chapter 12, FORMS, RS-3j. 


Back to Chapter Index

​

​