This regulation establishes the Connecticut Department of Mental Health and Addiction Services' personal data systems, covering personnel, fiscal, affirmative action, and patient/client records. It sets requirements for how the department must collect, maintain, retain, and protect personal data, and outlines individuals' rights to request disclosure or amendment of their records. Facility operators and department staff must follow prescribed retention schedules, accuracy standards, and access controls for all personal data systems.
View official sourceAgency Department of Mental Health Subject Personal Data Inclusive Sections §§ 17a-451(c)-1—17a-451(c)-5 CONTENTS Sec. 17a-451(c)-1. Definitions Sec. 17a-451(c)-2. General nature and purpose of personal data systems Sec. 17a-451(c)-3. Maintenance of personal data Sec. 17a-451(c)-4. Disclosure of personal data Sec. 17a-451(c)-5. Procedure for contesting the content of personal data - I- Revised: 2015-3-6 R.C.S.A. §§ 17a-451(c)-1—17a-451(c)-5 Regulations of C onnecticut State Agencies TITLE 17a. Social & Human Services & Resources Revised: 2015-3-6 D epartm ent of M ental H ealth R.C.S.A. §§ 17a-451(c)-1—17a-451(c)-5 §17a-451(c)-2 Personal Data Sec. 17a-451(c)-1. Definitions As used in Sections 17a-451 (c)-1 to 17a-451 (c)-5, inclusive: (a) “Category of personal data” means the classifications of personal information set forth in the Personal Data Act, Conn. Gen. Stat. Sec. 4-190 (9), as may be amended from time to time. (b) “Department” means the Department of Mental Health and its divisions and facilities as defined in Conn. Gen. Stat. Sec. 17a-450 (a) and (b), as may be amended from time to time, the Regional Offices, and the Commissioner and her/his designees. (c) “Other data” means any information which because of name, identifying number, mark or description can be readily associated with a particular person. (d) “Patient/Client” means any individual who is receiving treatment or service(s) or who has received treatment or service(s) in/through any facility operated by the Department of Mental Health, either directly or under contract, or in/through a grantee agency of the Department of Mental Health or who has requested information regarding treatment or services. (e) Definitions contained in Conn. Gen. Stat. Sec. 4-190, as may be amended from time to time, shall apply to these regulations. (Effective March 4, 1993) Sec. 17a-451(c)-2. General nature and purpose of personal data systems The Department of Mental Health maintains the following personal data systems: (a) Personnel Records (1) Personnel records are maintained at the Department facility which employs the individual or which has the individual on its payroll for administrative purposes. A directory listing sites where personnel records are kept is located at the Department of Mental Health, Personnel Unit, 90 Washington Street, Hartford, Connecticut, 06106. (2) Personnel records are maintained in both manual and automated forms. (3) The purpose of the personnel records system is to provide data necessary for personnel and payroll management activities and/or to satisfy the requirements of state or federal laws. (4) The title and business address of the Department official responsible for this system of records and to whom requests for disclosure or amendment of the records in the system should be directed may be obtained from the directory referred to in subsection (1) above. (5) Routine sources of data in these records may include applicants for employment, employees, previous employers, references, and other state agencies. (6) Personal data in these records are maintained under authority of Conn. Gen. Stat. Secs. 5-193 to 5-269, inclusive, and 54-142k (k), as may be amended from time to time. (7) Categories of personal data maintained in this system may include birth date, sex, race, educational history, licensure/certification, employment history, financial information, medical or emotional condition or history, family or other relationships, administrative - 1- Regulations of C onnecticut State Agencies TITLE 17a. Social & Human Services & Resources Revised: 2015-3-6 D epartm ent of M ental H ealth R.C.S.A. §§ 17a-451(c)-1—17a-451(c)-5 §17a-451(c)-2 investigation material, disciplinary action, reputation or character information and conviction records. (8) Categories of other data maintained in this system may include address, phone number and social security number. (9) These records are maintained on applicants for employment and on current and former employees of the Department. (10) These records are routinely used by employees of the Department who are assigned responsibility for personnel, payroll and employment-related activities. (b) Fiscal Services Records (1) Fiscal services records are maintained at the Department facility which provides fiscal services to the individual DMH site. A system directory listing the sites where fiscal records are kept is located in the Department of Mental Health, Fiscal Services Unit, 90 Washington Street, Hartford, Connecticut, 06106. (2) Fiscal services records are maintained in both manual and automated forms. (3) The purpose of the fiscal services records system is to maintain vendor payment records, personal services contracts, reimbursement records for employee travel expenses, records of private donations, patient accounts, activity fund, general welfare fund, and to reflect activities required to secure federal and state funding for programs of the Department and its grantees. (4) The title and