D.C. Mun. Regs. r. 22-A8021
A program shall create and maintain an organized record for each individual receiving services.
All records must be secured in a manner that provides protection from unauthorized disclosure, access, use, or damage in accordance with Federal and District laws and regulations.
Each individual's records shall be kept confidential and shall be handled in compliance with HIPAA, the Mental Health Information Act, and 42 CFR Part 2 (if applicable), and all other Federal and District laws and regulations regarding the confidentiality of an individual's records.
Each provider shall have a designated Privacy Officer responsible for ensuring compliance with privacy requirements.
A program shall inform staff and individuals receiving services of this chapter's privacy requirements during orientation.
A provider's decision to disclose protected health information ("PHI") must comply with Federal and District laws and regulations and shall be made only by the Privacy Officer or his/her designee with appropriately administered consent procedures.
A program shall ensure its policies and procedures comply with the Department's Privacy Policy and shall implement policies and procedures governing the release of PHI consistent with Federal and District laws and regulations regarding the confidentiality of individual records, including 42 CFR Part 2, the D.C. Mental Health Information Act, and HIPAA.
A provider shall participate through a formal agreement with a registered Health Information Exchange ("HIE") entity of the DC Health Information Exchange ("DC HIE"), defined in Chapter 87 of Title 29 DCMR.
For non-substance use treatment ("SUD") programs, the behavioral health stabilization provider shall develop policies and procedures to disclose protected behavioral health information to other certified providers, primary health care providers, and other health care organizations when necessary to coordinate the care and treatment of its individuals. These procedures may include entering into an agreement with an HIE. The program shall advise each prospective individual of the program's notice of privacy practices that authorizes this disclosure to other providers and shall afford the individual the opportunity to opt-out of that disclosure in accord with the D.C. Mental Health Information Act. The program shall document the individual's decision.
The program director shall designate a staff member to be responsible for the maintenance and administration of records.
A program shall arrange and store records according to a uniform system approved by the Department.
A program shall maintain records such that they are readily accessible for use and review by authorized staff and other authorized parties.
A program shall organize the content of records so that information can be located easily and so that Department surveys and audits can be conducted with reasonable efficiency.
D.C. Mun. Regs. r. 22-A8021