.15 Maintenance of Records.

A. The agency shall maintain a client’s record for 5 years after the client is discharged. For a client younger than 18 years old, the agency shall maintain the client’s record after discharge until the resident is 21 years old, or for 5 years after the record is made, whichever is later, except as otherwise provided in Health-General Article, §4-403, Annotated Code of Maryland.

B. If an agency ceases operation, the agency shall make arrangements to return the records to the client or client representative with legal authority to make health care decisions, or retain the records as required by §A of this regulation.

C. An agency shall:

(1) Maintain the privacy and confidentiality of a client’s medical records;

(2) Release medical records or medical information about a client only with the written consent of the client or client representative, or as permitted by Health-General Article, Title 4, Subtitle 3, Annotated Code of Maryland; and

(3) Maintain and dispose of a client’s medical records in accordance with Health-General Article, Title 4, Subtitle 3 and 4, Annotated Code of Maryland.

D. In addition to the provisions of §§A—C of this regulation, the agency shall establish and implement procedures that ensure that:

(1) Records of discharged clients are completed no later than 30 days after the date of discharge; and

(2) Safeguards are in place to protect clinical record information against loss, destruction, or illegal or unauthorized use.