business address of the Department official responsible for this system of records and to whom requests for disclosure or amendment of the records in the system should be directed may be obtained from the system directory referred to in subsection (1) above. (5) Routine sources of data in these records may include donors, vendors, employees, patients/clients, contractors, grantees and other state and federal agencies. (6) Personal data in these records are maintained under authority of Conn. Gen. Stat. Secs. 17a-450, as may be amended from time to time. (7) Categories of personal data maintained in this system may include birth date, educational history, licensure/certification, employment history, financial information, and medical condition. (8) Categories of other data maintained in this system may include address, telephone number, social security number, employee number, provider information, fee amount, case number, patient/client account number, and information pertaining to Department application for and receipt of state and federal payments. (9) These records are maintained on current and former donors, vendors, contractors, grantees, patients/clients and employees. (10) These records are routinely used by employees of the Department who are assigned responsibility to manage the grants, contracts, vendor payments, donations and employee travel reimbursements for the Department. (c) Affirmative Action Records (1) Affirmative action records are maintained at the Department facility employing the - 2- Regulations of C onnecticut State Agencies TITLE 17a. Social & Human Services & Resources Revised: 2015-3-6 D epartm ent of M ental H ealth R.C.S.A. §§ 17a-451(c)-1—17a-451(c)-5 §17a-451(c)-2 individual or providing treatment or services to the individual. A directory listing sites where affirmative action records are kept is located in the Department of Mental Health, Affirmative Action and Patients’ Rights Unit, 90 Washington Street, Hartford, Connecticut, 06106. (2) Affirmative action records are maintained in both manual and automated forms. (3) The purpose of the system is to provide data for monitoring and revising Department affirmative action plans and implementing affirmative action discrimination, patients’ rights and sexual harassment complaint procedures. (4) Affirmative action records are the responsibility of the Mental Health Chief of Affirmative Action and Patients’ Rights, Department of Mental Health, 90 Washington Street, Hartford, Connecticut 06106, to whom all requests for disclosure or amendment of the records should be addressed. (5) Routine sources of data in these records may include patients/clients, family members, friends, employees, health care or other service providers, grantee agencies and other state agencies. (6) Personal data in these records are maintained under authority of Conn. Gen. Stat. Secs. 46a-51 to 46a-104, inclusive, as may be amended from time to time, and the appurtenant Regulations, as may be amended from time to time. (7) Categories of personal data maintained in this system may include birth date, age, sex, race, educational history, employment history, medical or emotional condition or history, family or personal relationships, patient/client complaints, discrimination and/or sexual harassment complaints, and administrative investigation material. (8) Categories of other data maintained in this system may include patient/client identification number, social security number, address and telephone number. (9) These records are maintained on current and former patients/clients and employees of the Department. (10) These records are routinely used by affirmative action staff in affirmative action/equal employment opportunity monitoring and complaint resolution and in investigation and resolution of patients’ rights violations. (d) Patient/Client Records (1) Patient/client records are located at the Department facility which provides treatment or services to the particular individual. A directory listing sites where patient/client records are kept is located in the Office of the Commissioner, Department of Mental Health, 90 Washington Street, Hartford, Connecticut, 06106. (2) Patient/client records are maintained in both manual and automated forms. (3) The patient/client records system serves several purposes including: collecting preliminary demographic and clinical data to determine appropriateness and/or eligibility of an individual for treatment or services, as well as logging the episodes of service from initial request to final disposition; documenting admission, diagnosis, treatment planning, treatment process, care, service delivery, discharge, and case management of patient/client; documenting quality assurance monitoring of treatment planning and service delivery; - 3- Regulations of C onnecticut State Agencies TITLE 17a. Social & Human Services & Resources Revised: 2015-3-6 D epartm ent of M ental H ealth R.C.S.A. §§ 17a-451(c)-1—17a-451(c)-5 §17a-451(c)-3 providing complete demographic and clinical data on patient/client; and providing a baseline of information for billing purposes. (4) The personal data records in this system are the responsibility of the Commissioner, Department of Mental Health, 90 Washington Street, Hartford, Connecticut 06106. The title and business address of the Department official to whom requests for disclosure or amendment of the records in the system should be directed may be obtained from the directory referred to in subsection (1) above. (5) Routine sources of data in