Code of Massachusetts Regulations › 651 CMR - EXECUTIVE OFFICE OF ELDER AFFAIRS › Title 651 CMR 5.00 - Elder Abuse Reporting and Protective Services Program › Section 5.20 - Privacy and Confidentiality Requirements

Current through Register 1525, July 5, 2024
(1)
Generally
. All records containing Personal Data
			 concerning an Elder for whom a report of alleged Abuse has been made under
			 M.G.L. c. 19A, § 15 to the Department, the Elder Abuse Hotline,
			 guardianship agencies, Protective Services Agencies or other agencies holding
			 Personal Data shall not be public records and shall be governed by M.G.L. c.
			 66A,
			 801
			 CMR 3.00:
Privacy and Confidentiality
and
			 651 CMR 5.00.
(2)
Agreement with Holder of
			 Personal Data
. The Department shall enter into an agreement with
			 the provider of the Elder Abuse Hotline service, each guardianship agency, and
			 each Protective Services Agency whereby each Agency agrees to act as a Holder
			 of Personal Data and comply with the aforementioned regulations regarding the
			 holding of Personal Data as a result of performing a governmental or public
			 function or purpose.
(3)
Separate Personal Data System
. Each Holder of Personal
			 Data under the Protective Services Program shall establish a Personal Data
			 System separate and distinct from any other records of information it may hold
			 in the usual course of business in compliance with the legal requirements
			 identified in 651 CMR 5.20(1) regarding Personal Data.
(4)
Access to Personal Data by
			 Third Parties
. Each Holder maintaining Personal Data shall not
			 allow any agency or individual other than the employees of the Department or
			 other Holder agency under the Protective Services Program to gain access to
			 Personal Data unless such access is authorized by statute or regulations, or is
			 authorized by the Data Subject whose Personal Data is sought except for the
			 following:
Medical or psychiatric data may be made available to a
				physician treating a Data Subject upon the request of said physician, if a
				medical or psychiatric emergency arises which precludes the Data Subject's
				giving approval for the release of such data, but the Data Subject shall be
				given notice of such access upon termination of the emergency. The identity of
				the reporter shall be deleted prior to the release of any such
				information.
(5)
Discretionary Release of Information
. Subject to the
			 limitations established in
			 651 CMR
			 5.08(2)(c)2., the Department
			 may release or direct a Protective Services Agency to release any records,
			 documents, data, information, or any portion thereof to a relevant government
			 agency in furtherance of efforts to serve a compelling public interest to
			 protect the health, safety, and welfare of Elders; for the purpose of
			 conducting an effective Investigation; or for the purpose of providing
			 effective Protective Services Casework, subject to the following limitations:
(a) The exercise of the Department's
			 discretion shall be based upon a balancing of the respective interests of the
			 public in the protection of the privacy of those who may be affected by the
			 release of information, and the public interest in protecting vulnerable Elders
			 within the Commonwealth.
(b) The
			 discretionary release of information shall be limited to only that portion of
			 the information necessary to satisfy the public interest underlying the release
			 of the information:
(c) Personal
			 Data of Data Subjects and of reporters of abuse that are contained in such
			 records shall be redacted from the records when disclosure of such information
			 is not required by the public interest underlying the discretionary release of
			 such records; and
(d) Prior to the
			 release of any such records containing Personal Data information pursuant to
			 651 CMR 5.20(5)(c), the general counsel of the Department or his or her
			 designee shall review the records and remove any portion of the records which:
1. may be considered attorney work product or
			 privileged; and
2. may be
			 personally identifying or confidential information regarding any third party
			 data subject and the individual who reported the abuse to the Protective
			 Services Program.