In my last blog post about the confidentiality of adult protective services (APS) information, I described a five-step framework for determining when a department of social services (DSS) may release APS information (see flowchart here). The first step in that framework asks whether a state or federal law requires the disclosure of the confidential information. This blog post discusses some statutes and rules that require disclosure of APS information (to specific parties in specific circumstances) or give a particular agency or individual the right to access or inspect APS information. Note, however, that this post does not provide an exhaustive list of the various federal and state laws that may require the disclosure of certain APS information—nor does it discuss laws that allow (but do not require) DSS to disclose information.

DSS Disclosures of APS Information Required by Federal Law

To a “Protection and Advocacy” agency.  The Developmental Disabilities Assistance and Bill of Rights Act (DD Act) provides for each state to designate a public or private entity as the Protection and Advocacy (P&A) system that protects and advocates for the rights of individuals with developmental disabilities, including investigating incidents of abuse or neglect. The DD Act and its implementing regulations require that access to records—including records confidential under state law—be given to P&As under certain circumstances. Statutes and regulations regarding a P&A’s right to access records are found at 42 U.S.C. 15043(a)(2)(I)-(J) and 45 C.F.R. 1326.25. Depending on the nature of the incident at issue, a P&A may have authority to access records under other federal regulations, such as 42 C.F.R. 51.41 (which applies to records of individuals with mental illness). Disability Rights North Carolina is the designated P&A agency for the state of North Carolina.

To a federal agency investigating violations of civil rights laws. The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) enforces many nondiscrimination statutes and regulations that apply to programs, services, and activities receiving HHS federal financial assistance (including Title VI of the Civil Rights Act of 1964 and Title II of the Americans with Disabilities Act).  Some of these laws require that a federal funding recipient give OCR access to records and information as needed to investigate a civil rights complaint or otherwise assess compliance. For example, 45 CFR 80.6(c) requires a funding recipient to allow OCR (or its designee) to examine its records and access information as needed to ascertain compliance with Title VI, including information that would otherwise be confidential under state law.

DSS Disclosures of APS Information Required by APS-Specific State Laws

Most of a county DSS’s obligations to disclose APS information to specific parties are found in Title 10A, Chapter 71A of the North Carolina Administrative Code (NCAC), while some are found in the North Carolina General Statutes.

To the individual who made the APS report (the “complainant”). Immediately after DSS completes its evaluation of an APS report, it must provide a notice to the complainant stating whether or not the report is substantiated. If the report is substantiated, the notice must also state that DSS is providing continued services.  The information given to the complainant must not include any specific findings of the APS evaluation. The complainant may choose whether they want this notice to be oral or in writing, but in either case, DSS must document when and how the notice is given. 10A NCAC 71A .0907.

To the district attorney. If DSS finds evidence indicating that someone has abused, neglected, or exploited a disabled adult, DSS must notify the district attorney. The notification to the district attorney must be in writing and contain certain categories of information. See 10A NCAC 71A .0906. If requested, DSS must also share the specific findings of its APS evaluation with the district attorney to help with the investigation or prosecution of abuse, neglect, or exploitation of a disabled adult (in cases where DSS has found evidence of abuse, neglect, or exploitation). 10A NCAC 71A .0803.

To a law enforcement agency. If DSS finds evidence of abuse, neglect, or exploitation of a disabled adult, DSS must share the specific findings of its APS evaluation with law enforcement agencies (upon their request) to help with a criminal investigation or prosecution of abuse, neglect or exploitation. 10A NCAC 71A .0803.  Note that even prior to the competition of its APS evaluation, DSS may immediately share information with the district attorney or a law enforcement agency if there is reason to believe that physical harm may occur to the disabled adult. 10A NCAC 71A .0201(c).

To another county DSS.

• When an adult client who is receiving protective services under a court order moves from one county to another, the first county DSS may make an APS referral to the second county DSS without the client’s consent. If the second county requests information in order to conduct its own APS evaluation, the first county must provide the necessary information, including all information about the initial report, results of the APS evaluation, and services provided to the client. 10A NCAC 71A. 0804.
• If, in the course of an APS evaluation or providing APS services, a county DSS has reasonable cause to believe that another disabled adult is in need of protective services, the DSS must make a report to the DSS in the county where the adult resides or is present. G.S. 108A-102. Likewise, if DSS has cause to suspect that a juvenile is abused, neglected, or dependent, or has died as the result of maltreatment, the DSS must make a report to the DSS in the county where the juvenile resides or is found. G.S. 7B-301. In either case, a county DSS may disclose confidential information to the extent necessary to make a report (either internally or to a DSS in a different county).

In situations involving patients or residents of nursing, combination, and residential care facilities. Specific requirements apply when an APS report is made regarding a patient or resident of a nursing, combination, or residential care facility.

