First Regular Session Seventieth General Assembly STATE OF COLORADO INTRODUCED LLS NO. 15-0364.01 Dan Cartin x2045 SENATE BILL 15-038 SENATE SPONSORSHIP Aguilar, HOUSE SPONSORSHIP (None), Senate Committees House Committees State, Veterans, & Military Affairs A BILL FOR AN ACT Concerning access to certain records of a county department of human or social services containing personal identifying information by an auditor conducting a financial or performance audit of that department. Bill Summary (Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://www.leg.state.co.us/billsummaries.) Access to or publication of certain records containing personal identifying information that are held by a county department of human or social services is prohibited or limited under current law. This includes county department records relating to public assistance and welfare, at-risk adults, and child abuse and neglect. The state department of human services also has authority to establish rules restricting the use and disclosure of this information. The bill requires a county department of human or social services to provide an auditor who is conducting a financial or performance audit of the county department (county department audit) access to these records, including any personal identifying information necessary to achieve the purposes of the audit. The authorization applies to an auditor retained by a county or authorized pursuant to a county charter or ordinance. The bill prohibits an auditor from disclosing or releasing to any person or in an audit report any information, including personal identifying information, that is obtained pursuant to a county department audit and required to be kept confidential by law. A person who unlawfully releases this confidential information is subject to the applicable criminal penalty. Be it enacted by the General Assembly of the State of Colorado: SECTION 1. Legislative declaration. (1) The general assembly hereby finds and determines that: (a) The delivery of human and social services is a matter of state concern and a function that is administered by county departments as an arm of the state pursuant to state statutes; (b) The purposes of these county-administered programs include ensuring the protection, safety, and well-being of at-risk children and adults and promoting better outcomes for these individuals; (c) Despite these purposes, some counties are experiencing program deficiencies in the performance and delivery of these critical services, thereby failing at-risk individuals; (d) The general assembly is committed to improving the delivery of these services in order to ensure the safety and well-being of these individuals; (e) A performance or financial audit of a county department experiencing these adverse outcomes can be essential to addressing the causation of such systemic program weaknesses or deficiencies; (f) The general assembly recognizes that maintaining the confidentiality of highly sensitive and personal identifying information contained in the client records of county departments is critical to the privacy of the at-risk children, adults, and members of their families served by these programs; and (g) Auditors often have access to confidential information and allowing an auditor access to the confidential information held by county departments will serve to ensure that the audit report ultimately promotes improvements to, enhances the accountability of, and advances better outcomes for the children, adults, and families served by county-administered programs. (2) Therefore, the general assembly hereby declares that it is in the best interests of the at-risk individuals served by these programs for an auditor to have access to certain confidential information held by county departments in order to further the audit's examination of systemic deficiencies or failures, while ensuring that the information is not released, made available for public inspection, or made part of the audit report. SECTION 2. In Colorado Revised Statutes, add 26-1-114.5 as follows: 26-1-114.5. Records - access by county auditor. (1) Notwithstanding any provision of law to the contrary, a county department of human or social services shall provide to an auditor conducting a financial or performance audit of the county department access to all of the records, reports, papers, files, and communications of the county department, including any personal identifying information of individuals contained in the records, reports, papers, files, and communications necessary to achieve the stated audit objectives. (2) This section applies to an auditor retained by a county or authorized pursuant to a county charter or ordinance. (3) (a) Information required to be kept confidential or exempt from public disclosure pursuant to any other law or rule of the state department of human services or upon subpoena, search warrant, discovery proceedings, or otherwise, including personal identifying information, that is obtained by an auditor pursuant to subsection (1) of this section must not be: (I) Released, disclosed, or made available for inspection to any person by the auditor, the auditor's staff, or an audit oversight committee; or (II) Disclosed or contained in an audit report that is released for public inspection. (4) A person who releases information required to be kept confidential or exempt from public disclosure in violation of subsection (3) of this section is subject to the applicable criminal or civil penalty for the unlawful release of the information. (5) Nothing in this section shall be construed to supersede the authority of the state auditor pursuant to section 2-3-107 (2) (a), C.R.S. SECTION 3. In Colorado Revised Statutes, 19-1-307, amend (2) (o); and add (2) (o.5) as follows: 19-1-307. Dependency and neglect records and information - access - fee - rules - records and reports fund - misuse of information - penalty. (2) Records and reports - access to certain persons - agencies. Except as otherwise provided in section 19-1-303, only the following persons or agencies shall be given access to child abuse or neglect records and reports: (o) A person, agency, or organization engaged in a bona fide research or evaluation project, or audit, but without information identifying individuals named in a report, unless having said identifying information open for review is essential to the research and evaluation, in which case the executive director of the state department of human services shall give prior written approval and the child through a legal representative shall give permission to release the identifying information; (o.5) An auditor conducting a financial or performance audit of a county department of human or social services pursuant to section 26-1-114.5, C.R.S.; SECTION 4. In Colorado Revised Statutes, 26-1-114, amend (1) as follows: 26-1-114. Records confidential - authorization to obtain records of assets - release of location information to law enforcement agencies - outstanding felony arrest warrants. (1) The state department of human services may establish reasonable rules to provide safeguards restricting the use or disclosure of information concerning applicants, recipients, and former and potential recipients of federally aided public assistance and welfare, including but not limited to assistance payments, food stamps, social services, and child welfare services, to purposes directly connected with the administration of such public assistance and welfare and related state department activities and covering the custody, use, and preservation of the records, papers, files, and communications of the state and county departments. Whenever, under provisions of law, names and addresses of applicants for, recipients of, or former and potential recipients of public assistance and welfare are furnished to or held by another agency, or department of government, or an auditor conducting a financial or performance audit of a county department of human or social services pursuant to section 26-1-114.5, such the agency, or department, shall be or auditor is required to prevent the publication of lists thereof and their uses for purposes not directly connected with the administration of such public assistance and welfare. SECTION 5. In Colorado Revised Statutes, 26-3.1-102, amend (7) (b) (II) and (7) (b) (III); and add (7) (b) (IV) as follows: 26-3.1-102. Reporting requirements. (7) (b) Disclosure of a report of the mistreatment, self-neglect, or exploitation of an at-risk adult and information relating to an investigation of such a report shall be permitted only when authorized by a court for good cause. Such disclosure shall not be prohibited when: (II) There is a death of a suspected at-risk adult from mistreatment, self-neglect, or exploitation and a law enforcement agency files a formal charge or a grand jury issues an indictment in connection with the death; or (III) Such disclosure is necessary for the coordination of multiple agencies' investigation of a report or for the provision of protective services to an at-risk adult; or (IV) Such disclosure is necessary for purposes of an audit of a county department of human or social services pursuant to section 26-1-114.5, C.R.S. SECTION 6. Act subject to petition - effective date. This act takes effect at 12:01 a.m. on the day following the expiration of the ninety-day period after final adjournment of the general assembly (August 5, 2015, if adjournment sine die is on May 6, 2015); except that, if a referendum petition is filed pursuant to section 1 (3) of article V of the state constitution against this act or an item, section, or part of this act within such period, then the act, item, section, or part will not take effect unless approved by the people at the general election to be held in November 2016 and, in such case, will take effect on the date of the official declaration of the vote thereon by the governor.