US · guidance
CMS SOM App. U, Tag R114
(4) Abide by all Federal and State laws regarding confidentiality and disclosure for
patient care records and election information.
Interpretive Guidelines: §403.730(d)(4)
The RNHCI should have policies and procedures in compliance with the Health
Insurance Portability and Accountability Act (HIPAA), Privacy and Security Rules at 45
CFR parts 160 and 164, which protect the privacy and security of individual’s personal
health information. The RNHCI should have sufficient safeguards to ensure that access to
all patient care records is limited to those individuals designated by law, regulation, and
policy, or duly authorized by the patient to have access.
Survey Procedures:
Surveyors are not expected to have detailed knowledge of the requirements of the Privacy
and Security Rules, but instead are to focus on the steps the RNHCI takes to protect the
confidentiality of records, as well as to assure a patient’s access to his/her own clinical
record.
History
Rev. 239; Issued: 04-24-26; Effective: 04-24-26; Implementation: 04-24-26
Provenance
- Source
- cms.gov
- Retrieved
- 2026-07-22
- Edition
- som-2026-07-22
- Content hash
d0a0f98bcabfea7fa6155a5cbab9e1a768a5a89f2f0152dafab34f1d0852a4e5
The link goes to the issuing authority’s own document — the one we read to produce this record. Where a source publishes whole titles rather than sections, your browser may need a moment to jump to the provision.
Unofficial copy of government-published law, reproduced from official sources with full provenance. Not an official publication; verify against official sources before relying on it in a filing. Records in the 'guidance' corpus, and only that corpus, are sub-regulatory (interpretive guidelines, survey procedures) and are not binding law. Validity bounds follow each jurisdiction's declared temporalBasis.