Wyo. Code R. 048-0032-1
Effective Date: 07/12/1994 to 04/03/2008
Rule Type: Superceded Rules & Regulations
Reference Number: 048.0032.1.07121994
Section 1. Introduction. These rules pertain to the confidentiality and security of records maintained by the Wyoming Department of Health and/or its component divisions. With these rules and regulations, it is the intention of this agency to establish good practices in the handling of personal information entrusted to this agency for application to all agency personnel and to establish a procedure whereby an individual may have access to available records that pertain to him as authorized by the Wyoming Public Records Act (W.S. 16-4-201 et. seq.), W.S. 14-3-214, where not covered by agency enabling legislation.
a) Access. A way or means of approaching, obtaining, using, etc.; the ability to obtain the information contained in a record.
(b) Agency. Any bureau, board, commission, committee, or sub-agency of the state, county, municipality, or other political subdivision which is created by or pursuant to the Wyoming Constitution, statute, or ordinance, other than the state legislature and the judiciary.
(c) Confidential. The status of personal information according to federal regulations, state statutes, executive order, or agency regulations that connotes some commitment to withhold from authorized users information obtained from an individual or institution.
(d) Confidential Statistical Record. A group of any records under the control of an agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.
(e) Department. Shall refer to the Department of Health and/or its component divisions.
(f) Disclosure. Providing an individual (other than those authorized access for routine use) the information contained in a record; the release or transfer of information through oral, written, or electronic means.
(g) File. Any aggregation of individual records gathered for a particular purpose and organized or indexed as a unit.
(h) Financial. Fiscal, relating to salary, benefits, profits, debts of an individual.
(i) He/His. Use of the personal pronouns he/his within these rules and regulations shall at the same time refer to the personal pronouns she/her.
(j) Individual. Any man, woman, child, or place of business or organization on whom an agency keeps records or maintains information.
(k) Interest. A right or claim to something; advantage; welfare; benefit; importance; or study of medicine.
(l) Personal Information. All information that describes anything about an individual, such as records of financial transactions, medical treatments, or other services; any information that is or can be retrieved from a record or record-keeping system by reference to the name, number, or some other identifying feature associated with the individual to whom the information pertains.
(m) Medical. Of or connected with medicine or the practice or study of medicine.
(n) Privileged Information. Information that one cannot legally be compelled to divulge, as that to a lawyer from his client; information given with the stipulation that it shall not be divulged further.
(o) Psychological. Of the mind; mental.
(p) Public Interest. Something in which the public, the community-at-large, has some particular interest, or some interest by which their legal rights or liabilities are affected; interest shared by citizens generally in affairs of local, state, or national government.
(q) Record. Any grouping of information about an individual that is maintained in the file of an agency or organization that contains a name or identifying number or symbol assigned to the individual used to make a decision about the rights, character, opportunities, benefits, or liabilities of the individual to whom the record pertains.
(r) Responsible Authority. Any office or official established by state law as the body responsible for the collection and use of any system or record on persons or summary data.
(s) Right to Know. Conferred upon specific individuals either by statute or jurisprudence to execute the statutory function of the information maintained.
(t) Right to Privacy. The individual’s right to be left alone, to decide for himself how much he will share with others his thoughts, his feelings, and the facts of his personal life.
(u) Routine Use. The use of a record for the purpose for which it was collected according to statutory authority or agency regulation.
(v) Sociological. Having to do with the associated life of an individual; social identifiers relating to interaction with society.
(w) Statistical Record. A record maintained for statistical research or reporting purposes only and not used in whole or in part in making any determination about an identifiable individual.
(x) Subject. An individual or legal entity about whom personal information is maintained in an information system.
(y) Trade Secrets. A plan or process, tool, mechanism, or compound known only to its owner and those of his employees to whom it is necessary to confide it; a secret formula or process having commercial value.
Section 3. Disclosure. Records that are determined by the department to be public records shall be available for inspection to all inquiries without regard to intended use or purpose during normal business hours of the department. Records that are determined by the department to be confidential shall not in any event be communicated to any person who is not the subject of the record unless the subject provides written consent for the department to disclose such confidential information to any person or organization for the benefit of the individual who is the subject of the record. Circumstances under which disclosure with the individual's consent may be deemed to be beneficial to the individual include, but are not limited to, those disclosures which may assist the individual in connection with any public or private claim, right, privilege, gratuity, grant, or other interest accruing to, or for the benefit of, the individual or his immediate family.
The department may disclose the contents of a confidential record without the prior consent of the individual according to the following situations:
(a) To medical personnel to the extent necessary to meet a bona fide medical emergency.
(b) To qualified personnel for the purpose of conducting scientific research, management audits, or program evaluations, but such personnel may not identify directly or indirectly any individual in any report of such research, audit, or evaluation, or otherwise disclose individual identities in any manner.
(c) To any component of the health care rehabilitative system within the State of Wyoming that has a legitimate need for the record to further the treatment of, or any benefit to, the individual who is the subject of the record.
(d) To officers or employees of the department who have a clearly established need for the record as a routine use in order to carry out legal duties of administering or enforcing the laws of the Federal Government, the State of Wyoming, or any of its political sub-divisions.
