2.6 Confidentiality/Safeguarding Information | CWS

Georgia Division of Family and Children Services
Child Welfare Policy Manual

Chapter:

(2) Information Management

Policy Title:

Confidentiality/Safeguarding Information

Policy Number:

2.6

Previous Policy Number(s):

N/A

Effective Date:

May 2024

Manual Transmittal:

2024-05

Codes/References

O.C.G.A. § 19-7-5 Reporting of Child Abuse
O.C.G.A. § 19-15-1 Definitions
O.C.G.A. § 49-5-12 Licensing and Inspection of Child Welfare Agencies; Standards; Revocation or Refusal of License; Penalties; Violations
O.C.G.A. § 49-5-40 Definitions; Confidentiality of Records; Restricted Access to Records
O.C.G.A. § 49-5-41 Persons and Agencies Permitted Access to Records
O.C.G.A. § 49-5-41.1 Inspection and Retention of Records of Juvenile Drug Use
O.C.G.A. § 49-5-44 Penalties for Unauthorized Access to Records; Use of Records in Public and Criminal Proceedings
O.C.G.A. § 49-5-281 Bill of Rights for Foster Parents
O.C.G.A. § 50-18-72 When Public Disclosure Not Required
Title IV-E of the Social Security Act §§ 471(a)(8), 471(a)(9), 471(a)(9)(A), 471(a)(9)(C)(i)(I), 471(a)(20)(B)(iii), 471(a)(34)(A), 471(a)(35)(B), 471(c), 475(5)(D)
Child Abuse Prevention and Treatment Act (CAPTA)
Public Law (PL) 104-191 Health Insurance Portability and Accountability Act (HIPAA) of 1996
PL 117-348 Trafficking Victims Prevention and Protection Reauthorization Act of 2022
J.J. v. Ledbetter Consent Decree

Requirements

The Division of Family and Children Services (DFCS) will:

