(a)

1. (1) The State Kidney Disease Commission shall maintain a case record for applicants and individuals determined eligible to receive services available through the program.
2. (2) Client information developed or received by the commission is the property of the program.

3. (3) Information contained in the case record shall only be used for:

   1. (A) Determining eligibility/ineligibility for the commission’s services;
   2. (B) Providing payment for services rendered; or
   3. (C) Other program operations.
4. (4) The commission shall maintain personal information contained in the case record in a secure manner and treat such information with the highest degree of confidentiality.

(b)

1. (1) The commission Program Manager is designated as the custodian of applicant and client case records.
2. (2) The Program Manager has the responsibility of ensuring such information is maintained in a safe and secure manner consistent with state and federal law, rule, or regulation.
3. (3) The Program Manager shall provide training to the commission staff regarding how applicant and client information will be developed, maintained, and shared with affected parties.
4. (4) The Program Manager is responsible for the destruction of all closed case files.

(c)

1. (1) When requested in writing, the commission shall make available to the applicant or client or, if appropriate, the individual’s representative, information contained in that person’s case record.
2. (2) Should the applicant or client or, if appropriate, that individual’s representative believe information contained in the case record to be inaccurate or misleading, a written request can be made to the program to amend such information.
3. (3) In the event another agency or organization requests personal information contained in the case record of a commission applicant or client, the program shall only release such information with written consent of the applicant or client or, if appropriate, that individual’s representative.
4. (4) It is the responsibility of the commission and parties involved to respect the confidential nature of personal information and limit information exchanged to that minimally necessary.

5. (5) The commission shall release personal information contained in the case record in response to investigations in connection with law enforcement, fraud, and abuse, unless:

   1. (A) Expressly prohibited by state and federal laws, rules, and regulations; and
   2. (B) In response to an order issued by a judge, magistrate, or other authorized judicial official.