The administrator shall ensure that the facility develops and implements written policies and procedures concerning patientsí rights and responsibilities, including but not limited to:
A. The opportunity to participate in planning their medical treatment; and
B. Confidentiality of medical records and the right to approve or refuse release of records to any individual outside the facility, except as provided by federal or State law.