How to maintain confidentiality files for licensing compliance

Last updated 2026-07-09

What does confidentiality mean in daycare licensing?

Confidentiality in daycare licensing means you cannot share personally identifiable information about a child, family, or staff member without written authorization, except in narrow legally required situations like mandatory abuse reporting. It is more than a courtesy. It is a condition of your license.

Most state licensing regulations tie directly to the federal Child Care and Development Fund (CCDF) rule, which requires states to ensure the privacy and confidentiality of child care records as part of their Child Care Development Plans ^[1]. If your program accepts any subsidy dollars, CCDF confidentiality rules bind you at the federal level on top of your state rules.

State licensing standards take several forms. Some states (California, New York, Texas) write their own detailed confidentiality regulations into the licensing code. Others borrow HIPAA-adjacent standards for health records, FERPA-style protections for education records if the program is school-connected, or both. A few adopt the National Association for Regulatory Administration (NARA) model rules as a baseline.

The practical effect is the same everywhere. You need a written policy, locked storage, a list of who can access what, and a way to document every time a record leaves your hands.

Which records must be kept confidential?

The short answer is almost everything about a specific person. Inspectors routinely check five categories.

Child records. Enrollment applications, health histories, immunization records, medication authorizations, allergy alerts, developmental screenings, incident reports, and any special needs or IEP documentation. All of it is confidential.

Family records. Emergency contacts, custody orders, financial records including subsidy files, payment histories, and case notes from parent conversations about sensitive topics. Custody orders deserve special attention. If a court order restricts a parent's access, that document belongs in a locked file, and staff need to know it exists without necessarily seeing the whole record.

Staff records. Background check results, health clearances (TB tests, immunization documentation required in many states), performance reviews, disciplinary records, and personnel files. Even the fact that someone was terminated is protected. Background check results from the FBI or state criminal history databases carry their own statutory confidentiality requirements under 28 CFR Part 20 ^[2].

Subsidy and financial records. CCDF regulations require that subsidy recipient information be kept confidential and used only for program purposes ^[1]. Mixing subsidy files with general business records is a common citation.

Incident and injury reports. These feel administrative, but they hold medical information about specific children. They are confidential. You can share aggregate data ("we had three falls this quarter") but not individual incident reports without parent consent or a legal mandate.

One thing operators miss: photographs and video of children are covered too. If you post a photo to a private parent app, any parent whose child appears in that photo needs to have signed a photo release. Inspectors in several states now ask to see your photo policy and release forms as a standard part of licensing renewal.

What physical and digital storage standards do inspectors expect?

Physical storage standards vary by state but share one framework: records with personally identifiable information go in "locked storage." In practice that means a locking file cabinet, a locking drawer, or a locked room. A cabinet you can open by pulling up on the drawer does not pass inspection in any state I am aware of.

Inspectors will actually try the lock. Plan accordingly.

For digital records, the standards are less uniform because most state licensing codes were written before cloud software was common. States increasingly reference "secure" or "password-protected" systems in their updated regulations, and California's Community Care Licensing Division expects electronic records to have access controls equal to locked physical storage ^[3].

Here is a checklist most programs can apply regardless of state:

• Locking metal file cabinets for paper records (one key per authorized staff member, keys logged)
• Separate locked section or drawer for staff files versus child files
• Password-protected software with unique logins per user, not shared passwords
• Automatic screen lock on any computer used to access records
• Written policy on who can access records from personal devices
• Shredding protocol for documents you are disposing of

Cloud-based childcare management software (Procare, Brightwheel, HiMama, and others) can meet the security standard if you configure access controls correctly. The software does not do it automatically. You have to set which staff roles can see which records and audit the access logs periodically. Failing to configure role-based access is the most common digital storage error inspectors are starting to flag.

For home daycares, the challenge is that your records may sit on a shared family computer or in a filing area open to household members. Some states address this directly. Washington State's family home child care rules (WAC 110-300) require records to be stored where unauthorized household members cannot reach them ^[4]. Check your state's specific language.

How do you get proper consent before sharing records?

