The Executive Director of each CAO may give information to private individuals, officials or agencies outside DHS, within the limits explained in this chapter. The Executive Director may delegate this authority only to top level supervisors. The CAO will allow only enough access and use of PHI (Private Health Information) to accomplish the intended purpose of the disclosure.
The County Assistance Office will protect all information about benefits of an applicant, recipient, and non-applicant household member from disclosure. The CAO may use or disclose protected information for the following purposes:
To determine eligibility for benefits
To administer benefits
The CAO may use and disclose PHI without the individuals' authorization in these situations:
To share information with the individual who is the subject of the PHI.
For treatment, payment, and normal CAO operations such as:
Providing an ACCESS card number to a pharmacy so the individual can get his medication.
Sharing information with a food bank, homeless shelter or employment and training contractor.
In an emergency or crisis situation, providing necessary information to improve the situation (it is very important for the CAO to do this).
To share information with a friend, relative or other individual at the individuals’s request.
For specified purposes without consent or authorization, as required by law (See Sections 930.31, 930.33, and 930.34).
For purposes other than treatment, payment and normal operation, the CAO may also disclose information with the individual's signed authorization. For example, the individual may ask the CAO to disclose information to a housing agency or employer.
NOTE: It is not disclosure when the CAO makes a referral to another agency without providing applicant/recipient information.
The CAO will protect the rights of the individual to ensure the information will be used for purposes associated with assistance programs or as authorized in this chapter:
The receiving agency or official must only use the information for the purpose it was made available, and
Privacy standards must be at least equal to DHS privacy standards.
NOTE: Entities that receive information from DHS about applicants, recipients, and non-applicant household members to administer benefits, including USCIS, MCOs, RESET contractors and OSIG must be bound by the same privacy rules as DHS, must only use the information for the purpose it was made available, and must protect the information from disclosure.
EXAMPLE: In the application Jane submits for Julie's and John's Medicaid, Jane states that she is employed, and that John is a lawful permanent resident. The CAO may use information about Jane and her income on the Income Eligibility Verification System (IEVS) to verify her income. The CAO may disclose information about John to USCIS via SAVE to verify that he is a lawful permanent resident. The information the CAO disclosed to IEVS or USCIS is not used for any purpose other than to verify Jane's income and John's immigration status and is not used by USCIS for immigration enforcement. Once Jane and John are determined eligible for MA, information may be shared with an MA Managed Care Organization (MCO) so that the MCO may make MA payment for Jane's and John's medical services. The information shared with the MCO is not used for any purpose other than to administer Julie's and John's MA benefits and provide Julie and John with MA services.
There are very limited circumstances under which protected information may be shared with entities outside of DHS for reasons other than determining eligibility or administering benefits.
The CAO may disclose information:
To the individual or the individual's representative upon request.
To conduct an administrative audit, review, or evaluation of a benefits program.
To collect benefits that have been overpaid or that are owed to DHS as reimbursement.
To OSIG to investigate or prosecute benefits intentional program violations or fraud cases.
Protecting the Welfare of Certain Individuals: The CAO will provide information to other agencies when needed to protect the rights or welfare of children and adults who are unable to manage their own affairs or otherwise protect their rights, and:
The information is necessary to get services the individual has requested.
The services will advance the individual's welfare.
The individual has authorized the CAO to release the specific information to the agency.
In TANF cases, to establish and enforce child support orders: The CAO will provide information to the Domestic Relations Section (DRS), such as scheduled dates and times an individual will appear at the CAO. DRS may use the information to arrest an individual or serve a warrant for child support related matters only.
The CAO will advise DRS they must complete any action to serve the warrant or make the arrest outside the CAO, not on CAO property. The intent is to cooperate fully with DRS on child support and paternity issues, but not allow disruption of business inside the CAO.
NOTE: Written authorization is not necessary for the CAO to provide information to outside agencies for the purposes of restitution and collection, protecting the welfare of certain individuals, and cooperating with IV-D agencies.
The CAO must get authorization when there is a subpoena for information as evidence for a legal hearing not involving public assistance benefits fraud or welfare fraud.
The CAO will request legal advice using these steps:
Phone the Office of General Counsel (OGC) at 717-783-6563 to obtain the name of the designated staff attorney. (Philadelphia Area: 215-560-2192)
Email or fax the following information to the designated OGC attorney. Include "Law Enforcement individual Inquiry" on the email subject line. Copy the designated Operations staff person in the email. Copy the Operations Headquarters Staff Assistants on the email. Include the following information in the email:
Agency
Phone Number
The information requested
County, case record number and what benefits the individual receives
Copy of the request (subpoena, authorization, court order).
Exact receipt date and manner the document was served, such as by personal service or certified mail.
Name and telephone number of individuals who received the document.
Name, title, and telephone number of the contact person for giving additional information to OGC.
Direct any questions to OGC. The OGC will provide direction based on the CAO request. The CAO is not to take any action unless OGC directs it to do so.
NOTE: A CAO employee may be subpoenaed to testify as an expert witness about the Department’s policies and procedures. The CAO may also be subpoenaed to testify about the demeanor, condition or other fact not involving the individual's record or statements. The CAO will follow the above steps to request OGC legal guidance in these situations.
