Okla. Admin. Code § 340:65-1-2

Current through Vol. 42, No. 6, December 2, 2024

Section 340:65-1-2 - [Effective 9/14/2025] Purpose, legal basis, and confidential nature of case material

(a)Purpose. The purpose of this Chapter is to describe rules for the comprehensive management of Adult and Family Services (AFS) cases.

(b)Legal basis. Oklahoma Human Services (OKDHS) maintains the confidentiality of all applications, information, and records concerning applicants and recipients, per the Oklahoma Social Security Act located in Sections 161-260 of Title 56 of the Oklahoma Statutes (56 O.S. §§ 161-260) and the Federal Social Security Act.

(c)Custody of records. All case information including electronic data procured by, or available to, any OKDHS employee is OKDHS property and is used only in accordance with the provisions of federal laws, Oklahoma Statutes, and OKDHS rules.

(1)Authority to disclose information. The field manager is responsible for the custody and proper use of records in the OKDHS office. All requests for information from an OKDHS record are referred to the field manager, unless the request originates within OKDHS in carrying out its regular functions. Employees of each OKDHS division may exchange necessary information when working with the same family or a related case to provide benefits and services.

(2)Safeguarding case information. OKDHS employees safeguard case information, per Oklahoma Administrative Code (OAC) 340:1-1-20, OKDHS:2-41-15, OKDHS:2-45, OAC 340:65-3-6, and as provided in (A) through (D) of this subsection.

(A) The field manager is:

(i) the custodian of client records assigned to and located in an OKDHS office, or processed at an alternate work location; and

(ii) responsible for:

(I) taking reasonable precautions to ensure the confidentiality and proper use of client case information; and

(II) ensuring employees know OKDHS rules regarding safeguarding client case information and when and to whom information may be released.

(B) Per OKDHS:2-1-301, alternate work locations must be capable of safeguarding case information. When an alternate work location does not meet safeguarding standards, case information is not received, stored, or processed at that location.

(C) Practices for safeguarding information include:

(i) secure records storage in locked buildings, rooms, and containers;

(ii) securely storing OKDHS-owned electronic equipment;

(iii) controlling or restricting access to areas containing case information;

(iv) case information is:

(I) secured in a storage area, such as in a desk or file cabinet, when an employee is not present;

(II) not stored on any electronic device or storage media that is not OKDHS property;

(III) not emailed outside of OKDHS unless it is encrypted; and

(IV) destroyed in secure destruction bins when in paper form, after it is no longer needed or required; and

(v) providing reasonable privacy or restricted viewing of electronic data visible on computer screens or mobile devices.

(D) Information that must be safeguarded includes:

(i) names and addresses, including lists;

(ii) information contained in an application;

(iii) investigation reports;

(iv) medical data including, but not limited to, diagnosis and past history of disease and disability;

(v) correspondence and other records concerning the condition or circumstances of any person from whom or about whom information is obtained;

(vi) evaluations of information contained in (i) through (v) of this subparagraph; and

(vii) all data items available on computer screens. Disclosure to any unauthorized person is a federal and state regulation violation. Authorized persons are:

(I) the client;

(II) the client's authorized representative;

(III) OKDHS employees;

(IV) authorized volunteers; and

(V) other agencies' employees with a contract or agreement that allows access to specific data.

(3)Safeguarding federal tax information (FTI). Per Section 6103 of Title 26 of the United States Code (26 U.S.C. § 6103), OKDHS safeguards and restricts access to FTI to persons whose duties or responsibilities require access.

(A) FTI information that is safeguarded includes:

(i) the client's name;

(ii) the client's Social Security number;

(iii) Internal Revenue Service (IRS) reporting firm, company, and political subdivision;

(iv) state agency account number;

(v) income type; and

(vi) the amount of income or resources.

