The following definitions shall apply to these regulations.
(a) "Attorney" means an attorney at law empowered by a person to assert the confidentiality of or right of access to personal data under the Personal Data Act, Conn. General Statute §4-190.
(b) "Authorized representative" means a parent, or guardian or conservator, other than an attorney, appointed to act on behalf of a person and empowered by such person to assert the confidentiality of or right of access to personal data under the Personal Data Act, Conn. General Statute §4-190.
(c) "Automated personal data system" means a personal data system in which data is stored, in whole or part, in a computer or in computer accessible files.
(d) "Category of personal data" means the classifications of personal information set forth in the Personal Data Act, Conn. Gen. Stat. §4-190(9).
(e) "Child/youth" means any person under eighteen years of age, except as otherwise specified, or any person under twenty one years of age who is in full-time attendance in a secondary school, a technical school, a college or a state accredited job training program.
(f) "Computer accessible files" means any personal data which is stored on-line or off-line, which can be identified by use of electronic means, including but not limited to microfilm and microfilm devices, which includes but is not limited to magnetic tape, magnetic film, magnetic disks, magnetic drums, internal memory utilized by any processing device, including computers or telecommunications control units, punched cards, optically scanable paper or film.
(g) "Department/Agency" means the Department of Children and Youth Services.
(h) "Maintain" means collect, maintain, use or disseminate.
(i) "Manual personal data system" means a personal data system other than an automated personal data system.
(j) "Other Data" means any other information which because of name, identifying number, mark or description can be readily associated with a particular person.
(k) "Person" means an individual of any age concerning whom personal data is maintained in a personal data system, or a person's attorney or authorized representative.
(l) "Personal data" means any information about a person's education, finances, medical or emotional condition or history, employment or business history, family or personal relationships, reputation or character which because of name, identifying number, mark or description can be readily associated with a particular person. "Personal data" shall not be construed to make available to a person any record described in subdivision (3) of the subsection (b) of Conn. General Statute §1-19.
(m) "Personal data system" means a collection of records containing personal data.
(n) "Record" means any collection of personal data, defined in subsection (9) of Conn. General Statute §4-190, which is collected, maintained or disseminated.
(Effective April 27, 1987)
Section 17-415(g)-7. General nature and purpose of personal data systems
(a) Division of Children and Protective Services Records
(1) The Division of Children and Protective Services system directory is located in the office of the Division Director at 170 Sigourney Street, Hartford, Conn.
(2) Records are maintained in manual form.
(3) The purpose of the system is to record and document division activities in responding to complaints of child abuse/neglect and in providing services to children and their families.
(4) Division personal data records are the responsibility of the Division Director, 170 Sigourney Street, Hartford, Connecticut. All requests for disclosure or amendment to these records should be submitted to the appropriate Regional Director as listed below, if known, or if not known, to the Division Director.
Region I, Regional Director, 1115 Main St., Bridgeport, CT
Region II, Regional Director, 2105 State St., Hamden, CT
Region III, Regional Director, 331 Main St., Norwich, CT
Region IV, Regional Director, 1049 Asylum Ave., Hartford, CT
Region V, Regional Director, 414 Meadow St., Waterbury, CT
(5) Routine sources of data may include children and families, (clients), reporters of child abuse/neglect, medical personnel, educators, social workers, and other mental health professional staff persons, foster and adoptive parents.
(6) Personal data are collected and maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by Division Staff to reflect treatment plans, services, and payments to or on behalf of children/families included within the programs operated by the Division.
(b) The Division of Treatment Standards and Assurance Records
(1) The Division of Treatment Standards and Assurance personal data records are located at 170 Sigourney St., Hartford, Conn.
(2) Records are maintained in manual form.
(3) The purpose of the system is to document activities pertaining to (A) conducting Administrative Hearings as requested by clients, licensees, or vendors, (B) administering three compacts between Connecticut and other states covering appropriate placement, supervision and return of children and youth across state lines, (C) determining the timeliness and quality of department treatment planning and service delivery.
(4) Division personal data records are the responsibility of the Division Director, 170 Sigourney Street, Hartford, Conn. All requests for disclosure or amendment to these records should be submitted to the Division Director.
(5) Routine sources of data may include - children/youth, parents/family and significant other adults, and other state interstate compact administering agencies.
(6) Personal data are collected and maintained under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by Division Staff to reflect case information pertaining to administrative hearings, compliance with interstate compacts pertaining to the placement and return of children across state lines, and quality assurance monitoring of Department treatment planning and service delivery.