• To the facility administrator. The DSS director must provide the administrator of the facility with a written summary of the nature of the protective services report, which must be limited to (1) acknowledgement that a protective services report was received on a specified patient or resident of the facility; (2) the specific allegations in the report; (3) whether or not evidence of abuse, neglect or exploitation was found; (4) whether or not the need for protective services was substantiated; and (5) a general statement as to how the conclusion was reached. In this summary, the director must not identify the complainant/reporter or any individuals who were contacted during the evaluation to obtain information. 10A NCAC 71A .0502.
• To regulatory agencies (10A NCAC 71A .0503).
  • In the case of any APS report regarding a patient or resident of a nursing, combination, or residential care facility, a copy of the written APS evaluation report (see 10A NCAC 71A .0901) must be sent to the Division of Health Service Regulation (DHSR) within 30 days of completing the evaluation. If DHSR needs and requests the name of the complainant/reporter or the names of individuals who provided information during the evaluation in order to carry out an investigation, DSS must share that information verbally with DHSR.
  • If DSS finds evidence of abuse, neglect, or exploitation during an evaluation of such a report, the DSS director must immediately notify DHSR by telephone, and must also inform DHSR whether the need for protective services will be substantiated.
  • If DSS finds violations of licensure standards during its evaluation but it appears that a report of a need for protective services will not be substantiated, the DSS director must report those violations immediately to the appropriate supervisory agency for the facility in question (DHSR for facilities licensed under G.S. 122C; adult home specialist within the county DSS for facilities licensed under G.S. 131D-2).
  • If DSS finds evidence of financial exploitation in a Medicaid-funded facility, DSS must send a copy of the written report to the Division of Medical Assistance and DHSR.

DSS Disclosures of Information Required by Other State Laws

Some other North Carolina laws that are not specific to APS may, in some cases, require a DSS to disclose APS information or allow a particular party to review that information.

To “the client.”  A client of DSS has the right to “review or obtain without charge a copy of the information in his or her [DSS] records.”  10A NCAC 69 .0301. DSS must provide this access within five business days after receiving the request. The definition of “client” for purposes of this rule includes “someone acting on behalf of the client in accordance with their right to act on the client’s behalf under a legal order, federal or State law.” See 10A NCAC 69 .0101.

There are three exceptions to this right of access:

• information that DSS is required to keep confidential by other state or federal statutes, rules, or regulations (i.e. specific statutes or regulations other than S. 108A-80 and 10A NCAC Chapter 69, which apply broadly to all social services client information);
• confidential information originating from another agency; or
• information that would breach another individual’s right to confidentiality under State or federal statutes, rules, or regulations.

Some APS information will be subject to the APS confidentiality rules in 10A NCAC 71A (or other state or federal confidentiality laws) and therefore will fall under the first exception. For example, the “specific findings” of the APS evaluation are confidential under 10A NCAC 71A .0803 (but note that rule allows for the release of those findings via the consent of “the disabled adult”—a term which has a different definition than “client”). Likewise, the identity of the reporter of abuse, neglect, or exploitation is confidential under 10A NCAC 71A .0802 and could not be disclosed under this client right of access rule.

To the State or Regional Long-Term Care Ombudsman. G.S. 143B-181.20(e) gives the State Long-Term Care Ombudsman and each Regional Long-Term Care Ombudsman the right to obtain “access to files and records that will enable the Ombudsman to properly perform his duties and exercise his powers.” The statute does not require DSS to disclose information that is “privileged by law” (for example, information protected by attorney-client privilege) to the Ombudsman.

To the Chief Medical Examiner or county medical examiner. When a medical examiner is investigating the cause and manner of an individual’s death, the Chief Medical Examiner or the county medical examiner are statutorily authorized to “inspect and copy the medical records” of the individual whose death is under investigation. G.S. 130A-385(1).

A medical examiner’s right to access other records held by DSS—anything other than a decedent’s medical records—depends on whether the decedent’s death is also under a criminal investigation.

• If the death is not under criminal investigation, the Chief Medical Examiner or county medical examiner are statutorily authorized to “inspect all…documents that may be relevant to determining the cause and manner of death” of the decedent. G.S. 130A-385(2).
• If the death is under criminal investigation, the Chief Medical Examiner or the county medical examiner is not authorized to inspect other documents (besides medical records) “at the scene” of death except as permitted by the investigating law enforcement agency. Moreover, the statute states that a medical examiner may not obtain an administrative search warrant in cases where the death is under criminal investigation. G.S. 130A-385(3).
• What if the death is under criminal investigation but the records sought by the medical examiner are not “at the scene” of the decedent’s death? The statute is silent on this point. It does not give the medical examiner any explicit statutory right to inspect documents (other than medical records) that are located away from the scene of the decedent’s death. However, the statute also does not impose any limitations on the medical examiner’s authority to examine relevant records or documents that are located away from the scene of death (except that it does not authorize the issuance of an administrative search warrant for the medical examiner to inspect such records). Accordingly, while the medical examiner may request to examine such records, DSS is not required by law to allow such inspection as it is in cases where the death is not under criminal investigation (see G.S. 130A-385(2)), and should refer to APS confidentiality laws when determining whether it may disclose such records. Regardless of the location of the records or the status of whether the death is under criminal investigation, the medical examiner has a right to review the decedent’s medical records (see G.S. 130A-385(1)).