Written consent is the rule. Verbal consent is not enough for licensing purposes in any state I know of, though it might hold in some narrow common-law contexts. Do not rely on it.

A solid release form names the child or employee whose record is being shared, the specific information being released ("immunization records," not "health records"), the person or organization receiving it, the purpose, an expiration date or a statement that consent can be revoked, and the signature and date of the authorized person.

Parents or legal guardians sign for child records. Employees sign for their own personnel records. A parent cannot authorize release of another family's records, and staff cannot authorize release of records about other staff.

Some releases are mandatory and need no consent. You must report suspected abuse or neglect to child protective services regardless of parent consent. You may be required to share records in response to a court order or a licensing agency investigation. The Child Abuse Prevention and Treatment Act (CAPTA) protects mandatory reporters from liability when they report in good faith ^[5]. Put both exceptions in your written confidentiality policy so parents understand them from day one.

For subsidy programs, CCDF rules require you to explain to families what information will be shared with the Lead Agency and why. That explanation happens before enrollment, not after ^[1].

One real-world headache: divorcing or separated parents. If you have no custody order and both parents are listed on the enrollment form, both have equal rights to the child's records in most states. If one parent tells you to stop sharing records with the other, you need a court order before you honor that request. Document every request and your response.

How long do you have to keep childcare records?

Retention rules vary enough by state and record type that a table is the clearest way to lay it out.

Record Type	Typical Retention Range	Notes
Child enrollment files	3 to 7 years after last date of care	Many states specify 3 years; some (e.g., California) require 5 years [3]
Immunization records	Duration of enrollment + 3 years	May run longer under state health record rules
Incident/injury reports	3 to 7 years	Longer if injury was serious; check your state
Staff personnel files	3 to 7 years after termination	Background check records often have separate requirements
Payroll and financial records	3 to 7 years (IRS business record guidance applies) [6]	CCDF subsidy records often require 7 years [1]
Medication authorization forms	Duration of enrollment + 3 years	Controlled substances may require longer
Sign-in/sign-out logs	2 to 3 years	Used to verify attendance for subsidy audits

The IRS recommends keeping employment tax records for at least four years after the tax is due or paid ^[6], which sets a floor for payroll-adjacent staff records even where your state requires less.

For CCDF subsidy records, the federal regulation at 45 CFR 98.67 sets a three-year minimum, but many state CCDF plans extend that to five or seven years to line up with audit cycles ^[1]. If you have ever been audited or had a dispute over subsidy payments, keep those records longer.

The safest practical rule: keep everything seven years unless a specific federal or state rule requires longer. Set a calendar reminder each January to purge files that have aged out. Shred paper. Delete digital records or move them to an encrypted archive with a set destruction date.

ChildCareComp's compliance toolkit includes a state-by-state retention reference table if you want your state's exact numbers rather than the broad ranges above.

What should your written confidentiality policy include?

A written confidentiality policy is required by name in most state licensing standards and implied by the rest. Inspectors will ask for it. Here is what a complete policy covers.

Scope. What records are covered. List every category: child records, family records, staff records, financial records, photos and video.

Access. Who is authorized to see each record type and under what circumstances. Be specific. "Director and lead teacher" beats "authorized staff."

Storage. Where records are kept, what type of lock or security is required, and who holds keys or access credentials.

Sharing. The written consent requirement, the process for completing a release form, and the list of mandatory sharing exceptions (abuse reporting, court orders, licensing investigations).

Breach response. What happens if records are lost, stolen, or shared without authorization. Who gets notified, in what timeframe, and how the incident is documented.

Retention and destruction. How long records are kept and how they are destroyed.

Staff training. How and when staff are trained on the policy, and how that training is documented.

Date and sign the policy. Update it when your state licensing rules change or when you swap software systems. Keep a copy in your licensing binder and have every employee sign a receipt confirming they read it.

Child Care Aware of America tracks state licensing and inspection data through its research program, and records management shows up repeatedly as a citation category ^[7]. Programs with a documented policy on file tend to draw fewer records-related citations than those running on informal habits. The causal direction is obvious (programs with a documentation culture do better across the board), but the pattern holds.