(c) Division of Personnel Records
(1) The Division of Personnel system directory is located in the office of the Personnel Administrator at 170 Sigourney Street, Hartford, Conn.
(2) Records are maintained in both manual and automated form.
(3) The purpose of the system is to provide data necessary for personnel/payroll management activities and/or as required by Federal and State Law.
(4) Division personal data records are the responsibility of the Personnel Administrator 170 Sigourney Street, Hartford, Conn. All requests for disclosure or amendment to these records should be submitted to the Personnel Administrator.
(5) Routine sources of data may include applicants for employment, employees, previous employees, references provided by applicants and other state agencies.
(6) Personal data are collected and maintained and used under authority of Sections 4-193 et seq. of the Connecticut General Statute.
(7) Records are used by Division Staff and other administrative/supervisory staff as required to record and document the performance of personnel management activities within the Department.
(d) Division of Fiscal Services Records
(1) The Division of Fiscal Services system directory is located in the office of the Chief Fiscal Officer at 170 Sigourney Street, Hartford, Conn.
(2) Records are maintained in both manual and automated form.
(3) The purpose of the system is to maintain vendor payment records, reimbursement for employee travel expenses and reflect activities required to secure federal and state payments for department operated programs.
(4) Division personal data records are the responsibility of the Chief Fiscal Officer, 170 Sigourney Street, Hartford, Conn. All requests for disclosure or amendment to these records should be submitted to the Chief Fiscal Officer.
(5) Routine sources of data may include vendors, employees, other state and federal agencies.
(6) Personal data are collected and maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by Division Staff to reflect Department receipt of federal/state funding and Department payments to vendors for services provided to or on behalf of children/families.
(e) Division of Licensing Records
(1) The Division of Licensing system directory is located in the office of the Division Director at 170 Sigourney Street, Hartford, Conn.
(2) Records are maintained in both manual and automated form.
(3) The purpose of the system is to record and document division activities related to the licensing/relicensing of child-caring facilities and child placing agencies, and the Adoption Resource Exchange.
(4) Division personal data records are the responsibility of the Division Director. All requests for disclosure or amendment to these records should be submitted to the Division Director.
(5) Routine sources of data may include applicants for licensing, relicenses, references, other state and federal agencies.
(6) Personal data are collected and maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by Division and other Department Staff to reflect activities related to assessing and determining the initial and continued compliance with licensing requirements by child-caring facilities and child-placing agencies.
(f) Unified School District II Records
(1) The Unified School District II system directory is located in the office of the School District Superintendent at 170 Sigourney Street, Hartford, Connecticut.
(2) Records are maintained in manual form.
(3) The purpose of the system is to maintain educational records of students served through the District and to document and record the School District's administrative functions.
(4) School District personal data records are the responsibility of the Superintendent, Unified School District II, 170 Sigourney Street, Hartford, Conn. All requests for disclosure or amendment to theses records should be submitted to the Superintendent.
(5) Routine sources of data may include students, parents/guardians, teachers, private and other public education agencies.
(6) Personal Data are collected and maintained and used under authority of Section 17-441 of the Connecticut General Statutes.
(7) Records are used by the Unified School district Staff to reflect educational programs and services provided to students enrolled in the School District.
(g) Division of Research and Evaluation - Emergency Shelter Records
(1) The Division of Research and Evaluation - Emergency Shelter system - is located in the office of the Division Director at 170 Sigourney, Hartford, Conn.
(2) Records are maintained in automated form.
(3) The purpose of the system is to record and document referrals, admissions and services provided to children/youth by emergency shelters.
(4) Division personal data records are the responsibility of the Division Director, 170 Sigourney Street, Hartford, Conn. All requests for disclosure or amendment to these records should be submitted to the Division Director.
(5) Routine sources of data may include emergency shelter staff persons.
(6) Personal data are collected and maintained and used under authority of Section 17-48 et seq. of the Connecticut General Statutes.
(7) Records are used by Division Staff to monitor and evaluate the services provided to children/youth by emergency shelters.
(h) Division of Data Processing Records
(1) The Division of Data Processing system directory is located in the office of the Division Directory at 170 Sigourney Street, Hartford, Conn.
(2) Records are maintained in automated form.
(3) The purpose of the system is to collect, store, and disseminate information pertaining to children and families serviced by the department and vendors of services purchased by the department.
(4) Division personal data records are the responsibility of the Division Director, 170 Sigourney Street, Hartford, Conn.
(5) Routine sources of data may include department social workers and vendors of services purchased by the department.
