CMS SOM App. Z, Tag E-0023

§482.15(b)(5), §483.73(b)(5), §483.475(b)(5), §484.102(b)(4), §485.68(b)(3),

§485.625(b)(5), §485.727(b)(3), §485.920(b)(4), §486.360(b)(2), §491.12(b)(3),

§494.62(b)(4).

[(b) Policies and procedures. The [facilities] must develop and implement

emergency preparedness policies and procedures, based on the emergency plan set

forth in paragraph (a) of this section, risk assessment at paragraph (a)(1) of this

section, and the communication plan at paragraph (c) of this section. The policies

and procedures must be reviewed and updated at least every 2 years [annually for

LTC facilities]. At a minimum, the policies and procedures must address the

following:]

[(5) or (3),(4),(6)] A system of medical documentation that preserves patient

information, protects confidentiality of patient information, and secures and

maintains availability of records.

*[For RNHCIs at §403.748(b):] Policies and procedures. (5) A system of care

documentation that does the following:

(i) Preserves patient information.

(ii) Protects confidentiality of patient information.

(iii) Secures and maintains the availability of records.

*[For OPOs at §486.360(b):] Policies and procedures. (2) A system of medical

documentation that preserves potential and actual donor information, protects

confidentiality of potential and actual donor information, and secures and maintains

the availability of records.

Interpretive Guidelines applies to: §403.748(b)(5), §416.54(b)(4), §418.113(b)(3),

§441.184(b)(5), §460.84(b)(6), §482.15(b)(5), §483.73(b)(5), §483.475(b)(5),

§484.102(b)(4), §485.68(b)(3), §485.625(b)(5), §485.727(b)(3), §485.920(b)(4),

§486.360 (b)(2), §491.12(b)(3), §494.62(b)(4).

NOTE: This does not apply to Transplant Programs.

In addition to any existing requirements for patient records found in existing laws, under

this standard, facilities are required to ensure that patient records are secure and readily

available to support continuity of care during an emergency. This requirement does not

supersede or take away any requirements found under the provider/supplier’s medical

records regulations, but rather, this standard adds to such regulations. These policies and

procedures must also be in compliance with the Health Insurance Portability and

Accountability Act (HIPAA), Privacy and Security Rules at 45 CFR parts 160 and 164,

which protect the privacy and security of individual’s personal health information.

Survey Procedures

• Ask to see a copy of the policies and procedures that documents the medical record

documentation system the facility has developed to preserves patient (or potential and

actual donor for OPOs) information, protects confidentiality of patient (or potential

and actual donor for OPOs) information, and secures and maintains availability of

records.