Nursing homes and other healthcare facilities must take steps to ensure resident-identifiable information is not released to the public, and if released to an agent, it is done so in accordance with a contract in which the agent agrees not to disclose any information the facility would not be able to release publicly. Medical records must be complete, accurately documented, readily accessible, and systematically organized, and must be kept confidential except when release is to the resident or is required by law. The facility must also safeguard medical record information against loss, destruction, or unauthorized use, and must retain medical records for the period of time required by State law (or 5 years from the date of discharge when there is no requirement in State law, or 3 years after a minor resident reaches legal age under State law). The medical record must also contain sufficient information to identify the resident, a record of the resident's assessments, the comprehensive plan of care and services provided, the results of any preadmission screening and resident review evaluations, physician, nurse, and other licensed professionals progress notes, and laboratory, radiology and other diagnostic services reports. Electronic Health Records (EHR) must comply with HIPAA privacy and security rules and facilities must have policies that identify individuals who are authorized to sign electronically, and describe security safeguards to prevent unauthorized use of these signatures. Surveyors must assess compliance with the regulatory requirement for maintaining the content and confidentiality of the medical record, and if there are concerns that the facility’s practice may constitute violations of the HIPAA privacy or security rules, they must be referred to HHS’ Office for Civil Rights.

Summaries are generataed using AI. Check important information.