(a) The treatment program shall establish and maintain a separate treatment record for every client, beginning at the time of admission into the treatment program.
(b) The treatment program shall protect all client records and other client-identifying information from destruction, loss, or tampering and from unauthorized access, use, or disclosure. These safeguards must protect against verbal disclosure and prevent unsecured maintenance of records or recording of an activity or presentation without appropriate releases. Information that identifies those seeking services shall be protected to the same degree as information that identifies clients.
(c) Only personnel whose duties require access to client records may have such access. The treatment program shall keep records locked at all times unless authorized personnel are continuously present in the immediate area.
(d) The treatment program shall comply with federal and state confidentiality laws and regulations, including 42 CFR Part 2 (federal regulations on the confidentiality of substance use disorder patient records), Chapter 611, Texas Health and Safety Code (relating to mental health records), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The treatment program shall also protect the confidentiality of HIV information as required in Section 81.103, Texas Health and Safety Code (relating to confidentiality; criminal penalty).
(e) The treatment program shall adopt written policies for personnel regarding the confidentiality of substance use disorder treatment records under the law. The policies shall specify the circumstances in which information regarding a client's substance use disorder treatment may be shared by law.
(f) The treatment program may not deny clients access to the content of their records except as provided by Section 611.0045, Texas Health and Safety Code, and HIPAA or other law.

Source Note: The provisions of this §353.302 adopted to be effective October 1, 2021, 46 TexReg 6408