How do you train staff on confidentiality requirements?

Training is where the policy becomes real. A policy in a binder that no one has read protects no one.

Cover confidentiality in new hire orientation before the employee touches any records. Cover it again at annual training. And run a specific refresher any time you update your systems, change your software, or have an incident.

The training should cover what records are confidential and why, how to handle a parent or outside party asking about another family, what to do if someone asks an employee to share records outside normal channels (including social media), how to respond to a suspected breach, and the mandatory reporting exception.

Document every session. Keep a sign-in sheet or a digital completion record. Inspectors in many states now ask for proof of staff confidentiality training, more than proof that a policy exists. The National Association for the Education of Young Children (NAEYC) accreditation standards, which track closely with best-practice licensing expectations, call for documented confidentiality training for program staff ^[8].

For home daycares where you are the only employee, you still document your own training. A dated note in your licensing binder that reads "reviewed confidentiality policy, updated staff records procedure" counts. It sounds self-serving, but licensing inspectors understand the paperwork reality of solo operators and want evidence of intentional practice, not a formal classroom setup.

One area worth extra attention: social media. Staff posting about their workday, even without naming children, can cross the line. "Had such a rough day, one family just won't follow the schedule" identifies the child to anyone who knows the program. Make your social media expectations explicit in the policy and in training.

What do licensing inspectors actually check during a confidentiality review?

Inspectors do not read every file. They check systems and spot-test records. Here is what a typical confidentiality review looks like in practice.

The inspector asks for your written confidentiality policy. If you cannot produce it quickly, that alone may generate a citation in states that require it on file.

They look at physical file storage. Is the cabinet locked? Are staff files and child files in separate sections? Are any records left out in the open? Front-desk areas where admission forms sit in an unlocked inbox are a common citation source.

They may pull a sample child file and check for a signed enrollment agreement with a confidentiality notice, a signed photo release if you post photos anywhere, and current emergency contact and health forms.

For subsidy programs, they verify that CCDF subsidy records are stored separately from general child files and that only authorized staff have access.

They may ask staff directly what the confidentiality policy requires, especially on mandatory reporting. If a teacher cannot state the basics, inspectors treat that as a training deficiency.

NARA's model child care licensing work and licensing workforce research point to records management and confidentiality as recurring deficiency areas in center-based inspections, though exact percentages vary by state ^[9]. This is not an area inspectors gloss over.

One thing operators underestimate: inspectors compare enrollment records against attendance. Attendance for a child with no enrollment file, or an enrollment file for a child gone for years with no archived record, both raise questions.

The daycare center and home daycare licensing processes both require confidentiality documentation, but the specific forms and storage standards differ. Home-based programs often have more flexibility in where records live and an equal obligation to protect them.

What are the consequences of a confidentiality violation?

Consequences scale with severity and pattern. A first-time minor violation (unlocked filing cabinet, missing photo release for an older enrollment) usually draws a corrective action plan, not an immediate license sanction. You get a timeframe to fix it and document the fix.

Repeated minor violations stack. A licensing agency that sees the same confidentiality deficiency across two or three consecutive inspections will escalate. That can mean a conditional license, a fine, or a requirement for extra monitoring visits.

Serious violations, meaning you actually shared a child's records without consent, disclosed a family's subsidy status, or mishandled staff background check results, can bring license suspension, revocation proceedings, or referral to the state attorney general in states with specific child privacy statutes.

For CCDF-funded programs, a breach involving subsidy data can trigger a federal finding. The Lead Agency monitors for compliance with 45 CFR 98.67, and a finding can result in repayment demands or termination of the provider agreement ^[1].

Civil liability is real too. A parent whose custody information was shared with a non-custodial parent (enabling that parent to locate the child) has grounds for a lawsuit. Courts have found daycares liable in these situations. The dollar exposure depends on jurisdiction and harm, but it can far exceed any licensing fine.

The practical advice: treat a corrective action plan as a gift. You found the gap before something serious happened. Fix it thoroughly, document the fix, and use the incident to retrain staff.

Are there special confidentiality rules for children with disabilities or health conditions?

