Rule 5122-26-08 | Confidentiality.
(A) A provider is to have a written policy on staff member access to, and disclosure of, an individual client's records, treatment information, diagnosis, and other protected health information. That policy is to be consistent with federal and state laws and regulations, including the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and, if applicable to the services and supports, 42 C.F.R. part 2.
(B) Storage of client records is to be in accordance with all applicable federal and state laws and regulations.
(C) All certified services or supports provided by telehealth are to begin with the verification of the client through a name and password or personal identification number and be provided in accordance with all state and federal laws, including those pertaining to the protection of patient information. Accordingly, a provider is to ensure that any username or password information and any electronic communications between the provider and client are securely transmitted and stored. All equipment used for telehealth is to be used in accordance with state and federal laws.
Last updated August 3, 2026 at 8:34 AM
Supplemental Information