R6-6-1405. Disclosure and Confidentiality

A. An Operator who installs, oversees, and monitors an Electronic Monitoring Device shall: 1. Comply with the HIPAA Privacy Rule, HIPAA Security Rule, A.R.S. § 36-568.01, and other applicable federal and state laws addressing confidentiality; 2. Allow access to an Electronic Monitoring Record only as permitted by the HIPAA Privacy Rule, HIPAA Security Rule, A.R.S. § 36-568.01, and other applicable federal and state laws addressing confidentiality; and 3. Specify in policy how an Electronic Monitoring Record, regardless of format, is secured to protect the confidentiality of each Resident, including: a. Identifying the Operator’s personnel who have access to the Electronic Monitoring Record allowed under the HIPAA Privacy Rule, HIPAA Security Rule, and other applicable federal and state laws addressing confidentiality; b. Listing the circumstances under which the Operator’s personnel are permitted access to the Electronic Monitoring Record; c. Addressing how the Operator will handle disclosures and privacy breaches; d. Describing how a Resident may access an Electronic Monitoring Record; and e. Any other information required by the HIPAA Privacy Rule, HIPAA Security Rule, or other applicable federal and state law. B. Release of an Electronic Monitoring Record 1. Upon request, an Operator shall release an Electronic Monitoring Record to the Division unless the Electronic Monitoring Record contains evidence of a suspected criminal offense or is otherwise prohibited by law. 2. Upon request, an Operator shall release an Electronic Monitoring Record of a Resident to the Resident’s Responsible Person unless the Electronic Monitoring Record contains evidence of a suspected criminal offense or is otherwise prohibited by law. 3. If an Electronic Monitoring Record does not contain evidence of a suspected criminal offense and is otherwise not prohibited by law, the Operator shall release the Electronic Monitoring Record to the Division or Responsible Person prior to or on the date stated in the request. 4. If an Electronic Monitoring Record contains images of more than one Resident, the Operator shall not release the Electronic Monitoring Record to the Resident’s Responsible Person unless: a. The images of the non-requesting Resident are de- identified; or b. The Operator receives a signed, informed consent for the release of the Electronic Monitoring Record from all other Residents’ Responsible Persons who appear in the Electronic Monitoring Record.