CMS SOM App. J, Tag W112

records, regardless of the form or storage method of the records.

Guidance §483.410(c)(2)

"Keep confidential" means safeguarding the content of information including video, audio,

and/or computer stored information from unauthorized disclosure without the specific

informed consent of the client, parent of a minor child, or legal guardian, and consistent with

the advocate's right of access. Facility staff and consultants, hired to provide services to the

client, sign confidentiality agreements before having access to client records and should have

access to only that portion of information that is necessary to provide effective responsive

services to the client.

These agreements should be renewed according to the policies of the facility. The agreement

may stipulate that the agreements are in place until either the facility or member terminates the

agreement.

The facility has in place safeguards to ensure that access to all information regarding clients is

limited to those clients designated by Health Insurance Portability and Accountability Act

(HIPAA) requirements, the Developmental Disabilities Act, State law and facility policy.

The facility should prevent any instances of unauthorized access or dissemination. For example,

the staff is observed to leave the client record (hard copy or electronic version) in the living

room of the house when visitors or persons not authorized to access client records are present.

Client records must be secured when staff is not present.

The facility must develop and follow procedures for maintaining the confidentiality of client

information during transport to medical appointments or to other locations outside the facility.

Confidentiality applies to both central records and information kept at dispersed locations. If

there is information considered too confidential to place in the record used by all staff (e.g.,

identification of the family's financial assets, sensitive medical data), it may be retained in a

companion record located in a secure location in the facility with a notation made in the primary

record as to the location of confidential information. The facility must ensure that any client

information provided to day services programs is maintained confidential.

The sharing of client specific information with members of the "specially constituted

committee" required by §483.440(f)(3), who are not affiliated with the agency, does not violate

a client's right to have information about him or her kept confidential. The committee must

have relevant information to function properly.

Facility confidentiality safeguards include the development and implementation of written

policies to assure that members of the specially constituted team maintain confidentiality. Such

processes may include signed confidentiality agreements.

These agreements should be renewed according to the policies of the facility. The agreement

may stipulate that the agreements are in place until either the facility or member terminates the

agreement.