Comply with all state and federal confidentiality laws. This includes staff, volunteers, interns, contractors, agents, and providers of services.
Maintain written procedures at each county office for the handling and storage of records to assure the privacy of information and the accessibility of case material for staff that need to know and use the information.
Consider the following, with any information request, inquiry, or potential disclosure to ensure that confidential information is not unlawfully disclosed:
1. Georgia laws pertaining to access to child abuse records
2. J.J. v. Ledbetter Consent Decree (see policy 2.10 Information Management: J.J. v. Ledbetter Parent or Guardian Request for Information)
3. Health Insurance Portability and Accountability Act (HIPAA) (see policy 2.5 Information Management: Health Insurance Portability and Accountability Act (HIPAA)).
4. Title IV-E of the Social Security Act
5. Child Abuse Prevention and Treatment Act (CAPTA)
Consult with the DHS Office of General Counsel (OGC) when clarification is needed regarding requests for disclosure of confidential information, including any redactions that need to be made prior to disclosure.
Release only the information that is required by law, or necessary to arrange for services or to fulfill administrative requirements.
Request the individual’s informed consent via the Authorization for Release of Information (ROI) prior to disclosure, when disclosure of confidential information is not expressly permitted by law but is necessary for case management services. When a ROI is needed, it must include the following to be valid:
1. Name of each specific person, provider or agency to whom the information is being released;
2. The specific information to be released;
3. Name and dated signature of the individual or in the case of a minor their parent or legal guardian;
4. A statement that the consent can be withdrawn at any time; and
5. The length of time the consent is valid.
Individuals must never be asked to sign a blank ROI.
Upload each valid ROI to Georgia SHINES External Documentation within 72 hours of completion.
Ensure safeguards are in place for restricting use of or disclosure of information concerning individuals assisted under the title IV-E plan to purposes directly connected with:
1. The administration of the title IV-E plan or any of the plans or programs under Parts A, B or D of title IV or under titles I, V, X, XIV, XVI (as in effect in Puerto Rico, Guam and the Virgin Islands), XIX, or XX, or the Supplemental Security Income program under title XVI (see policy 1.0 Administration: Administration of Child Welfare Services); and
2. Any investigation, prosecution or criminal or civil proceeding conducted in connection with the administration of any such plan or program; and
3. The administration of any other Federal or federally assisted program which provides assistance (in-cash or in-kind) or services directly to individuals on the basis of need; and
4. Any audit or similar activity conducted in connection with the administration of any such plan or program by any governmental agency authorized by law to conduct such audit or activity; and
5. The disclosure of information pursuant to 471(a)(9)(A) to appropriate authorities with respect to known or suspected child abuse or neglect (see policy 3.24 Intake: Mandated Reporters).
Ensure safeguards provided will prohibit disclosure to:
1. Any individuals or entities not included above; and
2. Any committee or legislative body (other than an agency referred to in section 471(a)(8)(D) of the Social Security Act with respect to an activity referred to in that section) of any information which identifies by name or address any applicant for or recipient of assistance under title IV-E of the Act.
Ensure safeguards are in place to prevent the unauthorized disclosure of information in any child abuse and neglect registry maintained by the State, and to prevent any such information obtained from a child abuse registry from being used for a purpose other than conducting background checks in foster and adoptive cases.
In the use of child welfare records in court proceedings, section 471(a)(8) of the Act shall not be construed to limit the flexibility of DFCS in determining policies relating to public access to court proceedings to determine child abuse and neglect or other court hearings held pursuant to title IV-B or title IV-E of the Act, except that such policies shall, at a minimum, ensure the safety and well-being of the child, parents and family (see policy 17.6 Legal: Public Access to Dependency Proceedings).
Ensure the appropriate disclosure of information to:
1. Authorities pursuant to 471(a)(34)(A) with respect to children or youth identified in 471(a)(9)(C)(i)(I) of the Act who have been identified as being a sex trafficking victim (see policy 1.13 Administration: Sex Trafficking Overview).
2. Authorities pursuant to 471(a)(35)(B) with respect to children identified in 471(a)(9)(C)(i)(I) of the Act who are missing or abducted (see policy 19.22 Case Management: Missing Children).
Ensure the child’s health and education record is reviewed and updated, and a copy of the record is supplied to:
1. The foster parent or foster care provider with whom the child is placed, at the time of each placement of the child in foster care (see policy 10.1 Foster Care: Placement of a Child and 10.3 Foster Care: Changes in Placement); and
2. The child if the child is leaving foster care by reason of having attained the age of majority under the State law and is supplied to the child at no cost (see policy 13.4 Independent Living Program: Transition From Foster Care).
Not disclose DFCS records of child controlled substance or marijuana abuse. Such records are declared to be confidential, and access is prohibited except as provided in Code Sections 49-5-41.1.

Access to such records can only be authorized by order of the juvenile court.
Ensure records concerning child abuse or neglect which is received DFCS from the child abuse and neglect registry of any other state shall not be disclosed or used outside the department for any other purpose other than conducting background checks to be used in foster care and adoptive placements or in locating, recovering or providing services to a child/youth who is determined by the department to either be missing or the victim of sexual exploitation.

Provide reasonable access to child abuse records to the following persons or agencies in compliance with Georgia law:

Any federal, state, or local governmental entity, tribal entity, or any agency of any such entity that has a need for information contained in such reports in order to carry out their legal responsibilities to protect children from abuse and neglect.

Military law enforcement and the applicable military installation’s family advocacy program will be notified by securely encrypted email^[1] (see policy 3.25 Intake: Sharing Intake Reports with Law Enforcement, District Attorney or Military) of any reports of suspected child abuse involving child/ren with parents or guardians on active duty in the armed forces of the United States, where there is reasonable cause to believe such report is true, as required by O.C.G.A. §19-7-5.

