CMS SOM App. B, Tag G438

The patient has the right to—

(6) Have a confidential clinical record. Access to or release of patient information

and clinical records is permitted in accordance with 45 CFR parts 160 and 164.

Interpretive Guidelines §484.50(c)(6)

45 CFR Part 160 and 164 pertain to requirements of the Health Insurance Portability and

Accountability Act of 1996 (“HIPAA”). The HIPAA Privacy Rule (45 CFR Part 160 and

Subparts A and E of Part 164), Security Rule (45 CFR Part 160 and Subparts A and C of

Part 164), and Breach Notification Rule (45 CFR §§ 164.400–414) protect the privacy

and security of health information and provide individuals with certain rights regarding

their health information as follows:

• The Privacy Rule sets national standards for covered entities (health plans,

health care clearinghouses, and health care providers that conduct certain health

care transactions electronically) and their business associates, including

appropriate safeguards to protect the privacy of protected health information

(PHI) and the limits and conditions under which PHI is permitted or required to

be used or disclosed;

• The Security Rule specifies safeguards that covered entities and their business

associates must implement to protect the confidentiality, integrity, and availability

of electronic protected health information (ePHI)

• The Breach Notification Rule requires covered entities and their business

associates to notify affected individuals, U.S. Department of Health & Human

Services (HHS), and in some cases, the media of a breach of unsecured PHI.

The HIPAA Privacy Rule also gives certain patients’ rights over their health information,

including rights to examine and obtain a copy of their health records, and to request

corrections.

HHAs have unique concerns and risks regarding staff and contractors who transport

documents and/or electronic devices containing PHI, such as during their visits to

patient’s homes. Compliance with §484.50(c)(6) is evidenced by documentation of

HIPAA training for all staff and monitoring HIPAA compliance to manage the risk of

inappropriate PHI disclosure or unsecured ePHI. Each covered entity and business

associate is responsible for ensuring its compliance with the HIPAA Privacy, Security,

and Breach Notification Rules, as applicable, including consulting appropriate counsel as

necessary.

Survey procedures §484.50(c)(6)

Verify that the agency staff maintain the confidentiality of protected health information

that they transport and use.