Confidentiality

Confidentiality A. Personnel must maintain the confidentiality rights of people they serve at all times across situations and locations, such as in waiting areas to which the public has access, while speaking on the telephone, or in conversing with colleagues. B. The agency provider must have written policies and procedures and related documentation pertaining to the compilation, storage, and dissemination of people’s records that assures a person’s right to privacy and maintains the confidentiality of people’s records and information. C. Compilation, storage, and dissemination of people’s records, including related documentation, must be in accordance with these policies and procedures, which at a minimum must include: 1. Designated person(s) to distribute people’s records to employees. 2. Specific procedures to assure that people’s records are secure in all locations. 3. Procedures to limit access to people’s records to only those who have been determined to have specific need for the person’s record, including documentation listing those people. 4. Procedures for release and disclosure of Protected Health Information and other types of information that are in accordance with all applicable state and federal laws, including, but not limited to the Health Insurance Portability and Accountability Act (HIPAA). 5. Procedures requiring documented consent of the person receiving services or legal representative(s), when appropriate, prior to disclosing or releasing information (including to any third-party payer). 6. Procedures addressing the release of information regarding people receiving Substance Use Services, in accordance with applicable federal regulations. D. Records containing any information pertaining to people receiving services must be kept in a secure room or in a locked file cabinet or other similar container when not in use. E. All paper records must be marked "confidential" or bear a similar cautionary statement; all electronic health records or digital filing must be privacy protected and contain a statement of confidentiality or similar cautionary statement.