(6) Personal data are collected and maintained and used under authority of Section 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by Division and other Department Staff to maintain and update the information pertaining to services and payments provided to or on behalf of children/families included within the programs operated by the Department.
(i) Henry D. Altobello Children and Youth Center Records
(1) The Henry D. Altobello Children and Youth Center system is located in the office of the Superintendent at Undercliff Road, Meriden, CT.
(2) Records are maintained in manual form.
(3) The purpose of the system is to document the diagnosis, treatment planning, treatment process and response of the child.
(4) Personal data records are the responsibility of the Superintendent, Undercliff Road, Meriden, CT. All requests for disclosure or amendment to these records should be submitted to the Superintendent.
(5) Routine sources of data may include examination and observation; interview of the child, parent or other adult caretakers; and information provided by medical personnel, educators, social workers, mental health and other professionals.
(6) Personal data are collected, maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by the Henry D. Altobello Children and Youth Center Staff to reflect treatment planning and services provided to children as well as to the parents/families or other caretaker of such children.
(j) Greater Bridgeport Children's Services Center Records
(1) The Greater Bridgeport Children's Services Center System is located in the office of the Director at 1450 Barnum Road, Bridgeport, CT.
(2) Records are maintained in manual form.
(3) The purpose of the system is to document the diagnosis, treatment planning, treatment process and response of the child and/or family in treatment.
(4) Personal data records are the responsibility of the Director, 1450 Barnum Road, Bridgeport, CT. All requests for disclosure or amendment to these records should be submitted to the Director.
(5) Routine sources of data may include examination and observation; interview of the child, parent or other adult caretakers; and information provided by medical personnel, educators, social workers, mental health and other professionals.
(6) Personal data are collected, maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by the Greater Bridgeport Children's Services Center Staff to reflect treatment planning and services provided to children as well as to the parents/families or other caretaker of such children.
(k) High Meadows Records
(1) The High Meadows system is located in the office of the Superintendent at 825 Hartford Turnpike, Hamden, CT.
(2) Records are maintained in manual form.
(3) The purpose of the system is to document the diagnosis, treatment planning, treatment process and response of the child.
(4) Personal Data records are the responsibility of the Superintendent, 825 Hartford Turnpike, Hamden, CT. All requests for disclosure or amendment to these records should be submitted to the Superintendent.
(5) Routine sources of data may include examination and observation; interview of the child, parent or other adult caretakers; and information provided by medical personnel, educators, social workers, mental health and other professionals.
(6) Personal data are collected, maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by High Meadows Staff to reflect treatment planning and services provided to children as well as to the parents/families or other caretaker of such children.
(l) Housatonic Adolescent Hospital Records
(1) The Housatonic Adolescent Hospital system is located in the office of the Superintendent, Box W, Newtown, CT.
(2) Records are maintained in manual form.
(3) The purpose of the system is to document the diagnosis, treatment planning, treatment process and response of the child.
(4) Personal Data records are the responsibility of the Superintendent, Box W, Newtown, CT. All requests for disclosure or amendment to these records should be submitted to the Superintendent.
(5) Routine sources of data may include examination and observation; interview of the child, parent or other adult caretakers; and information provided by medical personnel, educators, social workers, mental health and other professionals.
(6) Personal data are collected, maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by Housatonic Adolescent Hospital Staff to reflect treatment planning and services provided to children as well as to the parents/families or other caretaker of such children.
(m) Long Lane School Records
(1) The Long Lane School system is located in the office of the Superintendent, Long Lane, Middletown, CT.
(2) Records are maintained in manual form.
(3) The purpose of the system is to document the assessment, treatment planning, treatment process and response of the child.
(4) Personal Data records are the responsibility of the Superintendent, Long Lane, Middletown, CT. All requests for disclosure or amendment to these records should be submitted to the Superintendent.
(5) Routine sources of data may include examination and observation; interview of the child, parent or other adult caretakers, and information provided by medical personnel, educators, social workers, mental health and other professionals.
(6) Personal data are collected, maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by Long Lane Staff to reflect treatment planning and services provided to children as well as to the parents/families or other caretaker of such children.
(n) RiverView Hospital Records
(1) The RiverView Hospital system is located in the office of the Superintendent, River Road, Middletown, CT.
(2) Records are maintained in manual form.
(3) The purpose of the system is to document the diagnosis, treatment planning, treatment process and response of the child.
(4) Personal data records are the responsibility of the Superintendent, River Road, Middletown, CT. All requests for disclosure or amendment to these records should be submitted to the Superintendent.
