Connecticut Administrative Code › Title 10 - Education and Culture › 293 - Agency Organization, Practice and Procedure › Part II - Rules of Practice Definitions › Section 10-293-48 - Disclosure of personal data

Current through July 10, 2024
(a) The board shall
				not disclose to the public client case records as stated in Section
				10-311a of
				Connecticut General Statutes except as allowed under state and federal
				law.
(b) Disclosure of personal
				data to a person will be made as follows:
(1)
				Within four (4) business days of receipt of a written request, therefore, the
				board shall mail or deliver to the requesting individual a written response in
				plain language, informing him/her as to whether or not the board maintains
				personal data on that individual, the category and location of the personal
				data maintained on that individual and procedures available to review
				records.
(2) Except where
				nondisclosure is required or specifically permitted by law, the board shall
				disclose to any person upon written request all personal data concerning that
				individual which is maintained by the board. The procedure for disclosure shall
				be in accordance with Connecticut General Statutes 1-15 through 1-21k. If the
				personal data is maintained in coded form, the board shall transcribe the data
				into a commonly understandable form before disclosure.
(3) The board is responsible for verifying
				the identity of any person requesting access to his/her own personal
				data.
(4) The board is responsible
				for ensuring that disclosure made pursuant to the Personal Data Act is
				conducted so as not to disclose any personal data concerning persons other than
				the person requesting the information.
(5) The board may refuse to disclose to any
				person medical, psychiatric or psychological data on that person if the board
				determines that such disclosure would be detrimental to that person.
(6) In any case where the board refuses
				disclosure, it shall advise that person of his/her right to seek judicial
				relief pursuant to the Personal Data Act.
(7) If the board refuses to disclose medical,
				psychiatric or psychological data to a person based on its determination that
				disclosure would be detrimental to that person and nondisclosure is not
				mandated by law, the board shall, at the written request of such person, permit
				a qualified medical doctor to review the personal data and to determine if the
				personal data should be disclosed. If disclosure is recommended by the medical
				doctor, the board shall disclose the personal data to such person. If
				nondisclosure is recommended by the medical doctor, the board shall not
				disclose the personal data and shall inform such person of the judicial relief
				provided in the Personal Data Act.
(8) The board shall maintain a complete log
				of each person, individual, agency or organization who has obtained access or
				to whom disclosure has been made of personal data under the Personal Data Act,
				together with the reason for such disclosure or access. This log must be
				maintained for not less than five (5) years from the date of such disclosure or
				access or for the life of the personal data record, whichever is
				longer.