45 CFR Part 164 - PART 164—SECURITY AND PRIVACY

The following state regulations pages link to this page.

---

Alabama

• Ala. Admin. Code r. 420-1-5-.04 - 420-1-5-.04 - Open Records

• Ala. Admin. Code r. 660-1-6-.14 - 660-1-6-.14 - HIPAA Privacy Policy

Alaska

• Alaska Admin. Code Title 12 § 19.415 - 12 AAC 19.415 - Safety and confidentiality of communications

• Alaska Admin. Code Title 12 § 52.250 - 12 AAC 52.250 - Job shadowing in pharmacy

• Alaska Admin. Code Title 12 § 62.410 - 12 AAC 62.410 - Safety and confidentiality of communications

• Alaska Admin. Code Title 3 § 26.680 - 3 AAC 26.680 - Disclosure of nonpublic personal health information

• Alaska Admin. Code Title 3 § 26.695 - 3 AAC 26.695 - Relationship to federal privacy laws

• Alaska Admin. Code Title 7 § 10.903 - 7 AAC 10.903 - Limited disclosure of background check and variance review committee information.

• Alaska Admin. Code Title 7 § 12.425 - 7 AAC 12.425 - Medical records

• Alaska Admin. Code Title 7 § 12.770 - 7 AAC 12.770 - Medical record service

• Alaska Admin. Code Title 7 § 166.040 - 7 AAC 166.040 - Privacy and security

• Alaska Admin. Code Title 7 § 85.200 - 7 AAC 85.200 - Confidential information

Arkansas

• Ark. Admin. Rules 007-003-Section I - Section I - Authority

• Ark. Admin. Rules 007-003-Section I - Section I - Definitions/Acronyms.

• Ark. Admin. Rules 007-005-Section IV - Section IV - Requirements for the Prescription Drug Monitoring Program.

• Ark. Admin. Rules 007-005-Section VI - Section VI - Confidentiality.

• Ark. Admin. Rules 054-074-20 - SECTION 20 - Relationship to Federal Rules

• Ark. Admin. Rules 054-100-4 - Section 4 - Definitions.

California

• 17 CCR Sec. 98100 - § 98100 - Local Health Officers' Report of Known or Suspected Pesticide-Related Illness.

Colorado

• 10 CCR 2505-10 8.000 - 10 CCR 2505-10 8.000 - MEDICAL ASSISTANCE - SECTION 8.000 Emergency Medical Transportation, Program Integrity

• 10 CCR 2505-10 8.1000 - 10 CCR 2505-10 8.1000 - MEDICAL ASSISTANCE - SECTION 8.1000 Medicare Modernization Act

• 10 CCR 2505-10 8.200 - 10 CCR 2505-10 8.200 - MEDICAL ASSISTANCE - SECTION 8.200 Physician Services, Dental, Vision Services, Medicaid Managed Care Program, EPSDT

• 10 CCR 2505-5 - 10 CCR 2505-5 - EXECUTIVE DIRECTOR OF HEALTH CARE POLICY AND FINANCING RULES

• 2 CCR 502-1 - 2 CCR 502-1 - BEHAVIORAL HEALTH

Connecticut

• Conn. Agencies Regs. § 31-51rr-38 - 31-51rr-38 - Authentication and clarification of medical certification for leave taken because of an employee's own serious health condition or the serious health condition of a family member; second and third opinions (29 CFR § 825.307)

Delaware

• 16 Del. Admin. Code § 101 - 101 - Regulations Governing the Relief from Disabilities Board

• 16 Del. Admin. Code § 6001 - 6001 - Substance Abuse Facility Licensing Standards

Florida

• Fla. Admin. Code r. 33-103.013 - 33-103.013 - Classification of Grievance

• Fla. Admin. Code r. 33-302.101 - 33-302.101 - Offender Grievance Procedures

• Fla. Admin. Code r. 59E-9.010 - 59E-9.010 - Claims Data Collection

Hawaii

• Haw. Code R. §11-188-23 - §11-188-23 - Overview.

• Haw. Code R. §11-188-24 - §11-188-24 - Health Insurance Portability and Accountability Act.

• Haw. Code R. §11-188-4 - §11-188-4 - Goals.

Idaho

• Idaho Admin. Code r. 16.03.24.010 - 010 - DEFINITIONS.