Yes, and they layer on top of basic licensing requirements.

Children served under an Individualized Family Service Plan (IFSP) or Individualized Education Program (IEP) through Part B or Part C of IDEA (Individuals with Disabilities Education Act) have FERPA protections attached to those education records ^[10]. FERPA gives parents the right to inspect, amend, and control disclosure of those records. If a child's IEP or evaluation report sits in your files, it carries its own protection requirements beyond standard licensing rules.

Children with chronic health conditions (diabetes, severe allergies, epilepsy) often have care plans full of detailed medical information. That information is protected. You can share it with direct care staff who need it to keep the child safe. You cannot post it on a general staff bulletin board or leave it in an unsecured spot.

Medication authorization forms for prescription medication are health records. In states that require documentation of medication administration, the administration log is also a health record. Both need locked storage and limited access.

HIPAA applies directly to covered health care entities. Most childcare programs are not covered entities, so you are not legally required to follow HIPAA's Privacy Rule. Many programs follow HIPAA standards voluntarily anyway because they line up with best practice and give a defensible standard if a breach ever leads to litigation.

For infant daycare programs especially, health records are dense and frequent. Infants have feeding logs, sleep logs, diaper logs, and constant health updates. Build your filing system for infants before you enroll your first infant, not after.

How do you handle a confidentiality breach if one occurs?

A breach happens when records are shared without authorization, lost, stolen, or accessed by someone who should not have seen them. Your response matters as much as the incident itself, from both a legal and a licensing standpoint.

Step one: document what happened immediately. Date, time, what records were involved, who accessed or received them, and how you found out. Do this before making any calls.

Step two: notify the affected family or employee, depending on whose records were involved. Do it quickly. Most states set no breach notification timeline for non-HIPAA childcare programs, but 24 to 72 hours is a reasonable standard and shows good faith. Explain what happened, what records were involved, and what you are doing to prevent a repeat.

Step three: notify your licensing agency if your state's rules require breach notification. Several states do. Check your state's specific code. Texas, for example, expects notification to HHSC Child Care Regulation for significant records violations ^[11].

Step four: if the breach involved digital records or a cyberattack, call your liability insurance carrier. Many commercial childcare policies include cyber coverage or at least a cyber incident hotline.

Step five: fix the root cause and document the fix. If a substitute teacher reached a record she should not have, explain how access controls failed and what you changed. If a file was left on a copier, write the new procedure. The corrective action documentation goes in your licensing binder and in the incident record.

One honest note: small programs often have informal breaches they never recognize as breaches. A teacher mentioning a child's medication to another parent at pickup is a breach. Texting a child's full name and emergency contact to a volunteer is a breach. Training staff on what actually counts as a breach matters as much as training them on locked storage.

How do CCDF and federal rules interact with state licensing confidentiality requirements?

The federal CCDF rule at 45 CFR 98.67 requires Lead Agencies (your state's administering agency, usually DCFS, DHHS, or equivalent) to ensure that records and information pertaining to children in care are treated as confidential ^[1]. The regulation limits use to program purposes and access to authorized personnel.

This federal floor does not preempt state rules. Your state can and often does require more. The result is that you comply with both. In practice, CCDF-funded programs have to be extra careful about subsidy records because those records are subject to audit by both the state and the federal Administration for Children and Families (ACF).

ACF publishes guidance on CCDF monitoring, and confidentiality of beneficiary records is a standard monitoring item. ACF Program Instruction CCDF-ACF-PI-2016-01 spells out the fiscal and data integrity requirements providers must meet to take part in subsidy programs ^[12].

For most operators the practical implication is this: keep subsidy files in their own locked section, separate from general enrollment files. Document every time a subsidy record is accessed or shared. Keep a log of which staff have access to subsidy records and why. When the state audits your subsidy claims, they look at whether your recordkeeping could have allowed improper billing or unauthorized disclosure.

A compliance tool like ChildCareComp that keeps your federal and state obligations visible in one place helps you avoid the trap where you meet state licensing rules but miss a CCDF overlay, or the reverse.

What is a practical file organization system for staying compliant year-round?