these records may include the patient/client, family members, friends, health care and other service providers, treatment staff, other state or federal agencies, and the judicial system. (6) Personal data in this system are maintained under the authority of Conn. Gen. Stat. Secs. 17a-450, 52-146d through 52-146j, 17a-615 through 17a-618, 54-91a, 54-142k, and 17-134x; as may be amended from time to time; and Sec. 1919 of the Federal Social Security Act, as may be amended from time to time. (7) Categories of personal data maintained in this system may include birth date, sex, social and family history; education; employment history; financial, medical and emotional condition or history; personal relationships; reputation or character information; treatment and discharge plans; legal status; and name of legal representative or conservator, if applicable; complaints, incident reports and investigation materials; criminal investigation records; and provider information. (8) Categories of other data maintained in this system may include social security number, case number, patient/client identification number, correspondence, referral sources, demographic admissions data, and names of staff members authorized to access the records. (9) These records are maintained on current and former patients/clients. (10) These records are routinely used by staff who are assigned care and treatment planning and responsibilities for the patients/clients, by staff who have quality assurance monitoring responsibilities, and by staff who have responsibility for administrative reporting of census, diagnosis, demographic data and billing information. (Effective March 4, 1993) Sec. 17a-451(c)-3. Maintenance of personal data (a) Records for each personal data system are maintained in accordance with schedules prepared by the Connecticut State Library, Department of Public Records Administration and retention schedules approved by the Public Records Administrator as authorized by Conn. Gen. Stat. Sec. 11-8a, as may be amended from time to time. Retention schedules are on file in the Personnel Office at the Office of the Commissioner and at each Department facility. They may be examined during the normal business hours, which are 8:30 a.m. to 4:30 p.m. at the Office of the Commissioner and 8:00 a.m. to 4:00 p.m. at the facilities. (b) Personal data will not be maintained unless relevant and necessary to accomplish the lawful purposes of the Department. Where the Department finds irrelevant or unnecessary public records in its possession, the Department shall dispose of the records in accordance - 4- Regulations of C onnecticut State Agencies TITLE 17a. Social & Human Services & Resources Revised: 2015-3-6 D epartm ent of M ental H ealth R.C.S.A. §§ 17a-451(c)-1—17a-451(c)-5 §17a-451(c)-3 with its records retention schedule and with the approval of the Public Records Administrator pursuant to Conn. Gen. Stat. Sec. 11-8a, as may be amended from time to time, or, if the records are not disposable under the records retention schedule, request permission from the Public Records Administrator to dispose of the records under Conn. Gen. Stat. Sec. 11-8a, as may be amended from time to time. (c) The Department shall collect and maintain all records with accurateness and completeness. (d) Insofar as it is consistent with the needs and mission of the Department, it shall, wherever practical, collect personal data directly from the person to whom a record pertains. (e) When an individual is asked to supply personal data to the Department, the Department shall disclose to that individual, upon request: (1) the name of the Department and division within the Department requesting the personal data; (2) the legal authority under which the Department is empowered to collect and maintain the personal data; (3) the individual’s rights pertaining to such records under the Personal Data Act and the Department regulations; (4) the known consequences arising from supplying or refusing to supply the requested personal data; (5) the proposed use to be made of the requested personal data. (f) Department employees involved in the operations of the Department’s personal data systems will be informed of the provisions of the Personal Data Act and the Department’s Regulations, the Freedom of Information Act and any other state or federal statute or regulations concerning maintenance or disclosure of personal data kept by the Department. (g) All Department employees shall take reasonable precautions to protect personal data under their custody from the danger of fire, theft, flood, natural disaster and other physical threats. (h) The Department shall incorporate by reference the provisions of the Personal Data Act and Regulations promulgated thereunder in all contracts, agreements or licenses for the operation of a personal data system or for research, evaluation and reporting of personal data for the Department or on its behalf. (i) The Department shall ensure that personal data requested from any other state agency is properly maintained. (j) Only Department employees who have a specific need to review personal data records for lawful purposes of the Department will be entitled to access to such records under the Personal Data Act. (k) The Department will keep a written up-to-date list of individuals entitled to access to each of the Department’s personal data systems. (l) The Department will ensure against unnecessary duplication of personal data records. In the event it is necessary to send personal data records