Indiana

• 35 Ind. Admin. Code 20-1-12 - 35 IAC 20-1-12 - HIPAA

• 844 Ind. Admin. Code 5-8-3 - 844 IAC 5-8-3 - Pilot program requirements

Iowa

• Iowa Admin. Code r. 129-11.11 - 129.11.11 - Protective orders.

Maine

• 90 590 Me. Code R. Ch. 120 § 2 - SECTION 2 - DEFINITIONS

Maryland

• COMAR 10.01.16.03 - 10.01.16.03 - Incorporation by Reference.

• COMAR 10.07.16.16 - 10.07.16.16 - Records.

• COMAR 10.09.06.04 - 10.09.06.04 - Conditions for Participation.

• COMAR 10.09.49.08 - 10.09.49.08 - Confidentiality.

• COMAR 10.09.59.03 - 10.09.59.03 - General Conditions for Provider Participation.

• COMAR 10.09.80.03 - 10.09.80.03 - Conditions for Provider Participation.

• COMAR 10.18.01.08 - 10.18.01.08 - Confidentiality.

• COMAR 10.18.05.08 - 10.18.05.08 - Confidentiality.

• COMAR 10.18.06.11 - 10.18.06.11 - Confidentiality.

• COMAR 10.18.07.10 - 10.18.07.10 - Confidentiality.

• COMAR 10.18.10.08 - 10.18.10.08 - Confidentiality.

• COMAR 10.21.17.02 - 10.21.17.02 - Definitions.

• COMAR 10.21.17.08 - 10.21.17.08 - Records.

• COMAR 10.21.17.09 - 10.21.17.09 - Policies and Procedures.

• COMAR 10.21.30.07 - 10.21.30.07 - Confidentiality.

• COMAR 10.25.18.02 - 10.25.18.02 - Definitions.

• COMAR 10.32.09.05 - 10.32.09.05 - Physician Responsibilities.

• COMAR 10.34.35.06 - 10.34.35.06 - Minimum Requirements for Policies and Procedures.

• COMAR 10.34.35.07 - 10.34.35.07 - Training Requirements.

• COMAR 10.44.30.01 - 10.44.30.01 - Scope.

• COMAR 10.47.01.03 - 10.47.01.03 - Governance.

• COMAR 10.47.01.08 - 10.47.01.08 - Records.

• COMAR 10.50.01.04 - 10.50.01.04 - Incorporation by Reference.

• COMAR 10.50.01.11 - 10.50.01.11 - Tissue Bank Standards — Testing to Minimize Disease Transmission.

• COMAR 10.52.08.05 - 10.52.08.05 - Navigation Program Design and Operation.

• COMAR 10.52.08.11 - 10.52.08.11 - Confidentiality.

• COMAR 17.04.13.09 - 17.04.13.09 - Termination of Coverage.

Massachusetts

• 104 Mass. Code Regs. 27.16 - 27.16 - Records and Records Privacy

• 104 Mass. Code Regs. 27.18 - 27.18 - Substance Use Disorder Treatment Facility

• 104 Mass. Code Regs. 28.09 - 28.09 - Records and Record Privacy

• 105 Mass. Code Regs. 164.042 - 164.042 - Personnel Policies

• 105 Mass. Code Regs. 164.046 - 164.046 - Personnel Records

• 105 Mass. Code Regs. 164.084 - 164.084 - Confidentiality

• 957 Mass. Code Regs. 5.02 - 5.02 - Definitions

Michigan

• Mich. Admin. Code R 325.135 - R 325.135 - Regional performance improvement.

• Mich. Admin. Code R 338.479b - R 338.479b - Noncontrolled prescriptions.

• Mich. Admin. Code R 393.5052 - R 393.5052 - Adoption by reference; code of professional conduct; VRI auxiliary aids and services; privacy rules.

• Mich. Admin. Code R 500.551 - R 500.551 - Authority.

• Mich. Admin. Code R 500.560 - R 500.560 - Violations.