Grand jury by subpoena.
Prosecuting attorney in this state or any other state, or for the United States, who may seek access in connection with official duty.
Mandated reporter (see policy 3.24 Intake: Mandated Reporters):
1. Access will include only notification regarding the child for whom the report was made and only disclose whether the investigation is ongoing or complete; and
2. If the investigation is complete and the request is made by the person making the report, access will only disclose whether child abuse was substantiated or unsubstantiated (see policy 5.4 Investigations: Notification of Child Protective Services (CPS) Investigation Outcome).
3. Disclosure will only occur if requested by the person making the report.
A school counselor for the school a child was attending when a report of suspected child abuse was received from a school employee.
1. Within 24 hours of receiving such report, DFCS will acknowledge, in writing, the receipt of such report to the reporting individual
2. DFCS will disclose:
  1. Whether the investigation of the reported abuse is ongoing or completed and, if completed,
  2. Whether the suspected child abuse was substantiated or unsubstantiated within five days of completing the investigation of the suspected child abuse. If the school does not have a counselor, the principal is provided the information (see policy 5.4 Investigations: Notification of Child Protective Services (CPS) Investigation Outcome).
Any adult requesting information regarding DFCS investigations, findings or information about a case of child abuse or neglect that results in a fatality or near fatality, unless such disclosure would jeopardize a criminal investigation or proceeding (see policy 2.11 Information Management: Public Access to Records in Child Fatality and Near Fatality Cases); however, the following may be redacted from such records:
1. Any record of law enforcement or prosecution agencies and any part of DFCS’ record that includes information provided by law enforcement or prosecution agencies in any pending investigation or prosecution of criminal activity contained within the child abuse, neglect, or dependency records;
2. Medical and mental health records made confidential by other provisions of law;
3. Privileged communications of an attorney;
4. Identifying information of the person who reported suspected child abuse;
5. Information that may cause mental or physical harm to the sibling(s) or other child living in the household of the child being investigated;
6. Name of the child who is the subject of reported child abuse or neglect; and
7. Name of any parent or other person legally responsible for the child, or any member of the household of the child who is the subject of reported child abuse or neglect, provided that such person is not under investigation for the reported child abuse or neglect.
State Personnel Board, by administrative subpoena:
1. Records may be released upon a finding by an administrative law judge that access to such records may be necessary for a determination of an issue involving DFCS personnel and that issue involves the conduct of such personnel in child related employment activities;
2. Only those parts of the record relevant to the child related employment activities should be disclosed; and
3. The name of any complainant or client will not be identified or entered into the record.
Child advocacy center that has a need for information contained in such records in order to carry out its legal responsibilities to protect children from abuse or neglect.
Police or any other law enforcement agency of this state or any other state.
Any medical examiner or coroner investigating a report of known or suspected child abuse.
Any child fatality review committee or child abuse protocol committee created pursuant to Chapter 15 of Title 19 (see policy 1.10 Administration: Child Fatality Review and 1.15 Administration: Child Abuse Protocol).
The Governor, the Attorney General, the Lieutenant Governor, or the Speaker of the House of Representatives following a written request to the DFCS Director. The request will specify the name of the child for whom such access is sought and describe the need to have access to the records in order to determine whether state laws are being complied with to protect children from abuse and neglect, and whether state laws need to be changed to enhance such protection.

The Office of General Counsel will respond to these requests.
Individuals or entities engaged in legitimate research for educational, scientific, or public purposes:
1. Inspection of DFCS records will be permitted by the county juvenile court after an application for inspection and a hearing on the issue;
2. Names and addresses of individuals, other than officials, employees, or agents of agencies receiving or investigating a report of abuse or treating a child or family which is the subject of a report, will be deleted from any information released pursuant to O.C.G.A § 49-5-41(b)(1), unless the court determines that having the names and addresses open for review is essential to the research and the child, through his or her representative, gives permission to release the information; and
A child who alleges that he or she was abused:
1. The child will be permitted access to records concerning a report of child abuse allegedly committed against him or her when he or she reaches 18 years of age;
2. Prior to such child reaching 18 years of age, if the requestor is not the subject of such record, such records will be made available to such child’s parent or legal guardian or a deceased child’s duly appointed representative;
3. The requestor or his or her attorney must submit a sworn affidavit to the applicable child advocacy center, DFCS, or other state or local agency that attests that such information is relevant to a pending or proposed civil action relating to damages sustained by such child; and
4. Such record concerning a report of child abuse will still be subject to confidentiality pursuant to O.C.G.A § 50-18-72(a)(4) (see policy 2.9 Information Management: Open Records Act of Georgia).
A court may make such records available to a party seeking such records by subpoena that is filed at the same time with a motion seeking records and requesting an in-camera inspection of such records. When a court issues an order making the records available, the court will issue a protective order to ensure the confidentiality of such records as specified in 49-5-41(a)(11).

