How should youth and social service programs protect client records?

A youth mentoring program, a foster family agency and a community counseling center often hold the same mix of records: names and birthdates of minors, school and court information, family income, case notes, and sometimes health or substance use details. Each category can carry its own client confidentiality rule, and one exposed file can raise several of them at once. This guide maps the rules that most often reach California programs and the controls that keep client records protected.

Which rules cover client records in youth and social service programs?

Usually more than one, depending on the program's funding, its services and where each record came from. The common layers are the federal Uniform Guidance for any federal award, California's reasonable security and breach notice statutes, confidentiality rules for juvenile case files and county social services records, and HIPAA or 42 CFR Part 2 for programs that deliver health or substance use services.

A single client file can touch all of them. A case plan for a teenager in a federally funded diversion program might hold a Social Security number (an element of California's breach law), school and medical records (protected PII under the Uniform Guidance), information drawn from a juvenile case file (governed by Welfare and Institutions Code section 827), and a substance use screening (possibly covered by Part 2). Agencies that manage this well keep an inventory of which records carry which rule, and protect a mixed file to the standard of the strictest rule that touches it.

What does a federal grant require for client data security?

Since the 2024 revision, the Uniform Guidance requires recipients and subrecipients to take reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information, under 2 CFR 200.303(e). The revision was published April 22, 2024 and applies to federal awards made on or after October 1, 2024, including federal money that reaches an agency as a subaward through a county or state.

The definition of protected PII in 2 CFR 200.1 reads like a youth program intake form: a person's name combined with identifiers such as a Social Security number, date and place of birth, or criminal, medical, financial or educational records. Section 200.303(e) also reaches information the awarding agency or pass-through entity designates as sensitive, and information the recipient itself considers sensitive, consistent with applicable privacy and confidentiality laws.

The rule names no specific technology. It sits inside the internal controls section of the Uniform Guidance, so the practical test is whether the agency can describe its measures and show they operate. Funders increasingly ask the same thing on applications; our guide to grant application cybersecurity questions covers how to answer them accurately.

What does California law require of a nonprofit holding client data?

California's customer records statutes apply to nonprofits. Civil Code section 1798.80(a) defines a business as any group "whether or not organized to operate at a profit," and section 1798.81.5 requires a business that owns, licenses or maintains personal information about a California resident to maintain reasonable security procedures and practices appropriate to the nature of the information. It must also require by contract that nonaffiliated third parties receiving that information do the same.

The statute does not define reasonable security. In its 2016 Data Breach Report, the California Attorney General pointed to the CIS Critical Security Controls as the starting point and said failing to implement the applicable controls would indicate a failure to provide reasonable security. The report is guidance rather than regulation. Section 1798.81.5 does not apply to HIPAA covered entities or providers regulated by the Confidentiality of Medical Information Act, whose own laws govern instead.

When computerized personal information is breached, section 1798.82 requires notice to affected California residents within 30 calendar days of discovery, a deadline added by SB 446 that took effect January 1, 2026. Personal information for this purpose includes a name combined with a Social Security number, a government ID number, medical information or health insurance information, all common in youth and family case files. A program that maintains records it does not own, such as files held for a county, must notify the owner immediately following discovery. When retention ends, section 1798.81 requires reasonable steps to dispose of records by shredding, erasing or otherwise making them unreadable. For response steps, see how to respond when client data is exposed.

Are juvenile case files and county records held to a stricter standard?

Yes. Juvenile case files may be obtained, inspected or disclosed only as Welfare and Institutions Code section 827 allows, and anyone not authorized by that section must petition the juvenile court under California Rules of Court, rule 5.552. Rule 5.551 defines the file broadly: court filings, probation and child welfare reports, records gathered to prepare those reports, transcripts, and admitted photographs and digital images.

Separately, Welfare and Institutions Code section 10850 makes applications and records about individuals in public social services programs confidential, limits their use to purposes directly connected with administering the program, and makes knowing and intentional unauthorized disclosure a misdemeanor. When a county shares these records with a contracted agency, the contract sets how the agency may use and protect them, so read the two together.

