42 CFR §494.170

1. (a)Standard: Protection of the patient's record. The dialysis facility must—
   1. (1)Safeguard patient records against loss, destruction, or unauthorized use; and
   2. (2)Keep confidential all information contained in the patient's record, except when release is authorized pursuant to one of the following:
      1. (i)The transfer of the patient to another facility.
      2. (ii)Certain exceptions provided for in the law.
      3. (iii)Provisions allowed under third party payment contracts.
      4. (iv)Approval by the patient.
      5. (v)Inspection by authorized agents of the Secretary, as required for the administration of the dialysis program.
   3. (3)Obtaining written authorization from the patient or legal representative before releasing information that is not authorized by law.
2. (b)Standard: Completion of patient records and centralization of clinical information.
   1. (1)Current medical records and those of discharged patients must be completed promptly.
   2. (2)All clinical information pertaining to a patient must be centralized in the patient's record, including whether the patient has executed an advance directive. These records must be maintained in a manner such that each member of the interdisciplinary team has access to current information regarding the patient's condition and prescribed treatment.
   3. (3)The dialysis facility must complete, maintain, and monitor home care patients' records, including the records of patients who receive supplies and equipment from a durable medical equipment supplier.
3. (c)Standard: Record retention and preservation. In accordance with 45 CFR § 164.530(j)(2), all patient records must be retained for 6 years from the date of the patient's discharge, transfer, or death.
4. (d)Standard: Transfer of patient record information. When a dialysis patient is transferred, the dialysis facility releasing the patient must send all requested medical record information to the receiving facility within 1 working day of the transfer.