(a) The agency must have criteria that govern the types of information about applicants and beneficiaries that are safeguarded.

(b) This information must include at least—

(1) Names and addresses;

(2) Medical services provided;

(3) Social and economic conditions or circumstances;

(4) Agency evaluation of personal information;

(5) Medical data, including diagnosis and past history of disease or disability; and

(6) Any information received for verifying income eligibility and amount of medical assistance payments (see §435.940 through §435.965 of this subchapter). Income information received from SSA or the Internal Revenue Service must be safeguarded according to the requirements of the agency that furnished the data, including section 6103 of the Internal Revenue Code, as applicable.

(7) Any information received in connection with the identification of legally liable third party resources under §433.138 of this chapter.

(8) Social Security Numbers.

[44 FR 17934, Mar. 29, 1979, as amended at 51 FR 7210, Feb. 28, 1986; 52 FR 5975, Feb. 27, 1987; 77 FR 17203, Mar. 23, 2012]