An organization must have and follow processes governing access to, use of, and release of information about a person served that include the organization's publicity, social media, research, and Health Insurance Portability and Accountability Act (HIPAA) practices.
Idaho Admin. Code r. 16.04.18.208