R 567.11 Confidentiality.

Rule 11. (1) The auditor shall ensure that all nonpublic records obtained from the state and the person subject to examination are confidential records. (2) Auditors shall not disclose confidential information obtained during the audit to any person other than to the administrator or his or her designee and, in the case of a multistate examination, to authorized representatives of a state participating in the examination but only to the extent such confidential information relates to property that may be subject to reporting in such state. (3) Auditors shall not use confidential information obtained from the person subject to an examination for any purpose other than for purposes of the examination. Auditors shall take all reasonable steps to ensure that the confidential information provided by the person subject to an examination is securely maintained. (4) An auditor and a person subject to examination may enter into a mutually agreeable nondisclosure agreement. However, if the person and the auditor are unable to enter into a mutually agreeable nondisclosure agreement within 30 calendar days from the date the agreement was first presented by the auditor to the person subject to the examination, then the examination shall commence without an agreement in place subject to subrules (1) to (3) of this rule. (5) The auditor must promptly cure any deficiencies and comply with any applicable federal and state laws and regulations pertaining to unauthorized disclosures. The administrator and the auditor will cooperate to mitigate, to the extent practicable, the effects of any breach, intrusion, or unauthorized use or disclosure. The auditor must report to the administrator in writing any use or disclosure of confidential information, whether suspected or actual, other than as required by the contract within 10 days of becoming aware of the use or disclosure or the shorter time period as is reasonable under the circumstances.