1. (a) There are written policies and procedures for the protection of client's privacy with regard to program visitors which require:

   1. (1) The clients are informed in advance of scheduled visitations; and
   2. (2) Visitations are conducted when they will minimally interrupt the client's usual activities and therapeutic programs.

2. (b)

   1. (1) A client's authorization shall be obtained before releasing information.

   2. (2) A proper consent form must be in writing and contain the following items:

      1. (A) The name or general designation of the program or programs making the disclosure;
      2. (B) The name of the individual or organization that will receive the disclosure;
      3. (C) The name of the client who is the subject of the disclosure;
      4. (D) The purpose or need for the disclosure;
      5. (E) A description of how much and what kind of information will be disclosed;
      6. (F) The client’s right to revoke the consent in writing, and the exceptions to the right to revoke or, if the exceptions are included in the program’s notice, a reference to the notice;
      7. (G) The program’s ability to condition treatment, payment, enrollment, or eligibility of benefits on the client agreeing to sign the consent, by stating either that the program may not condition these services on the client signing the consent, or the consequences for the client refusing to sign the consent;
      8. (H) The date, event, or condition upon which the consent expires if not previously revoked;
      9. (I) The signature of the client, and/or other authorized person; and
      10. (J) The date on which the consent is signed.

3. (c) The program has written procedures for responding to requests for confidential client information:

   1. (1) When presented with:

      1. (A) Telephone inquiries;
      2. (B) Written inquiries;
      3. (C) Subpoenas;
      4. (D) Court orders;
      5. (E) Search warrants; and
      6. (F) Arrest warrants; and
   2. (2) For reporting child abuse.
4. (d) Every authorization for release of information becomes part of the client’s permanent case record and, according to the Health Insurance Portability and Accountability Act of 1996, programs must provide the client with copies of all signed authorizations.
5. (e) In a life-threatening situation or where an individual's condition or situation precludes the possibility of obtaining written consent, the program does allow for the release of pertinent medical information to the medical personnel responsible for the individual's care without a client or applicant's authorization, and without the authorization of the Chief Executive Officer or his or her designee, if obtaining such authorization would cause an excessive delay in delivering treatment to the individual.

6. (f) In the event information has been released without the individual's authorization, the staff member responsible for the release of information enters into the individual's case record all details pertinent to the transaction, including at least:

   1. (1) The date the information was released;
   2. (2) Persons to whom the information was released;
   3. (3) The reason the information was released; and
   4. (4) The nature and details of the information given.
7. (g) The client or applicant is informed that the confidential information was released as soon as possible after the incident occurs.

Codification Notes: Health Insurance Portability and Accountability Act of 1996 was enacted as Pub. L. No. 104-191.