45 C.F.R. § 1326.25 – Access to records.

(a) Pursuant to sections 143(a)(2), (A)(i), (B), (I), and (J) of the Act, and subject to the provisions of this section, a Protection and Advocacy (P&A) System, and all of its authorized agents, shall have access to the records of individuals with developmental disabilities under the following circumstances:
1. (1) If authorized by an individual who is a client of the system, or who has requested assistance from the system, or by such individual's legal guardian, conservator or other legal representative.
2. (2) In the case of an individual to whom all of the following conditions apply:
  1. (i) The individual, due to his or her mental or physical condition, is unable to authorize the system to have access;
  2. (ii) The individual does not have a legal guardian, conservator or other legal representative, or the individual's guardian is the State (or one of its political subdivisions); and
  3. (iii) The individual has been the subject of a complaint to the P&A system, or the P&A system has probable cause (which can be the result of monitoring or other activities including media reports and newspaper articles) to believe that such individual has been subject to abuse and neglect.
3. (3) In the case of an individual, who has a legal guardian, conservator, or other legal representative, about whom a complaint has been received by the system or, as a result of monitoring or other activities, the system has determined that there is probable cause to believe that the individual with developmental disability has been subject to abuse or neglect, whenever the following conditions exist:
  1. (i) The P&A system has made a good faith effort to contact the legal guardian, conservator, or other legal representative upon prompt receipt (within the timelines set forth in paragraph (c) of this section) of the contact information (which is required to include but not limited to name, address, telephone numbers, and email address) of the legal guardian, conservator, or other legal representative;
  2. (ii) The system has offered assistance to the legal guardian, conservator, or other legal representative to resolve the situation; and
  3. (iii) The legal guardian, conservator, or other legal representative has failed or refused to provide consent on behalf of the individual.
4. (4) If the P&A determines there is probable cause to believe that the health or safety of an individual is in serious and immediate jeopardy, no consent from another party is needed.
5. (5) In the case of death, no consent from another party is needed. Probable cause to believe that the death of an individual with a developmental disability resulted from abuse or neglect or any other specific cause is not required for the P&A system to obtain access to the records. Any individual who dies in a situation in which services, supports, or other assistance are, have been, or may customarily be provided to individuals with developmental disabilities shall, for the purposes of the P&A system obtaining access to the individual's records, be deemed an “individual with a developmental disability.”
(b) Individual records to which P&A systems must have access under section 143(a)(2), (A)(i), (B), (I), and (J) of the Act (whether written or in another medium, draft, preliminary or final, including handwritten notes, electronic files, photographs or video or audiotape records) shall include, but shall not be limited to:
1. (1) Individual records prepared or received in the course of providing intake, assessment, evaluation, education, training and other services; supports or assistance, including medical records, financial records, and monitoring and other reports prepared or received by a service provider. This includes records stored or maintained at sites other than that of the service provider, as well as records that were not prepared by the service provider, but received by the service provider from other service providers.
2. (2) Reports prepared by a Federal, State or local governmental agency, or a private organization charged with investigating incidents of abuse or neglect, injury or death. The organizations whose reports are subject to this requirement include, but are not limited to, agencies in the foster care systems, developmental disabilities systems, prison and jail systems, public and private educational systems, emergency shelters, criminal and civil law enforcement agencies such as police departments, agencies overseeing juvenile justice facilities, juvenile detention facilities, all pre- and post-adjudication juvenile facilities, State and Federal licensing and certification agencies, and private accreditation organizations such as the Joint Commission on the Accreditation of Health Care Organizations or by medical care evaluation or peer review committees, regardless of whether they are protected by federal or state law. The reports subject to this requirement describe any or all of the following:
  1. (i) The incidents of abuse, neglect, injury, and/or death;
  2. (ii) The steps taken to investigate the incidents;
  3. (iii) Reports and records, including personnel records, prepared or maintained by the service provider in connection with such reports of incidents; or,
  4. (iv) Supporting information that was relied upon in creating a report including all information and records that describe persons who were interviewed, physical and documentary evidence that was reviewed, and the related investigative findings;
3. (3) Discharge planning records; and
4. (4) Information in professional, performance, building or other safety standards, and demographic and statistical information relating to a service provider.
(c) The time period in which the P&A system must be given access to records of individuals with developmental disabilities under sections 143(a)(2)(A)(i), (B), (I), and (J) of the Act, and subject to the provisions of this section, varies depending on the following circumstances:
1. (1) If the P&A system determines that there is probable cause to believe that the health or safety of the individual with a developmental disability is in serious and immediate jeopardy, or in any case of the death of an individual with a developmental disability, access to the records of the individual with a developmental disability, as described in paragraph (b) of this section shall be provided (including the right to inspect and copy records as specified in paragraph (d) of this section) to the P&A system within 24 hours of receipt of the P&A system's written request for the records without the consent of another party.
2. (2) In all other cases, access to records of individuals with developmental disabilities shall be provided to the P&A system within three business days after the receipt of such a written request from the P&A system.
(d) A P&A shall be permitted to inspect and copy information and records, subject to a reasonable charge to offset duplicating costs. If the service provider or its agents copy the records for the P&A system, it may not charge the P&A system an amount that would exceed the amount customarily charged other non-profit or State government agencies for reproducing documents. At its option, the P&A may make written notes when inspecting information and records, and may use its own photocopying equipment to obtain copies. If a party other than the P&A system performs the photocopying or other reproduction of records, it shall provide the photocopies or reproductions to the P&A system within the time frames specified in paragraph (c) of this section. In addition, where records are kept or maintained electronically they shall be provided to the P&A electronically.
(e) The Health Insurance Portability and Accountability Act Privacy Rule permits the disclosure of protected health information (PHI) without the authorization of the individual to a P&A system to the extent that such disclosure is required by law and the disclosure complies with the requirements of that law.
(f) Educational agencies, including public, private, and charter schools, as well as, public and private residential and non-residential schools, must provide a P&A with the name of and contact information for the parent or guardian of a student for whom the P&A has probable cause to obtain records under the DD Act.