Mississippi

• Miss. Admin. Code. 23-207-3.10 - Rule 3.10 - Release of Information

• Miss. Admin. Code. 23-225-1.2 - Rule 1.2 - General Provider Information

• Miss. Admin. Code. 23-225-2.2 - Rule 2.2 - General Provider Information

• Miss. Admin. Code. 23-225-3.2 - Rule 3.2 - General Provider Information

• Miss. Admin. Code. 23-225-4.2 - Rule 4.2 - General Provider Information

Missouri

• 13 CSR 35-60.010 - 13 CSR 35-60.010 - Family Homes Offering Foster Care

• 13 CSR 70-1.020 - 13 CSR 70-1.020 - Standards for Privacy of Individually Identifiable Health Information

• 20 CSR 2220-2.300 - 20 CSR 2220-2.300 - Record Confidentiality and Disclosure

• 9 CSR 10-5.220 - 9 CSR 10-5.220 - Privacy Rule of Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• 9 CSR 10-7.090 - 9 CSR 10-7.090 - Governing Authority and Program Administration

• 9 CSR 30-3.032 - 9 CSR 30-3.032 - Certification of Alcohol and Drug Abuse Programs

• 9 CSR 45-5.060 - 9 CSR 45-5.060 - Procedures to Obtain Certification

Montana

• Mont. Admin. R. 6.6.7003 - 6.6.7003 - EXEMPTION BASED ON FEDERAL STANDARDS FOR PRIVACY AND SECURITY OF INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION

Nevada

• Nev. Admin. Code § 439.790 - 439.790 - Confidentiality of records.

• Nev. Admin. Code § 439.862 - 439.862 - Confidentiality of records.

• Nev. Admin. Code § 458.163 - 458.163 - Operators: Responsibilities concerning confidentiality and recordkeeping.

• Nev. Admin. Code § 458.241 - 458.241 - Manual of policies and procedures.

• Nev. Admin. Code § 458.267 - 458.267 - Policies, procedures and protocols for provision of services using telehealth.

• Nev. Admin. Code § 458.272 - 458.272 - Records regarding clients.

• Nev. Admin. Code § 458.341 - 458.341 - Qualifications for certification.

• Nev. Admin. Code § 458.349 - 458.349 - Requirements for maintenance or renewal of certification.

• Nev. Admin. Code § 458.371 - 458.371 - Investigations: Public disclosure of information and records.

• Nev. Admin. Code § 641C.080 - 641C.080 - Applicability of provisions relating to acquisition, maintenance and disclosure of information relating to client.

• Nev. Admin. Code § 641C.300 - 641C.300 - Requirements for maintenance or renewal of license or certificate; grounds for disciplinary action.

• Nev. Admin. Code § 641C.425 - 641C.425 - Confidentiality of information.

New Hampshire

• N.H. Code Admin. R. He-A 504.02 - He-A 504.02 - Privacy and Confidentiality

• N.H. Code Admin. R. He-P 812.19 - He-P 812.19 - Patient Records

• N.H. Code Admin. R. Ins 4002.01 - Ins 4002.01 - Definitions

• N.H. Code Admin. R. Omb 404.03 - Omb 404.03 - Accessing Resident Records

North Carolina

• 10A NCAC 13B .2102 - 10A NCAC 13B .2102 - REPORTING REQUIREMENTS

• 10A NCAC 13C .0206 - 10A NCAC 13C .0206 - REPORTING REQUIREMENTS

• 10A NCAC 26E .0603 - 10A NCAC 26E .0603 - REQUIREMENTS FOR TRANSMISSION OF DATA

• 10A NCAC 27G .0603 - 10A NCAC 27G .0603 - INCIDENT RESPONSE REQUIREMENTS FOR CATEGORY A AND B PROVIDERS

North Dakota

• N.D. Admin. Code 113-02-01-05 - 113-02-01-05 - Use and disclosure of protected health information.

• N.D. Admin. Code 113-02-01-08 - 113-02-01-08 - Privacy and security protections.

Ohio

• Ohio Admin. Code 123-4-04 - 123-4-04 - Confidentiality statutes.

• Ohio Admin. Code 173-39-02 - 173-39-02 - ODA provider certification: requirements for providers to become, and to remain, certified.

• Ohio Admin. Code 3364-70-05 - 3364-70-05 - Protection of human subjects in research.

• Ohio Admin. Code 4112-8-04 - 4112-8-04 - Confidentiality statutes.

• Ohio Admin. Code 4766-2-18 - 4766-2-18 - Incorporated by reference.

• Ohio Admin. Code 5122-1-04 - 5122-1-04 - Access to confidential personal information.

