8022.1 A program shall retain individuals' records (either original or accurate reproductions) until all litigation, adverse audit findings, or both, are resolved. If no such conditions exist, a program shall retain individuals' records for at least ten (10) years after the individual's discharge.

8022.2 Records of minors shall be kept for at least ten (10) years after the minor has reached the age of eighteen (18) years.

8022.3 The provider shall establish a Document Retention Schedule with all medical records retained in accordance with Federal and District laws and regulations.

8022.4 The provider shall give the individual or legal guardian a written statement concerning individual's rights and responsibilities ("Rights Statement") in the program during orientation. The individual or guardian shall sign the statement attesting that they understand their rights and responsibilities. A provider staff member shall be available to answer an individual or legal guardian's questions about the Rights Statement and to witness the individual's or guardian's signature. This document shall be placed in the individual's record.

8022.5 If program records are maintained on computer systems, the system shall:

(a) Have a backup system to safeguard the records in the event of operator or equipment failure, natural disasters, power outages, and other emergency situations;

(b) Identify the name of the person making each entry into the record;

(c) Be secure from inadvertent or unauthorized access to records in accordance with HIPAA, the D.C. Mental Health Information Act, 42 CFR Part 2 (if applicable), and all Federal and District laws and regulations regarding the confidentiality of individual records;

(d) Limit access to providers who are involved in the care of the individual and who have permission from the individual to access the record; and

(e) Create an electronic trail when data is released.

8022.6 A program shall maintain records that safeguard confidentiality in the following manner:

(a) Records shall be stored with access controlled and limited to authorized staff and authorized agents of the Department;

1. (b) Written records that are not in use shall be maintained in either a secured room, locked file cabinet, safe, or other similar container;
2. (c) The program shall implement policies and procedures that govern individual access to their own records;
3. (d) The provider's policies and procedures shall only restrict an individual's access to their record or information in the record after an administrative review with clinical justification has been made and documented;
4. (e) Individuals shall receive copies of their records as permitted under HIPAA, the D.C. Mental Health Information Act, and 42 CFR Part 2;
5. (f) All staff entries into the record shall be clear, complete, accurate, and recorded in a timely fashion;
6. (g) All entries shall be dated and authenticated by the recorder with full signature and title;
7. (h) All non-electronic entries shall be typewritten or legibly written in indelible ink that will not deteriorate from photocopying;
8. (i) Any documentation error shall be marked through with a single line and initialed and dated by the recorder; and
9. (j) Limited use of symbols and abbreviations shall be pre-approved by the program and accompanied by an explanatory legend.

8022.7 Any records that are retained off-site must be kept in accordance with this chapter. If an outside vendor is used, the provider must submit the vendor’s name, address, and telephone number to the Department.

SOURCE: Final Rulemaking published at 68 DCR 1623 (February 5, 2021).