(B) AFS restricts FTI access to designated AFS FTI specialists who complete a favorably adjudicated suitability or security background investigation prior to handling FTI and annually thereafter. At a minimum, the background investigation must be at a tier-two level as designated by federal investigative standards and include:

(i) the results of a Federal Bureau of Investigation (FBI) fingerprint check using Form FD-258, FBI Applicant Fingerprint Card, from the state identification bureau. In Oklahoma, the Oklahoma State Bureau of Investigation Criminal Identification Section is the agency authorized to conduct FBI fingerprinting. The fingerprint results check the employee's criminal history in all 50 states;

(ii) a check of local law enforcement agencies where the employee lived, worked, or attended school within the last five years to identify trends of misbehavior and any identified arrests;

(iii) validating the employee's identity and eligibility to legally work in the United States (U.S.). New employees must complete the U.S. Citizenship and Immigration Services Form I-9, Employment Eligibility Verification, and be processed through E-Verify within three-business days of completing the form to assist with verifying the employee's employment status and the documents provided with Form I-9; and

(iv) completing another background investigation every five years following the previous background investigation's completion.

(C) AFS Information Security (IS) manager reviews a person's background investigation to determine if AFS should hire a job seeker, discipline or terminate an existing employee, and permit or terminate access to FTI. To evaluate past criminal offenses, felonies and misdemeanors, the AFS IS manager considers:

(i) whether OKDHS learned about the offense during the application or a subsequent reinvestigation;

(ii) what the position's duties and FTI access requirements are;

(iii) how much time has passed without a subsequent charge or conviction relating to a new offense;

(iv) whether the offender complied or is complying with any probation or parole terms;

(v) whether the offender has paid restitution; and

(vi) how any extenuating circumstances the offender offers mitigate the offense.

(D) Information safeguarding practices include:

(i) securing FTI, such as any written, typed, photocopied, or printed information from the Income Eligibility Verification System-Internal Revenue Service (IEVS-IRS), and Beneficiary and Earnings Data Exchange System (BENDEX) in a storage area, such as in a locked desk or file cabinet;

(ii) not viewing or storing FTI on any electronic device that is not OKDHS or state of Oklahoma property;

(iii) not printing or maintaining FTI in a non-electronic format;

(iv) not emailing FTI;

(v) not faxing FTI;

(vi) not sharing FTI in unapproved applications, such as Microsoft Office 365 applications including, but not limited to, Outlook, Yammer, Teams, SharePoint, OneDrive, and Planner; and

(vii) not bypassing access controls to enter a restricted area that contains FTI.

(E) FTI disclosure in violation of the guidelines specified in IRS Publication 1075, is a felony punishable by a fine in an amount not exceeding $5,000 or imprisonment of not more than five years, or both, together with the prosecution costs. Further, an AFS FTI specialist may lose access to FTI and be subject to disciplinary action, per OKDHS:2-1-7, when the specialist:

(i) does not properly safeguard FTI;

(ii) does not complete or pass the annual favorably adjudicated suitability or security background investigation; or

(iii) releases FTI to an unauthorized person(s), per 26 U.S.C. § 7213.

(4)Nature of information to be made available. General information not identified with any particular person or group of persons, such as total expenditures made, number of recipients, and other statistical information and social data contained in reports or surveys do not fall within the material to be safeguarded.

(A) Requested information is released to representatives of other agencies that are authorized by federal law or Oklahoma Statutes to have the information. Information may be released to other agencies only when they give assurance that the:

(i) confidential character of the information is preserved;

(ii) information is used only for purposes related to administering the assistance program and the inquiring agency's functionality; and

(iii) protection standards their agency establishes are equal to those OKDHS establishes, regarding both how their employees use the information and their protective procedures provisions.

(B) Client addresses may be disclosed to federal, state, and local law enforcement officers who furnish the client's name, Social Security number, and notify OKDHS that the location or apprehension of the client is within their official duties and that the client is:

(i) a fugitive felon who is fleeing to avoid prosecution, custody, or confinement after conviction; or

(ii) violating a probation or parole condition.

(C) The days and hours a child is approved for the Child Care Subsidy Program may be disclosed to a child care provider.

(D) Upon written request, information used to establish eligibility that is not otherwise legally protected is made available to the client or the client's representative during normal business hours. Confidential information, including the names of persons who have disclosed information about the client without the client's knowledge, and the nature or status of pending criminal prosecutions, is withheld.

