US · guidance
CMS SOM App. FC, Tag M0139
§485.910(c)(3) Have a confidential clinical record
Access to or release of client
information and the clinical record client information is permitted only in accordance with
45 CFR parts 160 and 164.
Interpretive Guidelines §485.910(c)(3)
The facility stores all medical records (current and closed) in a secure manner so that
only authorized persons may access the records. For facilities using an electronic
medical record system there must be established procedures to ensure the safeguard of
electronic information including persons authorized to access the database.
The release of patient medical record information occurs only in accordance with the
requirements of the Health Insurance Portability and Accountability Act (HIPAA). If the
State has additional or more restrictive laws governing medical record access, the facility
should also comply with these requirements.
History
Rev. 196, Issued: 01-10-20, Effective: 01-10-20, Implementation: 01-10-20
Provenance
- Source
- cms.gov
- Retrieved
- 2026-07-22
- Edition
- som-2026-07-22
- Content hash
9bc7c0dc36eb0a42672dbef72aef11d86c41089abcaa1d4eb2d5aa8985b89400
The link goes to the issuing authority’s own document — the one we read to produce this record. Where a source publishes whole titles rather than sections, your browser may need a moment to jump to the provision.
Unofficial copy of government-published law, reproduced from official sources with full provenance. Not an official publication; verify against official sources before relying on it in a filing. Records in the 'guidance' corpus, and only that corpus, are sub-regulatory (interpretive guidelines, survey procedures) and are not binding law. Validity bounds follow each jurisdiction's declared temporalBasis.