Introduction
Children, youth, and families involved with public systems have an expectation of, need for, and right to privacy. This interest is protected by the laws, regulations, and professional responsibilities that limit the disclosure of information. Protecting the confidentiality of information belonging to children, youth and families is not only a legal and ethical obligation, it is essential to establishing trust and building relationships among families and the systems that work with and come into contact with them. The disclosure of sensitive information carries the potential of significant consequences, some unintended and harmful. Children, youth, and families have due process rights that must be preserved and protected. For these reasons, professionals should presume that personally identifiable information is confidential.
Agencies and individuals who work with children, youth, and families are aware that the need or desire to share information commonly arises in their work. The lawful and appropriate disclosure of information has several benefits: services may be better coordinated and provided more efficiently, duplication in assessment and service provision can be avoided, and more informed decisions can be made based on accurate and timely information. In this way, information disclosure serves to further the welfare of the child or young adult and enhance child and family well-being. However, disclosure of information can also have harmful effects: providing information about a child or family can prejudice decision makers, it could incriminate the youth or a family member, or cause embarrassment to a family and lead to distrust of agencies and agency personnel. Therefore, disclosing information should not be viewed as strictly beneficial or harmful, but rather with an appreciation of the potential positive and negative consequences.
Personally identifiable confidential information must only be disclosed or used in a manner that is consistent with applicable federal and state laws. This means that personally identifiable confidential information is disclosed and used either with the informed and voluntary authorization of the person the information relates to or someone legally authorized to consent (e.g., parent of minor), or pursuant to an explicit exception to the consent requirement under applicable federal and state laws.
Recognizing that privacy laws are often confusing and that confidentiality policies are often outdated and unclear, the Massachusetts Court Improvement Program, through the Supreme Judicial Court of the Commonwealth, sought to collaboratively develop and produce a resource guide and quick reference grid on federal and state confidentiality laws and policies addressing Child Welfare, Juvenile Court, Probate and Family Court, Juvenile Justice, Education, and treatment information. This guide is the product of the work of a dedicated cross-system group of attorneys and practitioners aiming to provide a better understanding of how and when information can be disclosed.
At the end of the document is a Glossary along with links to pertinent laws, regulations, rules and policies.
Purpose and principles
The purpose of this guide is to inform a wide range of professionals working with children and families about confidentiality and privilege laws, thus promoting adherence to the law when making decisions about the disclosure of information and minimizing any unintended negative consequences.
The principles guiding information disclosure are as follows:
- Personally identifiable confidential information must only be disclosed in accordance with the law.
- Privacy is essential to establishing trust and building relationships among children, youth, and families and the systems that serve them.
- Due process rights must be preserved and protected.
- Before requesting confidential information, consider the purpose of your request and whether you need the information.
- When requesting consent to disclose confidential information, any consent obtained must be fully informed.
- Whenever possible, parents, youth, and children should be informed about the disclosure of their confidential information.
- Where disclosure of confidential information is allowed, but not required, it should be done for the purpose of promoting positive outcomes for children, youth, and families, and any possible unintended consequences of disclosure should be considered.
How to use this guide
Users of this guide are encouraged to read the introduction in its entirety and to return to the principles outlined above when considering whether or not information can and should be disclosed. Following the introduction, the guide is organized by section, with each section specific to agencies or entities that hold information. Within each section, questions are posed that represent common information sharing scenarios involving the particular agency or entity. The answers address what law and/or policy directs you to do when asked for information if you are the holder of information. If you are the individual or entity requesting the information, the answers indicate how you can anticipate the holder of information will respond to your request.
Note that there may be different limitations or requirements if the information requested originated with an entity different from the one holding the information. This is particularly relevant to entities whose records may include information obtained from other sources, such as education, mental health or substance use disorder treatment records.
When the term “disclosure” is used, it is referring to both the written and oral communication of confidential information. This includes phone conversations, communication at meetings, casual conversations, written records, etc. Where a specific rule treats oral and written communications differently, this will be noted.
This guide relies primarily on statutes, regulations, and court rules. There also may be agreements between agencies and entities allowing for the sharing of information in limited circumstances, e.g. Memorandum of Understanding. If you have questions about whether your request for information may fall within an information sharing agreement, contact the relevant agency or entity.
What is consent to release information?
Many laws permit the disclosure of information with the written consent of the individual or someone authorized to consent for the individual. This is sometimes referred to as a “consent,” an “authorization to release,” a “release of information,” or “authorization for disclosure.” The person who signs the release must give informed consent for the information to be disclosed. "Informed consent" means that the person consenting to the disclosure is aware of the confidentiality of the information, the reason for the information request, and how the information will be used. An attorney should be consulted during the informed consent process to ensure the person completely understands how the information could be used.
An “authorization to disclose records” or a “release of information” is a document that legally allows the disclosure of information by agencies and individuals. Any release form should clearly identify the specific information being sought so that the holder of the information is on notice as to what should be provided. Release forms must comply with the laws related to the type of information sought. For example, medical records require a form that is compliant with federal law (HIPAA[1]). The release should also state that the individual has the right to revoke the release at any time; include an indication of whether the information may be re-disclosed; and specify the period of time for which the release is valid.
Who can consent to release of information about a child?
Ordinarily, a parent, guardian or custodian can consent to the release of confidential information about their child. However, there are exceptions to this rule depending upon the type of information, the age of the child, and whether the parents and child are parties to a court proceeding. In the case of a child who is 14 or older, or who has entered the ninth grade, the child or the parent may consent to the release of the child’s education records. 603 CMR 23.02. In some limited situations, minors can consent to their own medical treatment. If this is the case, the minor alone has the right to consent to release of information concerning that treatment. 45 C.F.R. §164.502(g)(3). See the Health Care Section for examples of when a minor has the right to consent to release of their information.
Questions to ask yourself before disclosing confidential information:
- Who is asking for the information?
- What specific information is the requestor asking for?
- If a release or consent is provided, does it comply with the applicable law?
- If there is no release, do I have the authority to disclose the information being requested?
- Have I reviewed the record to make sure I am only disclosing the information requested?
- Have I redacted or removed all information that I am not authorized to release?
This guide is not a substitute for legal advice and answers only basic questions regarding confidentiality and disclosure of information. To fully understand the laws that apply, review applicable law and professional guidelines, and/or consult your supervisor or legal counsel.
Disclosure of Confidential Information Quick Reference Grid
Footnotes
[1] The Privacy Rule of the Federal Health Insurance Portability and Accountability Act. See pp. 26-28.