Connecticut Administrative Code › Title 17a - Social and Human Services and Resources › 636 - Maintenance and Disclosure of Personal Data › Section 17a-636-4 - Disclosure of personal data

Current through July 10, 2024
(a) The Commission
			 shall not disclose to the public personal records of a confidential or private
			 nature except as required under state and federal law.
(b) Within four business days of receipt of a
			 written request therefore, the Commission shall mail or deliver to the
			 requesting individual a written response in plain language, informing him/her
			 as to whether or not the Commission maintains personal data on that individual,
			 the category and location of the personal data maintained on that individual
			 and procedures available to review the records.
(c) Except where non-disclosure is required
			 or specifically permitted by law, the Commission shall disclose to any person
			 upon written request all personal data concerning that individual which is
			 maintained by the Commission. The procedures for disclosure shall be in
			 accordance with Connecticut General Statutes sections
			 1-15 through 1-21k,
			 inclusive. If the personal data is maintained in coded form, the Commission
			 shall transcribe the data into commonly understandable form before
			 disclosure.
(d) The Commission is
			 responsible for verifying the identity of any person requesting access to
			 his/her own personal data.
(e) The
			 Commission is responsible for ensuring that disclosure made pursuant to the
			 Personal Data Act is conducted so as not to disclose any personal data
			 concerning persons other than the person requesting the information.
(f) The Commission may refuse to disclose to
			 a person medical, psychiatric or psychological data on that person if the
			 Commission determines such disclosure would be detrimental to that
			 person.
(g) In any case where the
			 Commission refuses disclosure, it shall advise that person of his/her right to
			 seek judicial relief pursuant to the Personal Data Act.
(h) If the Commission refuses to disclose
			 medical, psychiatric or psychological data to a person based on its
			 determination that disclosure would be detrimental to that person and
			 nondisclosure is not mandated by law, the Commission shall, at the written
			 request of such person, permit a qualified medical doctor to review the
			 personal data contained in the person's record to determine if the personal
			 data should be disclosed. If disclosure is recommended by such person's medical
			 doctor, the Commission shall disclose the personal data to such person; if
			 nondisclosure is recommended by such person's medical doctor, the Commission
			 shall inform such person of the judicial relief provided under the Personal
			 Data Act.
(i) The Commission shall
			 maintain a complete log of each person, individual, agency or organization who
			 has obtained access or to whom disclosure has been made of personal data under
			 the Personal Data Act, together with the reason for each such disclosure or
			 access. This log must be maintained for not less than five years from the date
			 of such disclosure or access or for the life of the personal data record,
			 whichever is longer.