1. (a) The information contained in the resident records is confidential and is not to be released without legal authorization or subpoena.
2. (b) The records will be available to the Office of Long-Term Care or its contractor.

3. (c)

   1. (1) The psychiatric residential treatment facility shall ensure the confidentiality and security of resident records, including information in a computerized medical record system, in accordance with the Health Insurance Portability and Accountability Act of 1996 privacy regulations and any Arkansas state laws and regulations which provide a more stringent standard of confidentiality than the Health Insurance Portability and Accountability Act of 1996 privacy regulations.
   2. (2) Information from, or copies of, records may be released only to authorized individuals, and the psychiatric residential treatment facility shall ensure that unauthorized individuals cannot gain access to or alter resident records.
   3. (3) Original medical records shall not be released outside the psychiatric residential treatment facility unless under court order or subpoena or in order to safeguard the record in the event of a physical plant emergency or natural disaster.

4. (d)

   1. (1) The provider shall have written procedures for the maintenance and security of records specifying who shall supervise the maintenance of records, who shall have custody of records, and to whom records may be released.
   2. (2) Records shall be the property of the provider, and the provider as custodian shall secure records against loss, tampering, or unauthorized use.
5. (e) Employees of the psychiatric residential treatment facility shall not disclose, or knowingly permit the disclosure of, any information concerning the resident or his or her family, directly or indirectly, to any unauthorized person.
6. (f) When the resident is of majority age and noninterdicted, the provider shall obtain the resident’s written, informed permission prior to releasing any information from which the resident or his or her family might be identified, except for accreditation teams and authorized state and federal agencies.
7. (g) The provider shall, upon written authorization from the resident or his or her parent or legal guardian, make available information in the case record to the resident, his or her counsel, or the resident’s parent or legal guardian.

Codification Notes: The Health Insurance Portability and Accountability Act of 1996 is Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of 18 U.S.C., 26 U.S.C., 29 U.S.C., and 42 U.S.C.).