The rules adopted by the state Social Services Commission pursuant to G.S. 108A-80(d) apply to “client information” that is received by a county department of social services or the DHHS Division of Social Services in the performance of any agency function (except the state Medicaid program).

The rules define “client information” as any information (in any form) that (a) relates to a “client” and (b) was received in connection with the performance of any function of a county social services department or the state Division of Social Services. The rules define “client” as anyone who applies for or receives public assistance or social services (other than Medicaid) or who makes inquiries, is interviewed, or is otherwise served to some extent by a county social services department or the Division of Social Services. In some instances, a person who is “acting responsibly” for a client is included within the definition of “client.”

The rules require state and county social services agencies to provide a secure place with controlled access for the storage of client records and to establish procedures to prevent the accidental disclosure of client information from automated data processing systems. Only those social services employees or other individuals who need client information in order to carry out their assigned duties may enter the records storage area or remove client records. Original client records may be removed from the premises only by “authorized” staff or pursuant to a court order. Client records are considered to be property of the agency and may be destroyed only in accordance with applicable federal and state statutes, regulations, policies, and schedules governing the records of social services agencies.

The rules prohibit social services agencies from redisclosing client information received from another agency or individual if redisclosure is prohibited by the agency or individual who provided the information. When federal or state statutes or regulations regarding the confidentiality of client information are inconsistent, the rules require the agency to abide by the statute or regulation that provides more protection for the client.
The rules require social services agencies, upon the written or verbal request of a client, to allow the client, or his or her personal representative or attorney, to review or obtain without charge a copy of his or her client record. Information in the client’s record may be withheld from the client if (a) disclosure of the information to the client is prohibited by a federal or state statute or regulation; (b) the information was obtained from another agency or individual under conditions that prohibit redisclosure of the information to the client; or (c) disclosure of the information would violate another individual’s right to confidentiality. If the client contests the accuracy, completeness, or relevancy of information in his or her record, he or she may request that the information be corrected.

The rules allow the disclosure of client information with the client’s consent. The client’s consent for the release of confidential information must be reflected in a written document or form that
- identifies what information may be released;
- identifies the individual or agency to whom the information may be released;
- indicates the length of time for which the consent is valid;
- includes a statement recognizing the client’s right to revoke consent any time before information is released;
- indicates the date on which the client signed the consent; and
- is signed by the client.

When client information is released on the basis of the client’s consent, a copy of the client’s consent must be maintained in the client’s case file. If a client has been adjudicated incompetent, his or her guardian may consent, on the client’s behalf, to the disclosure of client information. If a client is a minor child in the custody of the county social services department, the county social services director may consent to the disclosure of information regarding the client.

The rules allow a state or county social services agency to disclose client information without a client’s consent to
- other employees of the agency for the purpose of making referrals, supervision, consultation, or determination of eligibility; to another county social services agency in connection with the provision of assistance or services to the client;
- to public or private agencies or individuals that provide services to or on behalf of a state or county social services agency to the extent necessary to determine service requirements, to meet the needs of the client, or to provide eligibility information for reporting purposes;
- between the county social services department and the state Division of Social Services for the purpose of supervision and reporting;
- for approved research studies if individually-identifying information is safeguarded and the research reports will not contain the names of individual clients or other individually-identifying information;
- to federal, state, or county employees for the purpose of “monitoring, auditing, evaluating, or facilitating the administration of other state and federal programs” if the need for the information is justified and adequate safeguards are maintained to protect the information from redisclosure;
- for the purpose of complying with other state or federal statutes or regulations;
- pursuant to a court order (or a subpoena signed by a judicial official) that explicitly directs the release of client information.

When client information is disclosed without the client’s consent, the client must be notified of the disclosure and the disclosure must be documented in the client’s case file.

Similar confidentiality requirements apply to public and private agencies and individuals who provide social services to clients on behalf of or under contracts with state or county social services agencies.

Social services employees who fail to comply with the state confidentiality rules may be subject to disciplinary action, suspension, or dismissal.