(a) The facility shall establish and maintain a single record for every client beginning at the time of admission. The content of client records shall be complete, current, and well organized.
(b) The facility shall protect all client records and other client-identifying information from destruction, loss, tampering, and unauthorized access, use or disclosure.
  (1) All active client records shall be stored at the facility. Inactive records, if stored off-site, shall be fully protected. All original client records shall be maintained in the State of Texas.
  (2) Information that identifies those seeking services shall be protected to the same degree as information that identifies clients.
  (3) Electronic client information shall be protected to the same degree as paper records and shall have a reliable backup system.
(c) Only personnel whose job duties require access to client records shall have such access.
(d) Personnel shall keep records locked at all times unless authorized staff is continuously present in the immediate area.
(e) The facility shall ensure that all client records can be located and retrieved upon request at all times.
(f) The facility shall comply with Federal and State confidentiality laws and regulations, including 42 C.F.R pt. 2 (Federal regulations on the Confidentiality of Alcohol and Drug Abuse Patient Records), TEX. HEALTH & SAFETY CODE ANN. ch. 611 (Vernon Supp. 2004)(relating to Mental Health Records) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The facility shall also protect the confidentiality of HIV information as required in TEX. HEALTH & SAFETY CODE ANN. §81.103 (Vernon 2001) (relating to Confidentiality; Criminal Penalty).
(g) The facility shall not deny clients access to the content of their records except as provided by TEX. HEALTH & SAFETY CODE ANN. §611.0045 (Vernon Supp. 2004) and HIPAA.
(h) Client records shall be maintained for at least six years. Records of adolescent clients shall be maintained for at least five years after the client turns 18.
(i) If client records are microfilmed, scanned, or destroyed, the facility shall take steps to protect confidentiality. The facility shall maintain a record of all client records destroyed on or after September 1, 1999, including the client's name, record number, birth date, and dates of admission and discharge.

Source Note: The provisions of this §564.508 adopted to be effective September 1, 2004, 29 TexReg 2020; transferred effective September 1, 2004, as published in the Texas Register September 10, 2004, 29 TexReg 8842; transferred effective April 30, 2024, as published in the Texas Register April 5, 2024, 49 TexReg 2197