42 CFR §491.10

1. (a)Records system.
   1. (1)The clinic or center maintains a clinical record system in accordance with written policies and procedures.
   2. (2)A designated member of the professional staff is responsible for maintaining the records and for insuring that they are completely and accurately documented, readily accessible, and systematically organized.
   3. (3)For each patient receiving health care services, the clinic or center maintains a record that includes, as applicable:
      1. (i)Identification and social data, evidence of consent forms, pertinent medical history, assessment of the health status and health care needs of the patient, and a brief summary of the episode, disposition, and instructions to the patient;
      2. (ii)Reports of physical examinations, diagnostic and laboratory test results, and consultative findings;
      3. (iii)All physician's orders, reports of treatments and medications, and other pertinent information necessary to monitor the patient's progress;
      4. (iv)Signatures of the physician or other health care professional.
2. (b)Protection of record information.
   1. (1)The clinic or center maintains the confidentiality of record information and provides safeguards against loss, destruction or unauthorized use.
   2. (2)Written policies and procedures govern the use and removal of records from the clinic or center and the conditions for release of information.
   3. (3)The patient's written consent is required for release of information not authorized to be released without such consent.
3. (c)Retention of records. The records are retained for at least 6 years from date of last entry, and longer if required by State statute.