To a county DSS if necessary to evaluate an A/N/D report or provide protective services to a juvenile. In some circumstances, a county DSS may gather information in an APS case that is somehow relevant to a child welfare case involving a juvenile. A county DSS director may make a written demand for any information or reports, whether or not confidential, that may be relevant to the assessment of a report alleging abuse, neglect, or dependency of a juvenile or relevant to the provision of protective services to a juvenile. The entity receiving the demand (including any county DSS) must provide such information to the requesting DSS director unless protected by attorney-client privilege or prohibited by federal law. G.S. 7B-302(e).

What Happens When Two Laws Conflict?

Navigating legally required disclosures of information is challenging, particularly when a required disclosure appears to conflict with an applicable confidentiality law. This comes up primarily in two areas described above: (1) where disclosures are required by federal law, and (2) where disclosures are required under state laws that are not specific to APS (i.e. laws outside of Article 6A of G.S. 108A or 10A NCAC 71A). It is sometimes difficult for DSS to know whether to follow the law saying certain information must be kept confidential or the law saying that same information must be disclosed. For example, 10A NCAC 71A .0802 makes the identity of the individual who reported abuse, neglect, or exploitation to DSS confidential, and states it can only be disclosed by DSS in very limited circumstances. But some of the federal and state laws above may require disclosure of such information at the request of a specific agency in circumstances other than those permitted by 10A NCAC 71A .0802. What is a DSS to do when faced with such a conflict?

When evaluating this type of conflict between legal requirements, there is a clear distinction between a disclosure that is required under federal law versus state law. If a DSS is prohibited from disclosing information under federal law, DSS should not disclose such information, even if the disclosure would be required under state law. Conversely, if a DSS is allowed to disclose information under federal law but is prohibited from disclosing such information under state law, the DSS should not disclose such information, even though it would be permitted under federal law. However, if federal law requires—not simply allows—disclosure, the information should be disclosed, even if there is a state law prohibiting disclosure. A graphic showing how these laws interact is below.

The answer is clear when the conflict is between a federally-mandated disclosure and a state prohibition on disclosure—the federal law must be followed. A trickier scenario arises when the conflict is between two different state laws—one law that gives an agency or official a right of access to records and information, and another law prohibiting DSS from disclosing such records and information. This is particularly challenging with respect to the three categories of APS information that I have highlighted in this blog post on disclosing APS information that receive heightened protection under North Carolina law —identity of the complainant/collateral contacts, specific findings of the APS evaluation, and financial records from a financial institution.

In the event of such a conflict between state laws, DSS may want to start by informing the requesting agency or official about the APS-specific statute or rule that generally prohibits DSS from disclosing such information (e.g. 10A NCAC 71A .0802, 10A NCAC 71A .0803, or G.S. 108A-116(d). It is possible that the requesting agency or official may be unaware of the APS-specific confidentiality laws and may not even need the specific pieces of information that are protected by those laws. DSS should also ask the agency or official to confirm the specific statute or rule that gives the agency or official a right of access to this information. If, however, the requesting agency or official still wants the information and takes the position that their statutory right of access under state law supersedes DSS’s confidentiality obligations under state law, DSS will then have to make a judgment call regarding how to proceed. One option is that DSS could simply disclose the information, relying on the state statute or rule that gives the particular agency or official a right of access to DSS’s records or information. There is support for this approach under the theory that if the legislature had wanted to carve out specific categories of information (such as APS information) from a particular statutory right of access, it could have done so but intentionally chose not to make such an exception. Alternatively, some departments of social services may still be concerned about disclosing the information and decide to take a different approach by pressing the requesting agency or official to obtain a court order to disclose the information (a court order would be sufficient for DSS to disclose the information protected under 10A NCAC 71A .0802, 10A NCAC 71A .0803, or G.S. 108A-116(d)).

Conclusion

The examples of when DSS must disclose confidential APS information described above, while numerous, are not exhaustive. There may be other statutes and rules that require DSS to disclose APS information in certain circumstances. As with any decision about confidential information, DSS staff should consult with legal counsel if they are unsure whether a particular disclosure of APS information is required, permitted, or prohibited.