For technology, the point is containment. These records belong in a defined system with named access, and never in personal email, drives open to all staff, or consumer AI tools. Our article on keeping case notes out of AI tools covers that last risk in detail.

When do substance use disorder records fall under 42 CFR Part 2?

42 CFR Part 2 protects records of federally assisted programs that provide substance use disorder diagnosis, treatment or referral for treatment. Whether a particular screening, counseling or referral service makes an agency a Part 2 program turns on the regulation's definitions; it is one of the decisions listed in the counsel review section below.

For programs that are covered, the 2024 final rule changed the security stakes. According to HHS's fact sheet, it applies the HIPAA Breach Notification Rule's requirements to breaches of Part 2 records, replaces Part 2's old criminal penalties with the civil and criminal enforcement authorities that apply to HIPAA, and required compliance by February 16, 2026. Part 2 records still cannot be used in legal proceedings against the patient without specific consent or a court order, which matters for youth who are also in the justice system. Programs that are HIPAA covered entities carry the HIPAA Security Rule as well; see how nonprofit health programs handle PHI.

What controls protect client records in practice?

The core controls are ordinary and inexpensive, and most map to the first implementation group of the CIS Controls:

• One named account per person, with multifactor authentication on email, the case management system and file storage. No shared logins, including for volunteers and interns.
• Role-based access, so case files are visible only to staff assigned to that client or program, with juvenile, county and substance use records in a restricted area.
• Same-day removal of access when staff, interns or volunteers leave, plus a monthly review of who can still open client files. Our volunteer offboarding guide walks through it.
• Managed, encrypted laptops and phones for anyone who opens client files, with the ability to lock and wipe a lost device.
• Data loss prevention rules that flag Social Security numbers and case numbers leaving by email, upload or AI prompt.
• A written retention schedule that follows funder and contract terms, with secure disposal when records age out. See our document retention guide.
• Backups tested by actually restoring them, and an incident response plan that names who calls the county, the funder, affected families and counsel.

What should a program director do this quarter?

Start with an inventory, then fix access. Each step below produces evidence a funder, county monitor or auditor can review.

1. List every place client records live: the case management system, shared drives, email, paper files, and any AI or note-taking tool staff have adopted.
2. Tag each record set by the rule that governs it: federal award, county contract, juvenile case file, HIPAA or Part 2.
3. Pull the confidentiality, security and breach notice clauses from each county contract and federal award, and note any deadline shorter than California's 30 days.
4. Turn on multifactor authentication everywhere client data lives and retire shared accounts.
5. Run an access review and remove anyone who no longer needs a file.
6. Update the incident response plan with the notice deadlines you found, and brief the board on the results in plain terms.

What should your counsel review for your program?

Schedule this review before you sign or renew a county contract or federal subaward, and before you add any health or substance use service. Each decision below depends on your own contracts, services and records, so bring the documents listed.

• Whether your screening, counseling or referral services make the agency a Part 2 program under 42 CFR 2.11 and 2.12. Bring service descriptions, funding sources and intake or screening forms.
• Whether a health program is a HIPAA covered entity under 45 CFR 160.103. Bring a description of how the program bills, including any health plan or clearinghouse arrangements.
• Who may receive information drawn from a juvenile case file under Welfare and Institutions Code section 827 and rule 5.552. Bring court orders, county contract data sharing clauses and partner agreements.
• Which breach notice deadline controls after an incident, comparing Civil Code section 1798.82 with your contract terms. Bring each county contract, federal award terms and your incident response plan.

How can s90 help?

s90 manages IT for nonprofits and social service agencies in Los Angeles and Orange County, with compliance built into the service. We map client records to the rules that govern them, put identity, device and data controls in place, and keep the evidence funders and county monitors ask for. Our agreements commit to notifying you of a breach within 72 hours and producing requested evidence within 24 hours. If you want a second look at how your program protects client files, we are glad to talk.