(5) Routine sources of data may include examination and observation; interview of the child, parent or other adult caretakers; and information provided by medical personnel, educators, social workers, mental health and other professionals.
(6) Personal data are collected, maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by RiverView Staff to reflect treatment planning and services provided to children as well as to the parents/families or other caretaker of such children.
(o) State Receiving Home Records.
(1) The State Receiving Home system is located in the office of the Superintendent, 36 Gardner St., Warehouse Point, CT.
(2) Records are maintained in manual form.
(3) The purpose of the system is to document the diagnosis, treatment planning, treatment process and response of the child.
(4) Personal data records are the responsibility of the Superintendent, 36 Gardner St., Warehouse Point, CT. All requests for disclosure or amendment to these records should be submitted to the Superintendent.
(5) Routine sources of data may include examination and observation; interview of the child, parent or other adult caretakers; and information provided by medical personnel, educators, social workers, mental health and other professionals.
(6) Personal data are collected, maintained and used under authority of Sections 17-32 et seq. and 17-410 et seq. of the Connecticut General Statutes.
(7) Records are used by the State Receiving Home Staff to reflect treatment planning and Services provided to children as well as to the parents/families or other caretaker of such children.
(p) Wilderness School Records
(1) The Wilderness School personal data records are maintained at the school in Tunxis State Forest, East Hartland, Connecticut.
(2) Records are maintained in manual form.
(3) The purpose of the system is to document the admission and participation of children/youth in the wilderness experience summer program and the year-round follow-up programs for participants who have returned to their communities.
(4) Wilderness School personal data records are the responsibility of the School Director, Tunxis State Forest, East Hartland, CT. All requests for disclosure or amendment to these records should be submitted to the Superintendent.
(5) Routine sources of data may include child/youth, family and other significant adult persons, court personnel, school personnel, and other youth service agencies.
(6) Personal data are collected, maintained and used under authority of Sections 17-32 et seq. and 17-410 et. seq. of the Connecticut General Statutes.
(7) Records are used by the Wilderness School Staff to reflect services provided to participants in the school programs and to parents/families or other caretaker of such children.
(Effective April 27, 1987)
Section 17-415(g)-8. Categories of personal data
The following categories of personal data may be maintained:
(a) Division of Children and Protective Services records
(1) Personal data records may include social and family history, education, financial, medical, emotional condition, personal relationships, reputation or character description, treatment plans and placement planning and services.
(2) Categories of other data may include social security numbers, case numbers, control systems and correspondence.
(3) Records are maintained pertaining to children and families serviced by the Division of Children and Protective Services.
(b)Division of Treatment and Assurance Records
(1) Personal data records may include social and family history, education, financial, medical, emotional condition, personal relationships, reputation or character description, treatment plans and placement planning and services.
(2) Categories of other data may include social security numbers, case numbers, control systems, correspondence and survey reports.
(3) Records are maintained which may pertain to children/youth, child-caring facilities, child placing agencies, and vendors of services purchased by the department.
(c) Division of Personnel Records
(1) Personal data records may include employment history, salary records, education, mental/emotional condition or history, and references.
(2) Categories of other data may include social security numbers, employee numbers, and addresses.
(3) Records are maintained pertaining to department applicants for employment and employees.
(d) Division of Fiscal Services Records
(1) Personal data records may include financial payments, vendor names and addresses, children's income and assets, requests for and receipt of federal and state payments to the department.
(2) Categories of other data may include social security numbers and case numbers.
(3) Records are maintained pertaining to payments made on behalf of children/families involved in Department programs and reimbursements secured by the Department.
(e) Division of Licensing Records
(1) Personal data records may include social and family history, education, financial, medical, emotional condition, personal relationships, reputation or character description, photo listing of children free for adoption and listing of families seeking to adopt a child.
(2) Categories of other data may include controls, correspondence and reports.
(3) Records are maintained pertaining to child care facilities, child placing agencies licensed by the Department and to reflect the operation of the Adoption Resource Exchange.
(f) Unified School District II Records
(1) Personal data records may include social and family history, education, financial, medical, emotional condition.
(2) Categories of other data may include program and case identification numbers.
(3) Records are maintained pertaining to students serviced by the Unified School District II.
(g) Division of Research and Evaluation - Emergency Shelter Records
(1) Personal data records may include name, age, sex of applicant/resident of emergency shelter, prior and planned future living arrangements, dates of admission and discharge, and reasons for admission.