County staff should contact their Special Assistant Attorney General (SAAG) or the Office of General Counsel for guidance.
Any child-caring agency, child-placing agency, or identified foster parent:
1. Any child-caring agency, child-placing agency, or identified foster parent who is granted access to a child’s record will be subject to the penalties imposed by O.C.G.A. §49-5-44 for unauthorized access to or use of such records;
2. Respond to the request for access to a child’s record within 14 days of receipt of such written request;
3. Records will include non-identifying information from the CPS or placement record compiled by DFCS with respect to any child who has been placed in the care or custody of such agency or foster parent or for whom foster care is being sought;
4. Records must exclude all documents obtained from outside sources which cannot be re-disclosed under state or federal law; and
5. Records provided will include reports of abuse of such child and the social history of the child and the child’s family, the medical history of such child, including psychological or psychiatric evaluations, or educational records as allowed by state or federal law and any plan of care or placement plan developed by DFCS, provided that no identifying information is disclosed regarding such child.
Notwithstanding the provisions of O.C.G.A § 49-5-41(d), a foster parent, as an agent of DFCS, will have access to a child’s medical and educational records in the same manner and to the same extent as DFCS itself and to the fullest extent allowable by law to ensure the proper care and education of a child entrusted to the foster parent’s care (see policy 10.11 Foster Care: Medical, Dental, and Developmental Needs and 10.13 Foster Care: Educational Needs).

Permit access to records concerning reports of child abuse when it is deemed appropriate by DFCS, and release information from such records to the persons or agencies below, in compliance with O.C.G.A. §49-5-41:
1. Physician who has before him or her a child whom he or she reasonably suspects may be abused
2. Licensed child-placing agency, licensed child-caring institution of this state which is assisting DFCS by locating or providing foster or adoptive homes for children in the custody of the department, a licensed adoption agency of this or any other state which is placing a child for adoption, or an investigator appointed by a court of competent jurisdiction of this state to investigate a pending petition for adoption.
3. Person legally authorized to place a child in protective custody when such person has before him or her a child, he or she reasonably suspects may be abused, and such person requires the information in the record or report in order to determine whether to place the child in protective custody.
4. Agency or person having legal custody, responsibility, or authorization to care for, treat, or supervise the child who is the subject of a report or record.
5. Agency, facility or person having responsibility or authorization to assist in making a judicial determination for the child, who is the subject of the report or record of abuse, including but not limited to members of officially recognized citizen review panels, court appointed guardians ad litem, certified court appointed special advocate (CASA) volunteers, and members of a child abuse protocol committee (see policy 17.10 Legal: Court Appointed Special Advocate (CASA) and Guardian Ad Litem (GAL)).
6. Legally mandated public child protective agency or law enforcement agency of another state bound by similar confidentiality provisions and requirements when, during, or following DFCS’ investigation of a report of child abuse the alleged abuser has left this state.
7. Child welfare agency or school where DFCS has investigated allegations of child abuse made against any employee of the agency or school and where any child remains at risk from exposure to that employee. Access to or release of this information must protect the identity of any person reporting the child abuse and any other person whose life or safety has been determined by DFCS likely to be endangered if the identity was not protected.
8. Employee of a school or child welfare agency, against whom allegations of child abuse have been made, when DFCS has been unable to determine the extent of the employee’s involvement in alleged child abuse against any child in the care of that school or agency. Upon receiving such request and signed release from the employee, DFCS may report its findings to the employer, except that such access or release will protect the identity of any person reporting the child abuse and any other person whose life or safety has been determined by DFCS or agency likely to be endangered if the identity were not so protected.
9. Any person who has an ongoing relationship with the child named in the record or report of child abuse, any part of which is to be disclosed to such person, but only if that person is required to report suspected abuse of that child pursuant to O.C.G.A § 19-7-5(b) as that subsection existed on January 1, 1990.
10. School principal or school guidance counselor, school social worker, or school psychologist who is certified under Chapter 2 of Title 20 and who is counseling a student as a part of their employment duties. Records will remain confidential, and information obtained from those records by the counseling person may not be disclosed to any unauthorized person, except that student, and such unauthorized disclosure will be punishable by a misdemeanor.
11. School official of a school that a child, who is the subject of a report of suspected abuse, attends in which there is an ongoing investigation of reported abuse. Any ongoing investigation will include contact with the school to obtain any relevant information from school personnel regarding the report of suspected child abuse (see policy 19.16 Case Management: Collateral Contacts).
12. The Department of Early Care and Learning or the Department of Education.
13. An individual who is leaving foster care, having attained the age of majority. Access will be limited to providing such individual with a free copy of his or her health and education records, including the most recent information available, and any other record(s) that may be required under Georgia law (see policy 13.4 Independent Living Program: Transition from Foster Care).
14. Local and state law enforcement agencies of this state, the Department of Community Supervision, probation officers, the Department of Corrections, and the Department of Juvenile Justice when such entities, officers, or departments are providing supervision or services to individuals and families who are also receiving DFCS services.
  