Records that are classified as confidential by the department may not be disclosed without a court order to any member of the criminal justice system for the initiation or substantiation of any criminal charges against an individual or to conduct any investigation of an individual. The provisions of any portion of Section 3 continue to apply to records concerning any individual who has been in contact with this department, irrespective of whether or when he ceases to receive any service or benefit from this agency.
Section 4. Request for Access. All records classified as confidential by the department are so classified according to federal and state statute. The individual who is the subject of any confidential record shall be afforded the opportunity to see any portion thereof which, in the responsible authority's judgment, disclosure would not be detrimental for the individual to know. When denying access to any record, the responsible authority must furnish the statutory reference that allows him to deny access to such record. The responsible authority must be prepared to prove that disclosure of such information to the individual who is the subject of the record would not be in his own best interest to know. This department shall release any portion of a confidential record that can be disclosed to the individual without an adverse effect upon the individual.
Section 5. Procedure for Access. This department shall respond to requests for access to a record within a reasonable time period, not to exceed thirty (30) days, specifying whether access will be granted and the time, place, and circumstances of access. The person requesting access may be accompanied by another person of his choosing or may be represented by another person with his written approval. Access will be provided only during regular working hours of this department. Copies of the record may be provided at the requester’s expense at reasonable cost to cover the expense incurred in compiling and copying the requested data. This department shall request appropriate identification from the person seeking access to his own records to be presented at the time of access.
Section 6. Correction and Amendment. The individual who is the subject of the record has the right to bring to the attention of the responsible authority any erroneous, inaccurate, or misleading information that is contained in his record subject to access restrictions imposed by the Wyoming Public Records Act (W.S. 16-4-201 et. seq.). He shall have the right to correct or amend such inaccuracies with a written request to the responsible authority, identifying the specific record to be corrected, the erroneous portion of the record, and the proposed amendment. Correction or amendment may be by the physical alteration of the record or by the inclusion of the individual’s “version” of the disputed data. All future use of the record shall include the individual’s corrections or amendments. The individual who has any disputes with this department over access to, or amendment of, a record to which he is its subject, must present his grievance to the appropriate supervisor of the record in dispute. Further, the individual has the right to a public hearing. The individual has the right to petition the district court for an order permitting him access to any record denied his inspection and review. The responsible authority for the record may ask the district court for the right to restrict access to any record which, in the responsible authority’s judgment, knowledge of which would not be in the individual’s best interest to know.
Section 7. Personnel Records. The individual who is an employee of this department has the right to view his own employment application; performance ratings; and scholastic achievement data received as part of state employee training, that is maintained within the personnel files of this department. All the contents of an individual’s personnel file shall be available to the duly elected and appointed officials who supervise the work of the employee. Responses to inquiries concerning present or former employees of this department shall be limited to employment dates and employment responsibilities. The gross annual salary of an employee may be given to inquirers who have not obtained the employee’s written consent, but only in a manner that affirms or denies the salary information in possession of the inquirer as when financial institutions or prospective employers call to verify information provided them by an employee or former employee. Requests for recommendations of former employees shall be limited to the above information and a factual evaluation of the employee’s performance. This department shall be prepared to fully document and defend any negative recommendations of a former employee, allowing the former employee to physically attach his “version” of any facts surrounding his employment to the department’s version. Both versions shall be made available to any future employer upon his request with the written consent of the former employee.
Section 8. Maintenance of Records. The department shall:
(a) Maintain any record that is used to make determinations about an individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual.
(b) Establish physical safeguards and specific security policies for the protection of each system from burglary, misuse, or destruction.
(c) Give timely notice to the Data Management Consultant (Administration) when any new personal information system is added to the agency’s operation or when there is any new routine use of an established system.
(d) Maintain all systems of personal information in a manner that is conducive to public inspection and access subject to enabling legislation and to the Wyoming Public Records Act.
(e) Maintain only that information about an individual necessary to accomplish the agency’s purposes as authorized by statute.
(f) Collect information to the greatest extent possible directly from the individual who is the subject of the record.
The department shall give the following annual notification to the Data Management Consultant (Administration) for each personal information system maintained:
(g) The title and location of the system.
(h) The major data elements of the system.
(i) The statutory authority for the classification and collection of information.
(j) The title, business address, and telephone number of the responsible authority for the system.
Section 9. Mailing Lists. Requests for names and addresses maintained by the department will be refused unless the requester can prove to the satisfaction of the responsible authority that release of the information will promote the health and safety of the citizens of Wyoming. All requests for mailing lists shall be evaluated within thirty (30) days as to whether the request should be approved or denied. The requester may be required to complete an “Agreement for Information” form identifying the organization or person making the request, a copy of any material to be mailed, and a guarantee that the names and addresses furnished will be used only for the stated purpose, and will not be transferred to any other party or to a computerized data system. The completed “Agreement for Information” form will be forwarded to the Data Management Consultant (Administration) prior to release of the mailing list(s). If the request for a mailing list is denied, the responsible authority shall so inform the requester within thirty (30) days, and the reasons for the refusal will be stated. Denial of permission to release mailing lists will be grounds for a public hearing.