1. (1) Subject to rules adopted by the administrator, nothing in this part 2 prohibits a registered provider from permitting its employees to work from a remote location so long as the registered provider:

   1. (a) Ensures that no in-person customer interactions are conducted at the remote location and does not designate the remote location to consumers as a business location;
   2. (b) Maintains appropriate safeguards for registered provider and consumer data, information, and records, including the use of secure virtual private networks, also known as VPNs, where appropriate;
   3. (c) Employs appropriate risk-based monitoring and oversight processes of work performed from a remote location and maintains records of the monitoring and oversight processes;
   4. (d) Ensures consumer information and records are not maintained at a remote location;
   5. (e) Ensures consumer and registered provider information and records remain accessible and available for regulatory oversight and examination; and
   6. (f) Provides appropriate employee training to ensure employees working from a remote location keep all conversations about and with consumers that are conducted from the remote location confidential, as if conducted from a commercial location, and to ensure that employees working at a remote location work in an environment that is conducive and appropriate to ensuring privacy and confidential conversations.
2. (2) As used in this section, remote location means a private residence of an employee of a registered provider or another location selected by the employee and approved by the registered provider.

Source: L. 2023: Entire section added, (SB 23-248), ch. 360, p. 2153, § 13, effective August 7.