• Ohio Admin. Code 5123:1-6-01 - 5123:1-6-01 - Access to confidential personal information maintained by the Ohio department of developmental disabilities.

• Ohio Admin. Code 5160-43-03 - 5160-43-03 - Specialized recovery services program individual rights and responsibilities.

• Ohio Admin. Code 5160-43-04 - 5160-43-04 - Specialized recovery services program covered services and provider requirements.

• Ohio Admin. Code 5160-43-05 - 5160-43-05 - Specialized recovery services program provider conditions of participation.

• Ohio Admin. Code 5160-44-31 - 5160-44-31 - Ohio department of medicaid (ODM)-administered waiver programs: provider conditions of participation.

• Ohio Admin. Code 5160-45-03 - 5160-45-03 - Ohio department of medicaid (ODM) -administered waiver program: individual rights and responsibilities.

Oklahoma

• Okla Admin. Code § 340:1-1-20 - Section 340:1-1-20 - Confidentiality

• Okla Admin. Code § 340:105-11-242 - Section 340:105-11-242 - Access

• Okla Admin. Code § 340:2-8-1 - Section 340:2-8-1 - Legal basis, purpose, and hybrid designation

• Okla Admin. Code § 365:35-1-43 - Section 365:35-1-43 - Relationship to federal rules

• Okla Admin. Code § 450:70-3-5.10 - Section 450:70-3-5.10 - Assessment and record content - Service notification

Oregon

• OR Admin. Rule 125-055-0105 - 125-055-0105 - Definitions

• OR Admin. Rule 137-003-0036 - 137-003-0036 - Individually Identifiable Health Information

• OR Admin. Rule 137-003-0573 - 137-003-0573 - Individually Identifiable Health Information

• OR Admin. Rule 333-025-0100 - 333-025-0100 - Definitions

• OR Admin. Rule 333-071-0430 - 333-071-0430 - Medical Records

• OR Admin. Rule 333-265-0080 - 333-265-0080 - Reporting Obligations

• OR Admin. Rule 407-014-0000 - 407-014-0000 - Definitions

• OR Admin. Rule 407-014-0010 - 407-014-0010 - Purpose

• OR Admin. Rule 407-014-0040 - 407-014-0040 - Minimum Necessary Standards

• OR Admin. Rule 407-014-0050 - 407-014-0050 - Business Associate

• OR Admin. Rule 407-014-0060 - 407-014-0060 - Uses and Disclosures of Protected Information for Research Purposes

• OR Admin. Rule 407-014-0070 - 407-014-0070 - De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements

• OR Admin. Rule 407-014-0315 - 407-014-0315 - Security Information Assets

• OR Admin. Rule 407-045-0220 - 407-045-0220 - Adult Mental Health Abuse Rules: Disclosure of the Abuse Investigation Report

• OR Admin. Rule 407-045-0330 - 407-045-0330 - Adult Developmental Disabilities Abuse Rules: Disclosure of the Abuse Investigation and Protective Services Report and Related Documents

• OR Admin. Rule 407-045-0495 - 407-045-0495 - Oregon State Hospital Patient Abuse Investigation Rules: Disclosure of Investigation Report and Related Documents

• OR Admin. Rule 410-123-1265 - 410-123-1265 - Teledentistry

• OR Admin. Rule 415-065-0055 - 415-065-0055 - Program Requirements

• OR Admin. Rule 459-015-0020 - 459-015-0020 - Application Required

• OR Admin. Rule 459-076-0020 - 459-076-0020 - Application Required

• OR Admin. Rule 943-014-0000 - 943-014-0000 - Definitions

• OR Admin. Rule 943-014-0010 - 943-014-0010 - Purpose

• OR Admin. Rule 943-014-0040 - 943-014-0040 - Minimum Necessary Standards

• OR Admin. Rule 943-014-0060 - 943-014-0060 - Uses and Disclosures of Protected Information for Research Purposes

• OR Admin. Rule 943-014-0070 - 943-014-0070 - De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements

• OR Admin. Rule 943-014-0315 - 943-014-0315 - Security Information Assets

• OR Admin. Rule 943-014-0410 - 943-014-0410 - Definitions

• OR Admin. Rule 943-014-0415 - 943-014-0415 - General Business Associate Requirements

• OR Admin. Rule 943-045-0330 - 943-045-0330 - Disclosure of the Abuse or Mistreatment Investigation and Protective Services Report and Related Documents

• OR Admin. Rule 943-045-0480 - 943-045-0480 - Disclosure of Investigation Report and Related Documents

Pennsylvania

• 55 Pa. Code § 6000.1032 - § 6000.1032 - Applicability of section 417(c) of the MH/MR Act to health-care decisions.