(2) Categories of other data may include social security numbers, case numbers, correspondence and monitoring reports.
(3) Records are maintained pertaining to youth in need of emergency shelter services.
(h) Division of Data Processing Records
(1) Personal data records may include social and family history, education, financial, emotional condition, personal relationships.
(2) Categories of other data may include social security and case numbers.
(3) Records are maintained pertaining to children and families serviced by the Department and vendors of services purchased by the Department.
(i) Henry D. Altobello Children and Youth Center Records
(1) Personal data records may include medical and emotional condition and history, family and personal relationships, character, finances, education and work history.
(2) Categories of other data may include social security and case numbers.
(3) Records are maintained in the name of the child/patient but may contain information about family members and/or other significant adult persons.
(j) Greater Bridgeport Children's Services Center Records
(1) Personal data records may include medical and emotional condition and history, family and personal relationships, character, finances, education and work history.
(2) Categories of other data may include social security and case numbers.
(3) Records are maintained in the name of the child/patient but may contain information about family members and/or other significant adult persons.
(k) High Meadows Records
(1) Personal data records may include medical and emotional condition and history, family and personal relationships, character, finances, education and work history.
(2) Categories of other data may include social security and case numbers.
(3) Records are maintained in the name of the child/patient but may contain information about family members and/or other significant adult persons.
(l) Housatonic Adolescent Hospital Records
(1) Personal data records may include medical and emotional condition and history, family and personal relationships, character, finances, education and work history.
(2) Categories of other data may include social security and case numbers.
(3) Records are maintained in the name of the child/patient but may contain information about family members and/or other significant adult persons.
(m) Long Lane School Records
(1) Personal data records may include medical and emotional condition and history, family and personal relationships, character, finances, education and work history.
(2) Categories of other data may include social security and case numbers.
(3) Records are maintained in the name of the child but may contain information about family members and/or other significant adult persons.
(n) RiverView Hospital Records
(1) Personal data records may include medical and emotional condition and history, family and personal relationships, character, finances, education and work history.
(2) Categories of other data may include social security and case numbers.
(3) Records are maintained in the name of the child/patient but may contain information about family members and/or other significant adult persons.
(o) State Receiving Home Records
(1) Personal data records may include medical and emotional condition and history, family and personal relationships, character, finances, education and work history.
(2) Categories of other data may include social security and case numbers.
(3) Records are maintained in the name of the child but may contain information about family members and/or other significant adult persons.
(p) Wilderness School Records
(1) Personal data records may include education, financial, medical, emotional history, family and personal relationships, and information pertaining to child/youth participation in programs while at Wilderness School and in other programs upon return to the community.
(2) Categories of other data may include social security and case numbers.
(3) Records are maintained pertaining to youth who are/or have participated in school programs.
(Effective April 27, 1987)
Section 17-415(g)-9. Maintenance of personal data
(a) Personal data will not be maintained unless relevant and necessary to accomplish the lawful purposes of the agency. Where the agency find irrelevant or unnecessary public records in its possession, the agency shall dispose of the records in accordance with its records retention schedule and with the approval of the Public Records Administrator as per Conn. Gen. Stat. §11-8a. or, if the records are not disposable under the records retention schedule, request permission from the Public Records Administrator to dispose of the records under Conn. Gen. Stat. §11-8a.
(b) The agency will collect and maintain all records with accurateness and completeness.
(c) Insofar as it is consistent with the needs and mission of the agency, the agency, wherever practical, shall collect personal data directly from the persons to whom a record pertains.
(d) Agency employees involved in the operations of the agency's personal data systems will be informed of the provisions of: (i) the Personal Data Act; (ii) the agency's regulations adopted pursuant to §4-196; (iii) the Freedom of Information Act and (iv) any other state or federal statute or regulations concerning maintenance or disclosure of personal data kept by the agency.
(e) All agency employees shall take reasonable precautions to protect personal data under their custody from the danger of fire, theft, flood, natural disaster and other physical threats.
(f) The agency shall incorporate by reference the provisions of the Personal Data Act and regulations promulgated thereunder in all contracts, agreements or licenses for the operation of personal data system or for research, evaluation and reporting of personal data for the agency or on its behalf.
(g) The department shall have an independent obligation to insure that personal data requested from any other agency is properly maintained.
(h) Only agency employees who have a specific need to review personal data records for lawful purposes of the agency will be entitled to access to such records under the Personal Data Act.
(i) The agency will keep a written up-to-date list of individuals entitled to access to each of the agency's personal data system.
