20 C.F.R. § 401.200 – Blood donor locator service.

(a) General. We will enter into arrangements with State agencies under which we will furnish to them at their request the last known personal mailing addresses (residence or post office box) of blood donors whose blood donations show that they are or may be infected with the human immunodeficiency virus which causes acquired immune deficiency syndrome. The State agency or other authorized person, as defined in paragraph (b) of this section, will then inform the donors that they may need medical care and treatment. The safeguards that must be used by authorized persons as a condition to receiving address information from the Blood Donor Locator Service are in paragraph (g) of this section, and the requirements for a request for address information are in paragraph (d) of this section.
(b) Definitions. State means the 50 States, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, Guam, the Commonwealth of Northern Marianas, and the Trust Territory of the Pacific Islands.
Authorized person means—
1. (1) Any agency of a State (or of a political subdivision of a State) which has duties or authority under State law relating to the public health or otherwise has the duty or authority under State law to regulate blood donations; and
2. (2) Any entity engaged in the acceptance of blood donations which is licensed or registered by the Food and Drug Administration in connection with the acceptance of such blood donations, and which provides for—
  1. (i) The confidentiality of any address information received pursuant to the rules in this part and section 1141 of the Social Security Act and related blood donor records;
  2. (ii) Blood donor notification procedures for individuals with respect to whom such information is requested and a finding has been made that they are or may be infected with the human immunodeficiency virus; and
  3. (iii) Counseling services for such individuals who have been found to have such virus. New counseling programs are not required, and an entity may use existing counseling programs or referrals to provide these services.
Related blood donor records means any record, list, or compilation established in connection with a request for address information which indicates, directly or indirectly, the identity of any individual with respect to whom a request for address information has been made pursuant to the rules in this part.
(c) Use of social security number for identification. A State or an authorized person in the State may require a blood donor to furnish his or her social security number when donating blood. The number may then be used by an authorized person to identify and locate a donor whose blood donation indicates that he or she is or may be infected with the human immunodeficiency virus.
(d) Request for address of blood donor. An authorized person who has been unable to locate a blood donor at the address he or she may have given at the time of the blood donation may request assistance from the State agency which has arranged with us to participate in the Blood Donor Locator Service. The request to the Blood Donor Locator Service must—
1. (1) Be in writing;
2. (2) Be from a participating State agency either on its own behalf as an authorized person or on behalf of another authorized person;
3. (3) Indicate that the authorized person meets the confidentiality safeguards of paragraph (g) of this section; and
4. (4) Include the donor's name and social security number, the addresses at which the authorized person attempted without success to contact the donor, the date of the blood donation if available, a statement that the donor has tested positive for the human immunodeficiency virus according to the latest Food and Drug Administration standards or that the history of the subsequent use of the donated blood or blood products indicates that the donor has or may have the human immunodeficiency virus, and the name and address of the requesting blood donation facility.
(e) SSA response to request for address. After receiving a request that meets the requirements of paragraph (d) of this section, we will search our records for the donor's latest personal mailing address. If we do not find a current address, we will request that the Internal Revenue Service search its tax records and furnish us any personal mailing address information from its files, as required under section 6103(m)(6) of the Internal Revenue Code. After completing these searches, we will provide to the requesting State agency either the latest mailing address available for the donor or a response stating that we do not have this information. We will then destroy the records or delete all identifying donor information related to the request and maintain only the information that we will need to monitor the compliance of authorized persons with the confidentiality safeguards contained in paragraph (g) of this section.
(f) SSA refusal to furnish address. If we determine that an authorized person has not met the requirements of paragraphs (d) and (g) of this section, we will not furnish address information to the State agency. In that case, we will notify the State agency of our determination, explain the reasons for our determination, and explain that the State agency may request administrative review of our determination. The Commissioner of Social Security or a delegate of the Commissioner will conduct this review. The review will be based on the information of record and there will not be an opportunity for an oral hearing. A request for administrative review, which may be submitted only by a State agency, must be in writing. The State agency must send its request for administrative review to the Commissioner of Social Security, 6401 Security Boulevard, Baltimore, MD 21235, within 60 days after receiving our notice refusing to give the donor's address. The request for review must include supporting information or evidence that the requirements of the rules in this part have been met. If we do not furnish address information because an authorized person failed to comply with the confidentiality safeguards of paragraph (g) of this section, the State agency will have an opportunity to submit evidence that the authorized person is now in compliance. If we then determine, based on our review of the request for administrative review and the supporting evidence, that the authorized person meets the requirements of the rules in this part, we will respond to the address request as provided in paragraph (e) of this section. If we determine on administrative review that the requirements have not been met, we will notify the State agency in writing of our decision. We will make our determination within 30 days after receiving the request for administrative review, unless we notify the State agency within this 30-day time period that we will need additional time. Our determination on the request for administrative review will give the findings of fact, the reasons for the decision, and what actions the State agency should take to ensure that it or the blood donation facility is in compliance with the rules in this part.
(g) Safeguards to ensure confidentiality of blood donor records. We will require assurance that authorized persons have established and continue to maintain adequate safeguards to protect the confidentiality of both address information received from the Blood Donor Locator Service and related blood donor records. The authorized person must, to the satisfaction of the Secretary—
1. (1) Establish and maintain a system for standardizing records which includes the reasons for requesting the addresses of blood donors, dates of the requests, and any disclosures of address information;
2. (2) Store blood donors' addresses received from the Blood Donor Locator Service and all related blood donor records in a secure area or place that is physically safe from access by persons other than those whose duties and responsibilities require access;
3. (3) Restrict access to these records to authorized employees and officials who need them to perform their official duties related to notifying blood donors who are or may be infected with the human immunodeficiency virus that they may need medical care and treatment;
4. (4) Advise all personnel who will have access to the records of the confidential nature of the information, the safeguards required to protect the information, and the civil and criminal sanctions for unauthorized use or disclosure of the information;
5. (5) Destroy the address information received from the Blood Donor Locator Service, as well as any records established in connection with the request which indicate directly or indirectly the identity of the individual, after notifying or attempting to notify the donor at the address obtained from the Blood Donor Locator Service; and
6. (6) Upon request, report to us the procedures established and utilized to ensure the confidentiality of address information and related blood donor records. We reserve the right to make onsite inspections to ensure that these procedures are adequate and are being followed and to request such information as we may need to ensure that the safeguards required in this section are being met.
(h) Unauthorized disclosure. Any official or employee of the Federal Government, a State, or a blood donation facility who discloses blood donor information, except as provided for in this section or under a provision of law, will be subject to the same criminal penalty as provided in section 7213(a) of the Internal Revenue Code of 1986 for the unauthorized disclosure of tax information.