D.C. Mun. Regs. tit. 22, r. 22-A8021
A program shall create and maintain an organized record for each individual receiving services.
All records must be secured in a manner that provides protection from unauthorized disclosure, access, use, or damage in accordance with Federal and District laws and regulations.
Each individual's records shall be kept confidential and shall be handled in compliance with HIPAA, the Mental Health Information Act, and 42 CFR Part 2 (if applicable), and all other Federal and District laws and regulations regarding the confidentiality of an individual's records.
Each provider shall have a designated Privacy Officer responsible for ensuring compliance with privacy requirements.
A program shall inform staff and individuals receiving services of this chapter's privacy requirements during orientation.
A provider's decision to disclose protected health information ("PHI") must comply with Federal and District laws and regulations and shall be made only by the Privacy Officer or his/her designee with appropriately administered consent procedures.
A program shall ensure its policies and procedures comply with the Department's Privacy Policy and shall implement policies and procedures governing the release of PHI consistent with Federal and District laws and regulations regarding the confidentiality of individual records, including 42 CFR Part 2, the D.C. Mental Health Information Act, and HIPAA.
Each provider shall execute a participation agreement with the District's Health Information Exchange (HIE) and utilize the HIE to receive and transmit protected health information for individuals in accordance with the District of Columbia Mental Health Information Act of 1978, effective Mar. 3, 1979 (D.C. Law 2-136, D.C. Official Code §§ 7-1201.01et seq.).
For non-substance use treatment ("SUD") programs, the behavioral health stabilization provider shall develop policies and procedures to disclose protected behavioral health information to other certified providers, primary health care providers, and other health care organizations when necessary to coordinate the care and treatment of its individuals. These procedures may include entering into an agreement with an HIE. The program shall advise each prospective individual of the program's notice of privacy practices that authorizes this disclosure to other providers and shall afford the individual the opportunity to opt-out of that disclosure in accord with the D.C. Mental Health Information Act. The program shall document the individual's decision.
The program director shall designate a staff member to be responsible for the maintenance and administration of records.
A program shall arrange and store records according to a uniform system approved by the Department.
A program shall maintain records such that they are readily accessible for use and review by authorized staff and other authorized parties.
A program shall organize the content of records so that information can be located easily and so that Department surveys and audits can be conducted with reasonable efficiency.
Providers shall utilize an Electronic Health Record (EHR) system certified by the Department of Health and Human Services Office of the National Coordinator for Health Information Technology to document all phases of the individual's treatment and care.
All providers shall electronically transmit Behavioral Health Supplemental Data (BHSD) to the Department in a form and manner as prescribed by the Department. BHSD is a compilation of individual-level behavioral health data defined in the Department's Integrated Technology Engine (ITE) Provider Companion Guide (available at https://dbh.dc.gov/).
Providers shall timely transmit BHSD to the Department pursuant to the procedure established in the ITE through the EHR system.
The Department shall provide notice of any future updates to the ITE Guide through https://dbh.dc.gov/.
D.C. Mun. Regs. tit. 22, r. 22-A8021