(a) The use and disclosure of all information received for applicants for and recipients of foster care, preventive services and child protective services as a result of an indicated report of child abuse and maltreatment through the child care review service shall be subject to Parts 357, 423 and 432 of this Title. Any person, firm, corporation or association contracted by the department for the child care review service shall safeguard the confidentiality of information received or maintained by the service in the same manner, and will remain subject to the same confidentiality requirements of Parts 357, 423 and 432 of this Title.

1. (1) Disclosure of information to authorized agencies and individuals.

   1. (i) The child care review service will issue individual identifiable information only to representatives of the State Department of Social Services, the local social services district responsible for the child, and any authorized agency as defined in subdivision 10 of section 371 of the Social Services Law providing services and care to the child and, in accordance with provisions below, the child or his representative.
   2. (ii) Information identifiable by caseload or by social worker will only be made available by the child care review service to the authorized agency employing the worker, the local social services district purchasing care and service, and the State Department of Social Services.
   3. (iii) Information not identifying children, families or caseworkers including aggregate information which may identify local social services districts and voluntary agencies will be public information.
   4. (iv) Except for recurring aggregate reports the child care review service will notify public and voluntary agencies of the public release of information specifically identifying their agency.

2. (2) Safeguards for the disclosure of information to authorized agencies and individuals.

   1. (i) Information shall be released to authorized agencies and individuals only when the public welfare official providing such data is assured that:

      1. (a) the confidential character of the information will be maintained;
      2. (b) the information will be used for the purposes for which it is made available, such purposes to be reasonably related to the purposes of the public welfare program and the functioning of the inquiring agency;
      3. (c) the information will not be used for commercial or political purposes.
   2. (ii) The child care review service shall be notified of any use made of child and/or family specific information generated by the child care review service.
   3. (iii) Those agencies receiving individual identifying information from the child care review service shall designate a security officer responsible for assuring the maintenance of the confidentiality of said information.
   4. (iv) Those individuals who fail to take reasonable security precautions resulting in the unlawful disclosure of confidential information shall be guilty of a misdemeanor.

3. (3) Disclosure of information to the child or representative.

   1. (i) Subject to the provisions of Parts 357, 423 and 432 of this Title, any child, his guardian, attorney parent or next of kin shall be provided an opportunity to review information on file with the child care review service pertaining to such child or family.
   2. (ii) Requests to review information on file with the child care review service shall be made to the State director of the child care review service. Denial of such request to review information shall be made in writing stating the reason or reasons therefor.

4. (4) Requests for amendment or expungement of information.

   1. (i) Any child or his guardian, attorney, parent, or next of kin may request that any information on file with the child care review service be amended or expunged.
   2. (ii) Requests for amendment or expungement of information shall be addressed to the director of the child care review service. Within 30 days of the request, the director of the child care review service or his representative shall review the appropriateness of the request, and if in agreement, take appropriate steps to amend or expunge such information from the child care review service.
5. (5) All child care review records must be retained in accordance with the requirements of section 428.10(a)(5) of this Title.