(1) A provider shall ensure that each of its services maintains an individual record of services provided to each person served. Such record shall contain accurate, complete, timely, and relevant information, and shall be sufficiently detailed to enable a person to identify the types of services the person receives.

1. (a) Records shall be maintained in a consistent format that facilitates information retrieval. Records may be handwritten, printed, typed or in electronic digital format, or any combination thereof.
2. (b) A provider shall employ reasonable physical, technical and administrative safeguards to ensure the confidentiality, integrity and availability of records, and shall comply with all applicable federal and state laws and regulations.
3. (c) A person who is the subject of a record, or the person's legally authorized representative, who believes that the record contains inaccurate or misleading information, may request that it be amended. A provider shall respond to such request in accordance with applicable state and federal requirements.

(3) Inspection by Person, Legally Authorized Representative or Person's Attorney.

1. (a) A person and the person's legally authorized representative shall be permitted to inspect the person's records unless a licensed health care professional of the provider, determines that:

   1. 1. inspection by the person is reasonably likely to endanger the life or physical safety of the person or another individual;
   2. 2. the record makes reference to another person (other than a health care provider) and its inspection is reasonably likely to cause substantial harm to such other person; or
   3. 3. inspection by the legally authorized representative is reasonably likely to cause substantial harm to the person or another person.
2. (b) If access to a record is denied based on the criteria in 104 CMR 28.09(3)(a), the person or the person's legally authorized representative shall be informed of, and have, the right to appeal such denial. The determination on appeal must be made by a licensed health care professional, other than the person who made the initial decision to deny access, and such determination shall be final.
3. (c) The person's attorney shall be permitted to inspect the person's record upon request. The Commissioner or designee may require that the request be in writing and may further require appropriate verification of the attorney client relationship.
4. (d) Clinical staff may offer to read or interpret the record when necessary for the understanding of the person or his or her legally authorized representative. However, in no circumstance may an individual be denied access to a record solely because he or she declines the offer of staff to read or interpret the record.
5. (e) The program director may require the legally authorized representative's consent before permitting a person younger than 18 years old to inspect his or her own records; provided that the records of medical or dental treatment of a person younger than 18 years old, who has been determined to be an emancipated or mature minor as provided in 104 CMR 25.03: Emancipated and Mature Minors, shall be confidential between the minor and physician or dentist and shall not be released, except in accordance with M.G.L. c. 112, § 12F.

(4) Inspection by or Disclosure to Other Persons.

1. (a) Records of a person shall be open to inspection or disclosure upon proper judicial order, whether or not such order is made in connection with pending judicial proceedings.

   1. 1. For the purpose of 104 CMR 28.09(4), "proper judicial order" shall mean an order signed by a justice or special justice of a court of competent jurisdiction, or a clerk or assistant clerk of such court acting upon instruction of such a justice. A subpoena shall not be deemed a "proper judicial order."
   2. 2. Whenever practicable, a person and the person's legally authorized representative, if any, shall be informed of a court order for the production of the person's record.
2. (b) The records of a person, or parts thereof, shall be open to inspection by or disclosure to other third parties, upon receipt of written authorization from the person or the person's legally authorized representative, provided that such written authorization shall meet the requirements set forth in 45 CFR 164.508.

3. (c) The Commissioner or designee may permit inspection or disclosure of the records of a person where he or she has made a determination that such inspection or disclosure:

   1. 1. would be in the best interest of the person; and
   2. 2. is permitted by the privacy regulations promulgated under the Health Insurance Portability and Accountability Act (HIPAA) at 45 CFR Parts 160 and 164;

4. (d) Without limiting the discretionary authority of the Commissioner or designee to identify other situations where inspection or disclosure is in the person's best interest, the following inspections or disclosures are deemed to be in the person's best interest:

   1. 1. for purposes of treatment, payment, and health care operations as permitted by the privacy regulations promulgated under HIPAA at 45 CFR Parts 160 and 164;
   2. 2. to obtain authority for a legally authorized representative to act on the person's behalf, or to obtain a judicial determination of substituted judgment, when a clinical determination has been made that the person lacks capacity to render informed consent to treatment;
   3. 3. to persons conducting an investigation involving the person pursuant to 104 CMR 32.00: Investigation and Reporting Process;
   4. 4. to persons engaged in research if such access is approved by the Department pursuant to 104 CMR 31.00: Human Subject Research Authorization and Monitoring;
   5. 5. to make reports of communicable and other infectious disease to the Department of Public Health and/or local board of health consistent with 105 CMR 300.000: Reportable Diseases, Surveillance, and Isolation and Quarantine Requirements; and
   6. 6. in the case of death, to coroners, medical examiners, or funeral directors.

5. (e) Records may be disclosed as required by law. In addition to the laws and regulations of the Department, such laws include, but are not limited to:

   1. 1. M.G.L. c. 6, §§ 178C through 178Q (the Sex Offender Registry Law);
   2. 2. M.G.L. c. 19A, § 23 (Executive Office of Elder Affairs - abuse of elderly persons 60 years of age or older);
   3. 3. M.G.L. c. 19C, § 10 (Disabled Persons Protection Commission - abuse of disabled persons 18 through 59 years of age);
   4. 4. M.G.L. c. 119, §§ 51A and 51B (Department of Children and Families - abuse or neglect of children younger than 18 years old);
   5. 5. 42 U.S.C. 10806 (Protection and Advocacy for Individuals with Mental Illness);
   6. 6. M.G.L. c. 221, § 34E (Mental Health Legal Advisors Committee).

6. (f) Pursuant to M.G.L. c. 6A, § 16, the Department must offset the costs of the services which it provides directly or through contract by maximizing all Title XIX and other federal, state, and private health insurance reimbursement which might be available for such services. Accordingly, without limiting 104 CMR 28.09(4)(d)1., records may be disclosed by the Department and/or its agents for the purpose of:

   1. 1. benefits/insurance coverage/availability inquiries;
   2. 2. obtaining third-party reimbursement;
   3. 3. appeals of reimbursement denials; and
   4. 4. charging fee payers as set forth in 104 CMR 30.04: Charges for Services and 104 CMR 30.06: Charges for Room and Board in the Community.
7. (g) Any inspection or disclosure under the exceptions enumerated in 104 CMR 28.09(4)(c) through (f) shall be limited to the minimum information necessary to achieve the permitted inspection or disclosure.

(5) Notwithstanding the provisions of 104 CMR 28.09(3) and (4), inspection or disclosure of records or information shall not be permitted in the following circumstances:

1. (a) if the record or information was obtained from someone other than a health care provider under a promise of confidentiality, and the requested disclosure would likely reveal the source;
2. (b) on a temporary basis only, by or to the person, during the course of research involving treatment, where the person agreed to such temporary suspension of access when consenting to participation in the research study;
3. (c) if the subject of the record is in the custody of a correctional institution and the correctional institution has requested that access not be provided for health and safety reasons; or
4. (d) if the records are created in anticipation of litigation.