(j) The agency will insure against unnecessary duplication of personal data records. In the event it is necessary to send personal data records through interdepartmental mail, such records will be sent in envelopes or boxes sealed and marked "confidential."
(k) The agency will insure that all records in manual personal data systems are kept under lock and key and, to the greatest extent practical, are kept in controlled access areas.
(l) With Respect To Automated Personal Data Systems
(2) To the greatest extent practical, the agency shall require visitors to such area to sign a visitor's log and permit access to said area on a bona-fide need-to-enter basis only.
(3) The agency, to the greatest extent practical, will insure that regular access to automated equipment is limited to the operations personnel.
(4) The agency shall utilize appropriate access control mechanisms to prevent disclosure of personal data to unauthorized individuals.
(m) Records for each personal data system are maintained in accordance with schedules prepared by the Connecticut State Library, Department of Public Records Administration and records retention schedules approved by the Public Records Administrator as authorized by Section 11-8a of the C.G.S. Retention schedules are on file at the Central Office of the Department of Children and Youth Services and may be examined during normal working hours.
(Effective April 27, 1987)
Section 17-415(g)-10. Disclosure of personal data
(a) Within four business days of receipt of a written request therefore, the agency shall mail or deliver to the requesting individual a written response in plain language, informing him/her as to whether or not the agency maintains personal data on that individual, the category and location of the personal data maintained on that individual and procedures available to review the records.
(b) Except where nondisclosure is required or specifically permitted by law, the agency shall disclose to any person upon written request all personal data concerning that individual which is maintained by the agency. The procedures for disclosure shall be in accordance with Conn. Gen. Stat. §§1-15 through 1-21k. If the personal data is maintained in coded form, the agency shall transcribe the data into a commonly understandable form before the disclosure.
(c) The agency is responsible for verifying the identity of any person requesting access to his/her own personal data.
(d) The agency is responsible for ensuring that disclosure made pursuant to the Personal Data Act is conducted so as not to disclose any personal data concerning persons other than the person requesting the information.
(e) The agency may refuse to disclose to a person medical, psychiatric or psychological data on the person if the agency determines that such disclosure would be detrimental to that person. Additionally, the agency may refuse to disclose to a person personal data pertaining to that person if such non-disclosure is otherwise permitted or required by law.
(f) In any case where the agency refuses disclosure, it shall advise that person of his/her right to seek judicial relief pursuant to the Personal Data Act.
(g) If the agency refuses to disclose medical, psychiatric or psychological data to a person based on its determination that disclosure would be detrimental to that person and nondisclosure is not mandated by law, the agency shall, at the written request of such person, permit a qualified medical doctor to review the personal data contained in the person's record to determine if the personal data should be disclosed. If disclosure is recommended by the person's medical doctor, the agency shall disclose the personal data to such person; if non disclosure is recommended by such person's medical doctor, the agency shall not disclose the personal data and shall inform such person of the judicial relief provided under the Personal Data Act.
(h) The agency shall maintain a complete log of each person, individual, agency or organization who has obtained access or to whom disclosure has been made of personal data under the Personal Data Act, together with the reason for each such disclosure or access. This log shall be maintained for not less than five years from the date of such disclosure or access or for the life of personal data record, whichever is longer.
(i) When an individual is asked to supply personal data to a state agency, including the agency, the agency shall disclose to that individual, upon request:
(1) The name of such agency and division within such agency requesting the personal data;
(2) The legal authority under which such agency is empowered to collect and maintain the personal data;
(3) The individual's rights pertaining to such records under the Personal Data Act and agency regulations;
(4) The known consequences arising from supplying or refusing to supply the requested personal data; and
(5) The proposed use to be made of the requested personal data.
(Effective April 27, 1987)
Section 17-415(g)-11. Contesting the content of personal data records
(a) Any person who believes that the agency is maintaining inaccurate, incomplete or irrelevant personal data concerning him/her may file a written request with the agency for correction of said personal data;
(b) Within 30 days of receipt of such request, the agency shall give written notice to that person that it will make the requested correction, or if the correction is not to be made as submitted, the agency shall state the reason for its denial of such request and notify the person of his/her right to add his/her own statement to his/her personal data records.
(c) Following such denial by the agency, the person requesting such correction shall be permitted to add a statement to his or her personal data record setting forth what that person believes to be an accurate, complete and relevant version of the personal data in question. Such statements shall become a permanent part of the agency's personal data system and shall be disclosed to any individual, agency or organization to which the disputed personal data is disclosed.
(Effective April 27, 1987)