Oklahoma Administrative Code › Title 340 - Department of Human Services › Chapter 100 - Developmental Disabilities Services › Subchapter 3 - Administration › Part 3 - ADMINISTRATION › Section 340:100-3-40 - Community records

Current through Vol. 41, No. 20, July 1, 2024
(a)
Purpose.
Oklahoma Administrative Code (OAC)
				  340:100-3-40 sets forth
				  requirements for:
(1) contract provider
				  records maintenance;
(2) document
				  transfer to a history file for service recipient records the contract provider
				  maintains;
(3) information transfer
				  when a service recipient changes contract providers;
(4) maintenance of an official electronic
				  record for each service recipient receiving services through a Home and
				  Community Based Services waiver.
(A) All
				  service recipient information and records are confidential and released only to
				  individuals or provider agencies who have proper authorization from the service
				  recipient or his or her legal representative.
(B) It is the legal responsibility of
				  Oklahoma Human Services (OKDHS) employees and contract providers to protect
				  clients' privacy and to ensure the protection of confidential
				  information.
(C) Developmental
				  Disabilities Services (DDS) ensures service-recipient records are protected
				  from loss, defacement, tampering, destruction, and violation of
				  confidentiality.
(D) DDS personnel
				  obtain individualized, time-limited, informed consent, prior to securing
				  service recipient information or records from provider agencies who do not have
				  a current OKDHS contract; and
(5) formatting, use, and retention of
				  electronic records and signatures generated, sent, communicated, received, or
				  stored by DDS, in conformity with the Uniform Electronic Transaction Act, found
				  at Section
				  15-101 et seq. of Title 12A of the
				  Oklahoma Statutes (12A O.S. §§ 15-101 et seq.).
(A) Only individual providers or employees
				  designated by the provider's agency may make entries in the member's record.
				  All entries in the member's record must be dated and authenticated with a
				  method established to identify the author. The identification method may
				  include computer keys, Private/Public Key Infrastructure (PKIs), voice
				  authentication systems that use a personal identification number (PIN) and
				  voice authentication, or other codes. Providers must have a process in place to
				  deactivate within one working day an employee's access to records upon
				  termination of employment of the designated employee.
(B) When PKIs, computer key codes, voice
				  authentication systems, or other codes are used, the provider agency's employee
				  completes a signed statement documenting that the chosen method is under the
				  sole control of the person using it and further demonstrate that:
(i) a list of PKIs, computer key codes, voice
				  authentication systems or other codes can be verified;
(ii) all adequate safeguards are maintained
				  to protect against improper or unauthorized use of PKIs, computer keys, or
				  other codes for electronic signatures; and
(iii) sanctions are in place for improper or
				  unauthorized use of computer key codes, PKIs, voice authentication systems or
				  other code types of electronic signatures.
(C) There must be a specific action by the
				  author to indicate that the entry is verified and accurate. Systems requiring
				  an authentication process include, but are not limited to:
(i) computerized systems that require the
				  provider's employee to review the document online and indicate that it has been
				  approved by entering a unique computer key code capable of
				  verification;
(ii) a system in
				  which the provider's employee signs off against a list of entries that must be
				  verified in the member's records;
(iii) a mail system that sends transcripts to
				  the provider's employee for review;
(iv) a postcard identifying and verifying the
				  accuracy of the record(s) signed and returned by the provider's employee;
				  or
(v) a voice authentication
				  system that clearly identifies the author by a designated PIN or security
				  code.
(D)
				  Auto-authentication systems that authenticate a report prior to the
				  transcription process do not meet the stated requirements and are not an
				  acceptable method for the authentication process.
(E) The signature and date entry are the
				  authentication of an electronic record and are expected on the day the record
				  is completed.
(F) The individual
				  provider or designated administrators within the provider agency may edit
				  records. Edits must be in the form of a correcting entry which preserves
				  entries from the original record. Edits must be completed prior to claims
				  submission or no later than 45-calendar days after the date of service,
				  whichever occurs first.
(G) Use of
				  the electronic signature for documentation constitutes a signature and has the
				  same effect as a written signature on the documentation. The section of the
				  electronic record documenting the service provided must be authenticated by the
				  employee or individual who provided the described service
(H) Any authentication method for electronic
				  signatures must:
(i) be unique to the person
				  using it;
(ii) identify the
				  individual signing the document by name and title;
(iii) be capable of verification, assuring
				  that the documentation cannot be altered after the signature has been
				  affixed;
(iv) be under the sole
				  control of the person using it;
(v)
				  be linked to the data in such a manner that if the data is changed, the
				  signature is invalidated; and
(vi)
				  provide strong and substantial evidence that make it difficult for the signer
				  to claim that the electronic representation is not valid.
(I) Failure to properly maintain or
				  authenticate records with the signature and date entry may result in the denial
				  or recoupment of payments.
(J)
				  Providers must retain electronic records and have access to the records per
				  guidelines found at OAC
				  317:30-3-15.
(K) The provisions of the Electronic
				  Transaction Act apply to the time and place of sending and receipt. When a
				  power failure, internet interruption, or internet virus occur, confirmation by
				  the receiving party is required to establish receipt.
(L) Any person who fraudulently represents
				  facts in an electronic transaction, acts without authority, or exceeds his or
				  her authority to perform an electronic transaction may be prosecuted under all
				  applicable criminal and civil laws.