a) The organization shall maintain records, including, but not limited to, the following:

1. 1) Intervention/treatment service records;
2. 2) Organizational records including policies and procedures;
3. 3) Personnel records; and
4. 4) All other documents required in this Part.

d) Organizations shall adhere to the following regarding client/patient records:

1. 1) All records shall be maintained electronically or in written form and shall be protected in a locked room, locked file, safe, or similar container or in computer records with secure, limited access. If maintained electronically, a hard copy of required information shall be made available upon request by DHS/SUPR;
2. 2) If the record is not maintained electronically, each signature on a hard copy record shall be in ink or typed and dated. All additional entries shall be typed or in ink and indicate the time and duration of each service. Additionally, if the organization provides services that are authorized by DHS/SUPR at multiple facilities, one record can document all such services;
3. 3) Records shall be kept in the facility where the person is receiving services and shall be directly accessible to the staff providing the service;
4. 4) The compilation, storage of, and accessibility to records, including electronic records, shall be governed by written policies and procedures in accordance with 42 CFR 2, HIPAA, and all other applicable State and federal laws;
5. 5) All information, regardless of format, shall be secured from theft, loss, or fire and records maintained electronically shall have a back-up system to safeguard records in the event of operator or equipment failure;

6. 6) Electronic or digital signature on records is acceptable when the organization has established the necessary policies and procedures to:

   1. A) Safeguard the issuance and identity of users;
   2. B) Ensure uniqueness in issuance of signature;
   3. C) Regularly review the usage of signature;
   4. D) Ensure adequate safeguards within the system upon application of signatures to documents; and
   5. E) Audit users to remove unnecessary, unused, and abusers on a regular frequency;
7. 7) Any entry made on the record that is in any other language than English shall have an accompanying English translation;
8. 8) The record shall contain the signatory documents that indicates the person was informed of their rights and that informed consent was given for any service;

9. 9) The record shall contain, in a standardized format, the following demographic information:

   1. A) Unique identifier or Registered Identification Number (RIN), if applicable;
   2. B) Initial date of contact;
   3. C) Name, street address, city, state, zip code;
   4. D) Telephone number;
   5. E) Date of birth;
   6. F) Sex or gender identity;
   7. G) Race and ethnicity;
   8. H) Veteran status;
   9. I) Marital status;
   10. J) Educational level;
   11. K) Type of health insurance;
   12. L) Employment status;
   13. M) Annual income for any person that requests a subsidized or reduced fee for services and all proof of income documents unless this information is kept in a separate financial record;
   14. N) A dated, signed service fee statement, as specified in Section 2060.345(b), unless this information is kept in a separate financial record;
   15. O) Primary language; and
   16. P) Referral source and, as applicable, release of information forms.
10. 10) The record shall contain all other required documentation specified by service type in Subparts D and E of this Part; and
11. 11) The organization shall have a process to ensure that records comply with the requirements referenced in this Part. As such, the recordkeeping system shall be reviewed at least annually and any necessary corrective action made part of the quality improvement plan referenced in Section 2060.340(a).