Rule 24-2-16.6 - ConfidentialityA. Personnel must maintain the confidentiality rights of people they serve at all times across situations and locations, such as in waiting areas to which the public has access, while speaking on the telephone, or in conversing with colleagues.B. The agency provider must have written policies and procedures and related documentation pertaining to the compilation, storage, and dissemination of people's records that assures a person's right to privacy and maintains the confidentiality of people's records and information.C. Compilation, storage and dissemination of people's records, including related documentation, must be in accordance with these policies and procedures, which at a minimum must include:1. Designated person(s) to distribute people's records to employees;2. Specific procedures to assure that people's records are secure in all locations;3. Procedures to limit access to people's records to only those who have been determined to have specific need for the person's record, including written documentation listing those people;4. Procedures for release of information that are in accordance with all applicable state and federal laws. Generally, this means people's records and information shall not be released except upon prior written authorization of the person receiving services or his/her legally authorized representative; upon order of a court of competent jurisdiction; upon request by medical personnel in a medical emergency; or, when necessary for the continued treatment or continued benefits of the person. These procedures at a minimum must: (a) Describe the process for releasing information about people receiving services only upon written consent, including the identification of the employee responsible for processing inquiries or requests for information regarding people receiving services.(b) Describe the process for releasing information about a person receiving services without prior written consent, that is, in cases of a medical emergency or upon receipt of a court order.(c) Provide that written consent to release information is not combined with any other consents or releases by the person receiving services.5. Procedures prohibiting the disclosure that a person answering to a particular description, name, or other identification has or has not been attending the service without prior written consent of the person specifically authorizing such disclosure;6. Procedures prohibiting re-disclosure of information obtained by the agency provider and released by the agency provider without specific prior written consent of the person to whom it pertains;7. Procedures requiring written consent of the person receiving services or his/her legal representative(s), when appropriate, prior to disclosing identifying information to third-party payer; and,8. Procedures addressing the release of information regarding people receiving Substance Use Services, in accordance with applicable federal regulations.D. Records containing any information pertaining to people receiving services must be kept in a secure room or in a locked file cabinet or other similar container when not in use;E. All paper records must be marked "confidential" or bear a similar cautionary statement; all electronic health records or digital filing must be privacy protected and contain a statement of confidentiality or similar cautionary statement; and,F. No agency provider shall release records of people receiving services for review to a state or federal reviewer other than DMH personnel without a written statement indicating: 1. The purpose of the review;2. Employee to conduct the review;3. That reviewer(s) are bound by applicable regulations regarding confidentiality and all others that apply; and,4. Reviewer(s) signature(s) and the date signed. Section 41-4-7 of the Mississippi Code, 1972, as Amended