The goal is a system an inspector can walk through in 10 minutes and find everything, and one you can actually maintain during a busy program day.

Here is one structure that works for centers and home daycares alike.

Active child files (locked cabinet, drawer 1). One folder per enrolled child, labeled with the last name. Contents: enrollment application, emergency contact form, immunization record, signed confidentiality/release notice, photo release, allergy and medication forms, any custody orders or care plan documents. Arrange alphabetically.

Inactive child files (locked cabinet, drawer 2 or a separate archive box). Children who have disenrolled. Same folder structure, labeled with last name and exit date. Keep for the required retention period, then shred.

Staff files (separate locked cabinet or locked drawer). One folder per employee. Contents: application, references, background check clearance, health clearances, training records, signed confidentiality policy receipt, performance reviews, and disciplinary records if any. Lock these apart from child files because access permissions differ.

Incident/injury log binder (locked). Chronological log of all incidents, with individual report forms filed behind the log. Some programs keep these in the child's folder instead. Either works. Pick one and stick to it.

Subsidy records (locked, separate section). If you accept CCDF or other subsidy dollars, keep those records in their own labeled section. Attendance records that support subsidy billing live here.

Policies binder (staff-accessible, non-confidential). Your written confidentiality policy, breach response procedure, records retention schedule, and signed staff acknowledgment forms.

For digital records, mirror this structure in your software's folder system. Use role permissions to restrict subsidy records to director-level access only.

Review the whole system at your annual license renewal. Pull one file at random and ask whether an inspector would find everything expected. If the answer is no, fix it before they arrive.

Programs that want a structured way to run this annual review can start with the daycares licensing basics resource for the broader compliance picture.

Frequently asked questions

Do home daycares have to follow the same confidentiality rules as centers?

Yes. Home daycare licensing regulations in every state that licenses home-based programs require confidentiality protection for child and family records. The storage methods may differ (a locking file box instead of a full cabinet) but the obligations match. If you accept CCDF subsidies, federal rules apply regardless of program type.

Can parents see their own child's file?

Yes, in virtually every state. Parents and legal guardians have a right to inspect records about their own child. Programs must provide access within a reasonable time, usually 24 to 48 hours of a request. A parent cannot see another family's records, and a non-custodial parent with a court order restricting contact may have limited access. Document every inspection request.

What happens if a licensing inspector asks to see a child's record during an inspection?

Inspectors are authorized by statute to review records as part of their regulatory function. You do not need parent consent to show a child's record to a licensing inspector conducting an official inspection. Document the visit, what records were reviewed, and by whom. This falls under the mandatory sharing exception in your confidentiality policy.

Are background check results confidential even from the parents of children in care?

Yes. Background check results from FBI or state criminal history databases are legally protected under 28 CFR Part 20 and equivalent state laws. You cannot share the contents of a background check with parents. You can confirm that staff meet your program's clearance requirements, but the underlying record is off-limits.

How do I handle confidentiality when using a childcare management app?

Choose an app with role-based access controls, unique user logins, and data encryption at rest and in transit. Disable access for former employees the moment they leave. Read the app's data privacy policy to see who else can access your data. Document your access control configuration in your written confidentiality policy. Review access logs quarterly.

Can I share information about a child with their pediatrician without parent consent?

Generally no, not without written consent, unless there is a health emergency. In an emergency you can share necessary information with emergency responders or treating physicians. For routine communication with a child's doctor, such as sharing a health history or developmental notes, you need a signed release naming the specific provider.

What do I do if a parent asks about another family enrolled in my program?

Decline politely and consistently. You cannot confirm or deny enrollment status for other families, share contact information, or discuss anything about another child. A simple script works: 'I'm not able to share information about other families in our program.' Document the request. If it feels concerning (a custody dispute, for example), contact your licensing agency for guidance.

How long do I have to keep incident reports after a child leaves my program?

Most states require three to seven years after the last date of care. Serious injury reports often require longer retention. For CCDF-funded programs, subsidy-related attendance and incident records linked to billing must be kept at least three years per federal regulation, and many states extend that to five to seven years for audit purposes. Check your state's specific licensing code.

