CMS SOM App. U, Tag R111

For any patient care records or election information it maintains on patients, the

RNHCI must establish procedures to do the following:

(1) Safeguard the privacy of any information that identifies a particular patient.

Information from, or copies of, records may be released only to authorized

individuals, and the RNHCI must ensure that unauthorized individuals cannot gain

access to or alter patient records. Original patient care records must be released

only in accordance with Federal or State laws, court orders, or subpoenas.

Interpretive Guidelines: §403.730(d)(1)

The patient has the right to have his or her care records maintained in a confidential

manner. In addition to any existing requirements for patient records found in existing

laws, under this standard, facilities are required to ensure that patient records are

secure. The RNHCI should have policies and procedures in compliance with the Health

Insurance Portability and Accountability Act (HIPAA), Privacy and Security Rules at 45

CFR parts 160 and 164, which protect the privacy and security of individual’s personal

health information. The RNHCI should have sufficient safeguards to ensure that access to

all patient care records is limited to those individuals designated by law, regulation, and

policy, or duly authorized by the patient to have access. No unauthorized access or

dissemination of patient records is permitted. Patient records must be kept secure and

only viewed when necessary by those persons participating in some aspect of the

patient’s care.

The right to the confidentiality of patient records means safeguarding the content of

information, including patient paper records, video, audio, and/or computer-stored

information from unauthorized disclosure without the specific informed consent of the

patient or patient’s representative.

Confidentiality applies to both central storage of the closed patient records and to open

patient records in use throughout the RNHCI.

Survey Procedures:

• How does the facility ensure the confidentiality of patient records?

• Does the facility instruct the caretaker and authorized individual about protecting

the confidentiality of the record, if the facility leaves a portion of the record with

the caretaker and/or authorized individual?

• What evidence indicates that each patient is informed of policies and procedures

concerning his/her record disclosure?