Tennessee

• TN Rules and Regs. 0465-01-04-.01 - 0465-01-04-.01 - REPEALED

• TN Rules and Regs. 0465-01-04-.05 - 0465-01-04-.05 - REPEALED

• TN Rules and Regs. 0465-01-04-.07 - 0465-01-04-.07 - REPEALED

• TN Rules and Regs. 0465-01-04-.08 - 0465-01-04-.08 - REPEALED

• TN Rules and Regs. 0465-01-04-.09 - 0465-01-04-.09 - REPEALED

Utah

• Utah Admin. Code R156-78B-2 - R156-78B-2 - Definitions.

• Utah Admin. Code R380-250-1 - R380-250-1 - Authority and Purpose.

• Utah Admin. Code R380-250-3 - R380-250-3 - General Compliance.

• Utah Admin. Code R380-250-5 - R380-250-5 - Sanctions, Retaliation.

• Utah Admin. Code R380-250-6 - R380-250-6 - Waiver of Rights Prohibited.

• Utah Admin. Code R380-250-7 - R380-250-7 - Complaints.

• Utah Admin. Code R495-881-1 - R495-881-1 - Authority and Purpose.

• Utah Admin. Code R495-881-3 - R495-881-3 - General Compliance.

• Utah Admin. Code R495-881-5 - R495-881-5 - Sanctions, Retaliation.

• Utah Admin. Code R495-881-6 - R495-881-6 - Waiver of Rights Prohibited.

• Utah Admin. Code R495-881-7 - R495-881-7 - Complaints.

Vermont

• Vt. Code R. 21 010 016 - 21 010 016 - PRIVACY OF CONSUMER FINANCIAL AND HEALTH INFORMATION

• Vt. Code R. 21 020 053 - 21 020 053 - REGULATION IH-2001-01 - PRIVACY OF CONSUMER FINANCIAL AND HEALTH INFORMATION REGULATION

Virginia

• 12 Va. Admin. Code § 30-120-935 - 12VAC30-120-935 - Participation standards for specific covered services.

• 12 Va. Admin. Code § 35-105-870 - 12VAC35-105-870 - Paper and electronic records management policy.

• 12 Va. Admin. Code § 5-115-40 - 12VAC5-115-40 - Patient confidentiality.

• 8 Va. Admin. Code § 90-80-20 - 8VAC90-80-20 - Federal regulations adopted.

Washington

• Wash. Admin. Code § 246-10-405 - 246-10-405 - Protective orders.

• Wash. Admin. Code § 246-11-400 - 246-11-400 - Protective orders.

• Wash. Admin. Code § 246-341-0800 - 246-341-0800 - Involuntary and court-ordered—Noncompliance reporting for court-ordered substance use disorder treatment.

• Wash. Admin. Code § 246-815-166 - 246-815-166 - Patient record retention and accessibility requirements.

• Wash. Admin. Code § 250-82-050 - 250-82-050 - Exemptions.

• Wash. Admin. Code § 284-04-610 - 284-04-610 - Violation.

• Wash. Admin. Code § 284-04-625 - 284-04-625 - Security breach notification requirements.

• Wash. Admin. Code § 504-45-060 - 504-45-060 - Exemptions.

West Virginia

• WV Code Reg. 151-1-2 - §151-1-2 - Governance of the Plan.

Wisconsin

• Wis. Admin. Code DHS Sec. 35.08 - DHS 35.08 - Certification process

• Wis. Admin. Code DHS Sec. 35.23 - DHS 35.23 - Consumer file

• Wis. Admin. Code DHS Sec. 62.05 - DHS 62.05 - Intoxicated driver assessment facilities

Wyoming

• Health, Department of, Information Practices, Ch. 1 § 1 - Section 1 - Authority.

• Health, Department of, Information Practices, Ch. 1 § 10 - Section 10 - Maintenance of Records.