US · guidance
CMS SOM App. H, Tag V728
§ 494.170(a) Standard: Protection of the patient’s record
The dialysis facility must— (3)
Obtaining written authorization from the patient or legal representative before releasing
information that is not authorized by law.
Interpretive Guidance § 494.170(a)(3)
Medical records must contain written authorization for health information release prior to
release of any medical records that require the patient’s/designee’s authorization for release.
42 CFR § 494.170(a)(2)(v) authorizes access and review of patient records to state and federal
surveyors and ESRD Networks, including making copies of medical records offsite for official
Page 278 of 420
purposes. Standards at §489.53(a)(13) requires a provider/supplier to permit copying of records
or other information by, or on behalf of CMS, as necessary to determine compliance with
Medicare requirements. Failure to permit copying of information can be the basis for
termination.
History
Rev.
Provenance
- Source
- cms.gov
- Retrieved
- 2026-07-22
- Edition
- som-2026-07-22
- Content hash
dd79ff4107e99421d7941f8c6ae59def9f0b5a3debc68d48bbe2437d5d5de08a
The link goes to the issuing authority’s own document — the one we read to produce this record. Where a source publishes whole titles rather than sections, your browser may need a moment to jump to the provision.
Unofficial copy of government-published law, reproduced from official sources with full provenance. Not an official publication; verify against official sources before relying on it in a filing. Records in the 'guidance' corpus, and only that corpus, are sub-regulatory (interpretive guidelines, survey procedures) and are not binding law. Validity bounds follow each jurisdiction's declared temporalBasis.