through interdepartmental mail, such records will be sent in envelopes or boxes sealed and marked “confidential.” - 5- Regulations of C onnecticut State Agencies TITLE 17a. Social & Human Services & Resources Revised: 2015-3-6 D epartm ent of M ental H ealth R.C.S.A. §§ 17a-451(c)-1—17a-451(c)-5 §17a-451(c)-4 (m) The Department will ensure that all records in manual personal data systems are kept under lock and key and, to the greatest extent practical, are kept in controlled access areas. (n) Where automated personal data systems records are maintained, the Department will: (1) to the greatest extent practical, locate automated equipment and records in a limited access area; (2) to the greatest extent practical, require visitors to such area to sign a visitor’s log and permit access to said area on a bona-fide need-to-enter basis only; (3) to the greatest extent practical, ensure that regular access to automated equipment is limited to operations personnel; (4) utilize appropriate access control mechanisms to prevent disclosure of personal data to unauthorized individuals. (Effective March 4, 1993) Sec. 17a-451(c)-4. Disclosure of personal data (a) Within four (4) business days of receipt of a written request for disclosure of personal data, the Department shall mail or deliver to the requesting individual a written response, in plain language, informing her/him as to whether or not the Department maintains personal data on that individual, the category and location of the personal data maintained on that individual and procedures available to review the records, including the records kept under subsection (h) of this section. (b) Except where nondisclosure is required or specifically permitted by law, the Department shall disclose to any person upon written request all personal data concerning that individual which is maintained by the Department. The procedures for disclosure shall be in accordance with Conn. Gen. Stat. Secs. 1-15 through 1-21k, as may be amended from time to time. If the personal data is maintained in coded form, the Department shall transcribe the data into a commonly understandable form before disclosure. (c) The Department is responsible for verifying the identity of any person requesting access to her/his own personal data. (d) The Department is responsible for ensuring that disclosure made pursuant to the Personal Data Act does not disclose any personal data concerning persons other than the person requesting the information. (e) The Department may refuse to disclose to a person medical, psychiatric or psychological data on that person if the Department determines that such disclosure would be detrimental to that person. (f) In any case where the Department refuses disclosure, it shall advise that person of her/his right to seek appropriate relief, including judicial relief, pursuant to the Personal Data Act. (g) If the Department refuses to disclose medical, psychiatric or psychological data to a person based on its determination that disclosure would be detrimental to that person and nondisclosure is not mandated by law, the Department shall, at the written request of such - 6- Regulations of C onnecticut State Agencies TITLE 17a. Social & Human Services & Resources Revised: 2015-3-6 D epartm ent of M ental H ealth R.C.S.A. §§ 17a-451(c)-1—17a-451(c)-5 §17a-451(c)-5 person, permit a qualified medical doctor to review the personal data contained in the person’s record to determine if the personal data should be disclosed. If disclosure is recommended by the person’s medical doctor, the Department shall disclose the personal data to such person; if nondisclosure is recommended by such person’s medical doctor, the Department shall not disclose the personal data and shall inform such person of the judicial relief provided under the Personal Data Act. (h) The Department shall maintain a complete log of each person, individual, agency or organization who has obtained access to or to whom disclosure has been made of personal data under the Personal Data Act, together with the reason for each such disclosure or access. This log must be maintained for not less than five years from the date of such disclosure or access or for the life of the personal data record, whichever is longer. (Effective March 4, 1993) Sec. 17a-451(c)-5. Procedure for contesting the content of personal data (a) Any person who believes that the Department is maintaining inaccurate, incomplete or irrelevant personal data concerning her/him may file a written request with the Department for correction of said personal data. (b) Within 30 days of receipt of such request, the Department shall give written notice to that person that it will make the requested correction, or if the correction is not to be made as submitted, the Department shall state the reason for its denial of such request and notify the person of her/his right to add her/his own statement to her/his personal data records. (c) Following such denial by the Department, the person requesting such correction shall be permitted to add a statement to her/his personal data record setting forth what that person believes to be an accurate, complete and relevant version of the personal data in question. Such statements shall become a permanent part of the Department’s personal data system and shall be disclosed to any individual, agency or organization to which the disputed personal data is disclosed. (Effective March 4, 1993) - 7- Regulations of C onnecticut State Agencies TITLE 17a. Social & Human Services & Resources