  Records may be provided electronically.
15. The National Center for Missing and Exploited Children (NCMEC) in order to assist in the location and safe recovery of a child/youth who is missing or the victim of sexual exploitation. Disclosure will be limited to records that pertain to the child/youth’s recovery (see policy 19.22 Case Management: Missing Children).
16. Prevent public disclosure of records concerning any foster parent or former foster parent. Records include home address, home telephone number, birthdate, social security number, insurance or medical information, mother’s birth name, credit or debit card information, bank or utility account information, passwords, or other financial data other than compensation by a government agency.

Redactions may be necessary before records are produced. Consult with the DHS OGC as needed.

Procedures

DFCS will:

Discuss and explain the following, upon initial contact with individuals served by DFCS:
1. Confidentiality and safeguarding of information, including HIPAA privacy laws (see policy 2.5 Information Management: Health Insurance Portability and Accountability Act (HIPAA)).
2. Information that is not confidential, including persons or entities to which confidentiality laws are not applicable.
3. Document the discussion in the Narrative of the Contact Detail in Georgia SHINES within 72 hours of occurrence.
Obtain a valid ROI, prior to disclosure, when disclosure of confidential information is not expressly permitted by law but is necessary for case management services.
When conducting any family meeting (family team meeting (FTM), Transition Roundtable, informal family meetings) that includes other participants adhere to confidentiality provisions as outlined in policy 19.3 Case Management: Solution-Focused Family Team Meetings to prevent unauthorized disclosure.
Upon receipt of a request for records or inquiry or potential disclosure:
1. Determine whether records may be disclosed to the requestor by considering all applicable laws to ensure that confidential information is not unlawfully disclosed.
2. Consult with the DFCS OGC when clarification is needed for information requests.
3. Redact any identifying information and remove the name and location of the reporter or of others corroborating the report of child abuse.
4. Arrange for the review of the case record, if applicable:
  1. Consider travel time in deciding where the record will be made available for review.
  2. Obtain written authorization from the County Director in the legal county if the record or copies of the record are to be reviewed at a location other than the legal or boarding county;
  3. Ensure a DFCS staff person is present when the record is reviewed to personally discuss DFCS policies and procedures and answer questions about the case record contents;
  4. Securely destroy the copy made of the record after it is reviewed.
5. If the record is to be mailed, send a copy of the releasable portions by certified mail to the nearest county DFCS office.
6. If the record is to be sent electronically, it must be shared using a secured method to protect privacy and assure confidentiality (i.e. DHS Encryption) (see Practice Guidance: Releasing Information in a Manner that Preserves Confidentiality).

Practice Guidance

Confidentiality

As a child welfare agency committed to maintaining confidentiality, DFCS ensures safeguards are in place to prevent the unauthorized disclosure of information. At the initiation of every case, DFCS staff explains to individuals being served the protections their information is provided and any anticipated disclosures that may be required by law. It is vital that DFCS adhere to confidentiality standards established by law as families place their confidence and trust in child welfare staff. Families deserve the respect and personal autonomy fostered by preserving confidence and personal privacy.

