1. Child and Family Connections (CFC) shall maintain appropriate records as required by 89 Illinois Administrative Code Part 500. All CFC activities shall be conducted in ways that are consistent with confidentiality and other record provisions as set forth in the Health Insurance Portability and Accountability Act (HIPAA), (Public Law 104-191, Title II, § 262(a), 100stat. 2024), the Family Educational Rights to Privacy Act (FERPA) (20 USC 1232g), and other pertaining laws.
  2. CFCs shall protect the confidentiality of personally identifiable information at collection, storage, disclosure and destruction stages.
  3. CFCs shall require one official to assume responsibility for ensuring the confidentiality of the Protected Health Information (PHI).
  4. All persons collecting or using PHI shall be trained regarding confidentiality requirements. All current and new CFC staff must receive basic training on HIPAA Privacy Standards and participation in this training shall be documented in each individual's personnel file.
  5. Each CFC shall maintain, for public inspection, a current listing of those employees having access to PHI.
  6. CFCs shall maintain a permanent case record for each child served by the CFC agency. This record shall be separate from clinical records if the agency also provides treatment or therapy.
  7. Permanent case records shall be housed at the main CFC office. A working file may be copied for use in satellite offices and in the field. Archived files must be accessible for monitoring purposes.
  8. All entries to records shall be kept current and must be legible, dated and the author designated. If hard copy, the author shall sign and date the entry.
  9. Upon initiation of services, CFCs shall obtain consent from families to permit the federal Office of Special Education Programs or its designees, the Department of Healthcare and Family Services or its designees and the Department of Human Services (DHS) and its designees access to all of the family's CFC and service provider records for the purpose of providing and paying for services, monitoring provision of services or investigating complaints.
  10. CFC entities and providers shall have written policies and procedures regarding the compilation, maintenance, storage of and access to records.
  11. Facilities for the handling, processing and storage of records (whether hard copy, magnetic tapes, computer files, or other automated systems, etc.) shall be secured from unauthorized access, theft, loss, fire or other natural occurrences.
  12. Records shall be maintained for a period of at least six (6) years from the child's discharge from Early Intervention (EI) services or longer if administrative or legal action is pending. Destruction of records shall be consistent with pertinent laws.
  13. All removable media including floppy disks, CDs, DVDs, cassettes and flash drives that contain PHI must be destroyed or sanitized prior to being discarded.
  14. Notify the Bureau of EI in writing upon discovery of any lost or stolen equipment such as a laptop or any removable media identified in number 13 above, any time there has been a breach of security or any time that PHI may have been compromised and log all disclosures in each child's file whose PHI may have been compromised due to any of these actions (See Accounting of Disclosures).