Private Data
1. Private data includes all information on persons that has been gathered by this program or from
other sources for program purposes as contained in an individual data file, including their presence
and status in this program.
2. Data is private if it is about individuals and is classified as private by state or federal law. Only the
following persons are permitted access to private data:
a. The individual who is the subject of the data or a legal representative.
b. Anyone to whom the individual gives signed consent to view the data.
c. Employees of the welfare system whose work assignments reasonably require access to the
data. This includes staff persons in this program.
d. Anyone the law says can view the data.
e. Data collected within the welfare system about individuals are considered welfare data. Welfare
data is private data on individuals, including medical and/or health data. Agencies in the welfare
system include but are not limited to: Department of Human Services; local social services
agencies, including a person’s case manager; county welfare agencies; human services boards;
the Office of Ombudsman for Mental Health and Developmental Disabilities; and persons and
entities under contract with any of the above agencies; this includes this program and other
licensed caregivers jointly providing services to the same person.
f. Once informed consent has been obtained from the person or the legal representative there is
no prohibition against sharing welfare data with other persons or entities within the welfare
system for the purposes of planning, developing, coordinating, and implementing needed
services
3. Data created prior to the death of a person retains the same legal classification (public, private,
confidential) after the person’s death that it had before the death.
B. Providing Notice
At the time-of-service initiation, the person, and his/her legal representative, if any, will be notified of
this program’s data privacy policy. Staff will document that this information was provided to the
individual and/or their legal representative in the individual record.
C. Obtaining Informed Consent or Authorization for Release of Information
1. At the time informed consent is being obtained staff must tell the person or the legal representative
individual the following:
why the data is being collected.
b. how the agency intends to use the information.
c. whether the individual may refuse or is legally required to furnish the information.
d. what known consequences may result from either providing or refusing to disclose the
information; and with whom the collecting agency is authorized by law to share the data. What
the individual can do if they believe the information is incorrect or incomplete.
e. how the individual can see and get copies of the data collected about them; and any other rights
that the individual may have regarding the specific type of information collected.
2. A proper informed consent or authorization for release of information form must include these
factors (unless otherwise prescribed by the HIPAA Standards of Privacy of Individually Identifiable
Health Information:
a. be written in plain language.
b. be dated.
c. designate the agencies or person(s) who will get the information.
d. specify the information which will be released.
e. indicate the specific agencies or person who will release the information.
f. specify the purposes for which the information will be used immediately and in the future.
g. contain a reasonable expiration date of no more than one year; and
h. specify the consequences for the person by signing the consent form, including:
“Consequences: I know that state and federal privacy laws protect my records. I know:
• Why I am being asked to release this information.
• I do not have to consent to the release of this information. But not doing so may affect
this program’s ability to provide needed services to me.
• If I do not consent, the information will not be released unless the law otherwise allows
it.
• I may stop this consent with a written notice at any time, but this written notice will not
affect information this program has already released.
• The person(s) or agency(ies) who get my information may be able to pass it on to
others.
• If my information is passed on to others by this program, it may no longer be protected
by this authorization.
• This consent will end one year from the date I sign it, unless the law allows for a longer
period.”
i. Maintain all informed consent documents in the consumer’s individual record.
D. Staff Access to Private Data
1. This policy applies to all program staff, volunteers, and persons or agencies under contract with this
program (paid or unpaid).
2. Staff persons do not automatically have access to private data about the persons served by this
program or about other staff or agency personnel. Staff persons must have a specific work function
need for the information. Private data about persons are available only to those program employees
whose work assignments reasonably require access to the data; or who are authorized by law to
have access to the data.
3. Any written or verbal exchanges about a person’s private information by staff with other staff or any
other persons will be done in such a way as to preserve confidentiality, protect data privacy, and
respect the dignity of the person whose private data is being shared.
4. As a rule, doubts about the correctness of sharing information should be referred to the supervisor.
E. Individual access to private data.
Individuals or their legal representatives have a right to access and review the individual record.
A staff person will be present during the review and will make an entry in the person’s progress
notes as to the person who accessed the record, date and time of review, and list any copies made
from the record.
2. An individual may challenge the accuracy or completeness of information contained in the record.
Staff will refer the individual to the grievance policy for lodging a complaint.
3. Individuals may request copies of pages in their record.
4. No individual, legal representative, staff person, or anyone else may permanently remove or destroy
any portion of the person’s record.
F. Case manager access to private data.
A person’s case manager and the foster care licensor have access to the records of person’s served by
the program under section 245D.095, sub. 4.
C. Requesting Information from Other Licensed Caregivers or Primary Health Care Providers.
1. Complete the attached release of information authorization form. Carefully list all the consults,
reports or assessments needed, giving specific dates whenever possible. Also, identify the purpose
for the request.
2. Clearly identify the recipient of information. If information is to be sent to the program’s health
care consultant or other staff at the program, include Attention: (name of person to receive the
information), and the name and address of the program.
3. Assure informed consent to share the requested private data with the person or entity has been
obtained from the person or the legal representative.
4. Keep the document in the person’s record.