Tips for protecting confidential client information:

Only access the minimum amount of case information needed to carry out your job responsibilities.
When requesting services, staff will release only the information that is required by law or needed to arrange for services or to fulfill administrative requirements.
If confidential material is mailed, it should be sent “certified” and “registered”.
When copies of client information are used for ad hoc consultation (e.g., staffing, case reviews, case conferencing, or education planning) and are not needed for the permanent file of the consultant, case management staff are expected to retrieve the copies and destroy them.
Properly dispose of confidential information through shredding.
Ensure confidential information on your computer is secure. For example, lock the computer before you step away, block the computer screen from the view of passers-by, protect your passwords, etc.
Keep paper files in locked file cabinets with the key in a separate secure location.
Discussions that include confidential client information should be held in locations such as an office or conference room to prevent passers-by from hearing confidential information.

Family Meetings and Confidentiality

DFCS uses family meetings (i.e., FTM, Transition Roundtable, informal family meetings) to bring together family members and other family supports, including kin, friends, members of the family’s faith community and professionals who in partnership create, modify and implement case plans/action plans, or make critical decisions regarding child safety, permanency, and well-being.

Bringing a family together with a solution focused team of support contributes to a variety of potential benefits but may also create a scenario where confidential information is discussed. Prior to the convening of a family meeting, the SSCM must explain to parents/guardians/legal custodians:

Their privacy rights
They are not required to share their private information with anyone including family members
Releasing private information verbally or in writing is their choice
They can provide consent through the signing of ROI

Case Record

O.C.G.A. §49-5-40(a)(9) defines “record” as including documents, books, maps, drawings, computer based or generated information, data, data fields, digital images, photographs, video images, audio recordings, and video recordings. Certain items within the case record may not be shared when the individual or agency who is making the request does not need the information contained in such records to carry out its legal responsibilities to protect children from child abuse and neglect. The safety of the children, reporters, and other individuals mentioned in these documents must be considered when providing access to records. These include names (children, reporters, individuals who were interviewed or provided information, etc.); social security numbers, dates of birth; addresses; phone numbers; information about a child who is not the subject of the report; medical, mental health, and substance abuse information that does not specifically relate to findings of abuse or neglect; and Information provided by law enforcement.

Releasing Information in a Manner that Preserves Confidentiality

When releasing confidential information, as permitted by law, to specified individuals or entities certain protections must be in place to prevent further disclosure of the information. Reasonable and appropriate security measures should be established to protect confidential information. When it is necessary to convey sensitive or confidential information, that information must be sent via a secure encrypted email. This information may include any information pertaining to a child welfare case of a current or former client, inclusive of investigative and health information, regardless of whether the information is stripped of identifying details or is otherwise considered confidential pursuant to law. DFCS, as a covered entity, must implement technical security measures to guard against unauthorized access to electronic protected health information (ePHI) that is being transmitted over an electronic communications network. Specifically, the encryption of ePHI during transmission over electronic communications networks with business associates should be used, when possible, to avoid access by unauthorized entities. Local offices have the flexibility to determine when, with whom, and what method of encryption to use. (See the DHS Encrypt Sending and Recipient Instructions in Forms and Tools).

Grand Jury

A panel of citizens that is convened by a court to decide whether it is appropriate for the government to indict (proceed with a prosecution against) someone suspected of a crime.

Subpoena

An order from the court requiring the production of documents or requiring a person to appear in court.

Child Abuse Protocol Committee

A multidisciplinary, multiagency committee was established for each county to define standard procedures and practice for responding to child abuse and neglect. The purpose of the Child Abuse Protocol is to ensure cooperation between all agencies involved in a child abuse case. This coordination increases agency efficiency and minimizes trauma for the allegedly abused child by the legal and investigatory process. In addition, it ensures that treatment is provided for the child, the family, and the perpetrator (see policy 1.15 Administration: Child Abuse Protocol).

Forms and Tools

Authorization for Release of Information
Authorization for Release of Information (Spanish)
DHS Encrypt Recipient Instructions
DHS Encrypt Sender Instructions
Guide for Secure Information Sharing
Guide for Secure Information Sharing with the Military

1. Encryption is a method of converting an original message of regular text into encoded text. The text is encrypted by means of an algorithm (i.e., type of procedure or formula). If information is encrypted, there would be a low probability that anyone other than the receiving party who has the key to the code or access to another confidential process would be able to decrypt (i.e., translate) the text and convert it into plain, comprehensible text.