When a CAO receives a request for individual information from any law enforcement officer, i.e., police, probation, parole or a constable, the CAO is required to contact the Office of General Counsel (OGC) for instructions using the following procedure:
Phone the OGC at 717-783-6563 to obtain the name of the designated staff attorney.(Philadelphia Area: 215-560-2192)
Email or fax the following information to the designated OGC attorney. Include "Law Enforcement individual Inquiry" on the email subject line. Copy the designated Operations staff person in the email. Copy the Operations Headquarters Staff Assistants on the email. Include the following information in the email:
Officer's name
Agency
Phone Number
The information requested
County, case record number and what benefits the individual receives
Copy of the request (subpoena, authorization, court order)
If a criminal law enforcement officer is only requesting address information and provides a search warrant, a contact with the OGC is not required.
NOTE: Criminal law enforcement officers include police officers, constables, parole officers and probation officers. Officers of all other government agencies, including IRS agents and immigration agents, are not criminal law enforcement officers.
For SNAP recipients, the CAO may give Constables and other law enforcement officers the individual's address only if the warrant or subpoena was issued because:
7 CFR 272.1(c) 7 USC 2020(e)(8) 62 P.S. 404
The individual was violating a condition of probation or parole.
The individual was fleeing to avoid prosecution for a felony.
Release of the information is related to a welfare fraud case.
NOTE: Release information other than an address only in connection to welfare fraud prosecution.
The CAO will use State Data Exchange (SDX) information only to determine if an individual qualifies for SNAP, MA, interim assistance, special items allowances, burial services, and social services. The CAO will not provide or release the names of or information about SSI individuals to other agencies or offices within DHS unless the SSI individual or his representative authorizes the release.
55 Pa. Code § 105.1 (c)(1) 55 Pa. Code § 105.1 (d)(3)
NOTE: The CAO may release SDX information to comply with a Social Security Administration (SSA) request for an audit or review of SSI cases.
With written authorization, an individual may authorize disclosure of PHI for purposes other than treatment, payment, or normal CAO operations. An individual may authorize release of information by completing the HIPAA Authorization for Use or Disclosure of Personal Information Form (HS 1815). See Appendix A. The CAO's may accept a fully completed SSA-827 as valid authorization that satisfies the requirements of HIPAA, the Mental Health Procedures Act, the Confidentiality of HIV-related Information Act and Drug and Alcohol confidentiality laws. When appropriate, the CAOs can release requested information to Labor and Industry (L & I) (SSA's representative) based on a completed SSA-827 without requiring the individual to fill out the HS-1815.
This form is for a specific time or event. It covers the release of information other than for treatment, payment, and normal operations. For example, the individual may request release of information to an attorney or insurance agency.
NOTE: If unsure whether disclosure requires authorization, request a clarification from the Privacy Officer through the Area Manager.
Disclosures that do not require authorization include:
Reporting child abuse or neglect.
Releasing case record information related to judicial or administrative proceedings, court orders and subpoenas about public assistance benefits fraud or welfare fraud. See Section 930.33 for the policy on subpoenas of Applicant/Recipient information.
Providing information, such as an address, to law enforcement officials as specified in Section 930.34.
Providing an individual information to a coroner/medical examiner or funeral director, or
Reporting actions to prevent serious threats to health or safety, such as calling the police for intervention.
The CAO must obtain proof of identity of an individual or agency requesting PHI. It must also verify the authority of the individual or agency if they are not part of DHS normal business operation and are not known to the CAO.
The CAO may accept:
Requests for information made in writing on appropriate government letterhead.
Written statements of an individual or agency’s legal authority.
Oral statements of an individual or agency’s legal authority, unless the CAO doubts that the statement is true or doubts the motive for using the requested information.
Oral requests from eligibility workers in other states’ Cash Assistance or MA program offices. Note the response to these requests in the case record.
The CAO may fax PHI information. Be sure the fax goes to the correct individual. The CAO must verify the fax number before sending a fax. Ask for confirmation of its receipt. Write this sentence on the fax cover sheet:
“If you receive this fax in error, please contact the sender immediately and destroy the faxed materials.”
The CAO may not email PHI to anyone outside of the Commonwealth network.
Individuals have the right to receive a report (accounting) of certain disclosures made without their authorization. See Section 930.36 for the list of relevant disclosures. The individual or his personal representative must make a written request to receive an accounting. See Appendix A for a copy of PA 1807, Request for Accounting of Disclosures.
The CAO must complete a PA 1800, HIPAA Disclosure Tracking System Form for each disclosure subject to an accounting. The PA 1800 is available on Docushare and Sharepoint. Inquiries and disclosures concerning treatment, payment and normal business operations do not need to be tracked.
NOTE: A disclosure to the individual is not subject to tracking. A disclosure to a law enforcement official is subject to tracking.
The CAO will refer requests for accounting of disclosures to the DHS Privacy Officer. Send a copy to the Area Manager and the OIM Client Privacy Coordinator in the Bureau of Program Support. DHS must act on the request no later than 60 days after receiving the request.
Disclosures made with the individual's signed authorization are not subject to the requirements of the Disclosure Tracking System.
The individual may request restrictions to the use and disclosure of PHI. The request must be in writing. See Appendix A for Form PA 1801, Request for Restrictions on the Use and Disclosure of Protected Health Information.
The CAO will agree to reasonable and possible restrictions, except uses and disclosures required for eligibility and program purposes or required by law. Ask the Privacy Officer for clarification through the Area Manager if unsure whether to approve a requested restriction.
When the CAO receives a written request for restrictions, it will:
Date stamp the request.
Document in the case record the decision to accept or deny the request, and
Keep the documentation in the record for six years.
The CAO informs the individual of the decision verbally or by letter. If the individual disagrees with the decision, the individual may file a complaint to challenge the decision using procedures in Section 930.7.
Revised October 24, 2023, replacing April 30, 2018