(E) Information the employee obtains from collateral sources, other than public records or the employee's written evaluation of the client's situation, is not made available to the client or to any other person without the consent of the person who gave the information.

(F) Prior to a fair hearing, the designated OKDHS field employee is responsible for providing the client with a copy of the completed hearing summary and documents or other records the employee plans to present at the hearing.

(5)Information release at client request. Upon the client's, or the client representative's, written request, OKDHS may release client-provided information to the client or the authorized representative. When an OKDHS employee receives a written inquiry from an interested person, another agency, or the courts, and the client's written permission accompanies the inquiry, the employee may furnish the information when the written release specifies what client-provided information to release and to whom it may be released.

(6)Information release to courts. OKDHS employees may only release case information about the client in court proceedings upon subpoena, except upon a court official's request in cases of child abandonment and desertion, child neglect, or restitution when OKDHS referred such cases to the court. In these situations, OKDHS employees' testimony is limited to material affecting the administration of public assistance law except when participating in a case the client or the client's representative requested and in which the client's personal interests are at stake.

(A) When a court subpoenas an OKDHS employee to give testimony based upon OKDHS records, the field manager confers with OKDHS Legal Services (LS) regarding the proper way to convey to the court the confidential character of information made available to OKDHS in the process of administering assistance and OKDHS's duty, per 43A O.S. § 10-110, to protect its records.

(B) When there is reason to believe the court will not respect the confidential character of OKDHS records, the field manager communicates immediately with OKDHS LS to determine the best course of action to take.

(7)Information release to the District Attorney (DA). OKDHS employees may release information to the DA as necessary, to carry out OKDHS rules regarding child support pursuit from a non-custodial parent. When child support pursuit is required in order for a client to receive Temporary Assistance for Needy Families benefits or SoonerCare (Medicaid), AFS employees inform the client of this requirement.

(8)Medical information release. Medical information OKDHS or the Oklahoma Health Care Authority pays for may be released at the request of the person to whom it pertains, as well as to another agency to which the person applied for services with the objective to protect or advance the person's welfare. There is nothing in federal law or Oklahoma Statutes to prevent a physician from releasing medical information to the physician's patient or a patient's authorized representative. In such instances, the physician-patient relationship governs the physician.

(A) OKDHS LS is responsible for determining if the requested medical information may be released under federal regulations and OKDHS rules.

(B) AFS employees do not release information obtained from the U. S. Department of Veterans Affairs or from the Social Security Administration to anyone outside of OKDHS.

(C) When a client requests a fair hearing on a medical decision, all medical records or reports considered in establishing a medical decision are provided to the client or the client's authorized representative at a reasonable time before the hearing except for psychological and psychiatric records and medical records regarding alcohol or substance abuse treatment. Copies of psychological and psychiatric records and medical records regarding alcohol or substance abuse treatment are only released with the treating physician's or practitioner's consent or when a court of competent jurisdiction orders it released upon a finding that it is in the patient's best interest.

Okla. Admin. Code § 340:65-1-2

Amended at 10 Ok Reg 1147, eff 3-9-93 (emergency); Amended at 10 Ok Reg 2303, eff 6-11-93; Amended at 17 Ok Reg 3233, eff 8-1-00 (preemptive); Amended at 18 Ok Reg 2096, eff 7-1-01; Amended at 26 Ok Reg 1272, eff 6-1-09; Amended at 29 Ok Reg 812, eff 7-1-12

Amended by Oklahoma Register, Volume 36, Issue 24, September 3, 2019, eff. 9/16/2019

Amended by Oklahoma Register, Volume 39, Issue 24, September 1, 2022, eff. 9/15/2022

Amended by Oklahoma Register, Volume 40, Issue 22, August 1, 2023, eff. 9/15/2023

Amended by Oklahoma Register, Volume 41, Issue 15, April 15, 2024, eff. 3/15/2024, exp. 9/14/2025 (Emergency)

Amended by Oklahoma Register, Volume 41, Issue 23, August 15, 2024, eff. 9/16/2024