3003.1 A Provider or Agency seeking to request or disclose HHSI to a Provider shall do so in accordance with their applicable contract, grant, or similar agreement with the Provider which shall contain provisions governing the sharing of HHSI.

3003.2 A Provider seeking to obtain HHSI from an Agency or another Provider shall submit a written request to the Agency or Provider in possession of the HHSI describing in detail the HHSI sought and the purpose for the HHSI being requested.

3003.3 An Agency or Provider that receives a request for HHSI from another Provider shall maintain an accurate record, for a reasonable period of time:

(a) Of the date and purpose for any request for the HHSI;

(a) The date which the HHSI was disclosed; and

(b) A record of whom the HHSI was disclosed to.

3003.4 For purposes of this Subsection 3003.3, the term “reasonable period of time” incorporates any applicable document retention requirements imposed by District or federal law.

SOURCE: Final Rulemaking published at 61 DCR 8497 (August 15, 2014).