Does posting photos of children on a private parent communication app require a release?

Yes. Any photograph identifying a specific child requires prior written consent from that child's parent or guardian, even on a private app open only to enrolled families. Other children may appear in the same photo. Get individual releases at enrollment, name the platforms covered, and update releases if you change platforms.

What is the difference between mandatory reporting and confidentiality?

Mandatory reporting is a legal exception to confidentiality. When you have reasonable suspicion of child abuse or neglect, you are required by law to report it to child protective services, and no parental consent is needed or permitted. CAPTA protects reporters acting in good faith from liability. Your confidentiality policy should name mandatory reporting as an exception so families understand it from the start.

Can I email child records to parents?

You can, but standard email is not secure. If a parent requests records by email, use a password-protected attachment or a secure file-sharing service. Some states require encryption for electronic sharing of health or financial records. Document the request, what you sent, and how you sent it. Never email records to an unverified address.

What should I do if a staff member quits and took copies of child records?

Treat it as a breach. Document what records were taken and when you found out. Notify affected families. File a report with your licensing agency if your state requires breach notification. Consult an attorney about whether the former employee violated state privacy law. Update your procedures to prevent unauthorized copying, including restricting printing access and logging file downloads in your software.

Are there confidentiality requirements specific to infants and toddlers?

No separate federal statute targets infant and toddler records specifically, but infant care generates unusually dense health documentation (feeding logs, sleep logs, medical updates) that all qualifies as confidential health information. Infant programs often carry the highest volume of records per child. Build your filing and retention system to handle that volume before you open, not after.

Do I need to notify families about my confidentiality policy before enrollment?

Yes, in most states, and it is best practice everywhere. The notification should explain what records you keep, how they are stored, who can access them, when you may share them without consent (mandatory reporting, licensing inspection, court order), and how to request access to their own child's records. Get a signed acknowledgment at enrollment and keep it in the child's file.

Sources

1. U.S. Department of Health and Human Services, Administration for Children and Families — Office of Child Care, CCDF policy and guidance: CCDF regulations at 45 CFR 98.67 require Lead Agencies to ensure confidentiality of child care records and limit use to program purposes; subsidy records retention minimum three years
2. U.S. Code of Federal Regulations — 28 CFR Part 20, Criminal Justice Information Systems: Background check results from criminal history databases carry statutory confidentiality protections and cannot be disclosed to unauthorized parties
3. California Department of Social Services — Community Care Licensing Division (Title 22 child care center regulations): California requires five-year retention for child records after last date of care and equivalent access controls for electronic and physical records
4. U.S. Department of Health and Human Services, Children's Bureau — Child Abuse Prevention and Treatment Act (CAPTA): CAPTA protects mandatory reporters from civil and criminal liability when reports of suspected abuse or neglect are made in good faith
5. Internal Revenue Service — How long should I keep records?: IRS recommends keeping employment tax records for at least four years after the date the tax is due or paid
6. Child Care Aware of America — research and state data: State licensing and inspection data tracked by Child Care Aware of America show records management among recurring citation categories for licensed childcare programs
7. National Association for the Education of Young Children (NAEYC) — Early Learning Program Accreditation standards: NAEYC accreditation standards require documented confidentiality training for program staff
8. National Association for Regulatory Administration (NARA) — model child care licensing requirements and licensing workforce research: Records management and confidentiality are among the top recurring deficiency areas in center-based care inspections nationally
9. U.S. Department of Education — Family Educational Rights and Privacy Act (FERPA): FERPA gives parents rights to inspect, amend, and control disclosure of education records including IEPs and IFSP documents attached to children in care
10. Texas Health and Human Services Commission — Child Care Regulation: Texas expects notification to HHSC Child Care Regulation for significant records violations at licensed childcare programs
11. Administration for Children and Families — Office of Child Care, CCDF Program Instruction CCDF-ACF-PI-2016-01 (fiscal and data integrity requirements): ACF Program Instruction specifies fiscal and data integrity requirements including confidentiality of beneficiary records for CCDF-participating providers