(1) The Department of Corrections Office of Health Services shall maintain a comprehensive medical file (including medical, dental and mental health components) on every person committed to the custody and care of the Department. Information included in the inmate’s medical file is protected health information and shall be used or disclosed in accordance with the Health Insurance Portability and Accountability Act Privacy Rule of 1996, (HIPAA) and Florida law. The Department of Corrections shall also maintain a comprehensive substance abuse file on every person inmate who receives substance abuse program services. Information included in the inmate’s substance abuse file is confidential in accordance with 42 C.F.R. Part II, the Health Insurance Portability and Accountability Act Privacy Rule of 1996 (HIPAA), and Florida law. The Department of Corrections’ Reception and Medical Center Hospital shall maintain an inpatient hospital medical file on every inmate admitted for care and treatment at Reception Medical Center Hospital.
    (2) Definitions.
    (a) Business Associate – refers to a person or entity who is not a member of the Department of Corrections’ workforce and who, on behalf of the department, performs a function or activity involving the use or disclosure of individually identifiable health information. A business associate agreement or contract requiring a business associate to appropriately safeguard protected health information is required from business associates.
    (b) Designated Records Set – refers to an inmate’s medical, mental health, and dental files, Reception Medical Center Hospital’s inpatient hospital file, and substance abuse clinical files that are maintained by the Department.
    (c) Department workforce – includes employees, volunteers, interns, trainees and other persons whose conduct, in the performance of work for the Department, is under the direct control of the Department, whether or not they are paid by the Department.
    (d) Disclose – refers to the release, transfer, provision of access to, or divulging in any other manner of information outside the Department.
    (e) Health Services Administrator – refers to designated Department employees responsible for working with the privacy officer to ensure that all Department privacy procedures are implemented.
    (f) Hospital file – as used in this rule refers to an inmate’s inpatient hospital patient records created and maintained by Reception Medical Center Hospital.
    (g) Medical file – as used in this rule refers to the inmate’s medical, mental health, and dental files maintained by the department.
    (h) Personal Representative – as used in this rule, means, with respect to a deceased inmate, a person appointed by a court to act as the personal representative, executor, administrator, curator, or temporary administrator of the deceased inmate’s estate, or if a court has not made such a judicial appointment, a person designated by the inmate to act as his or her personal representative in a last will that is self-proved under Florida Statutes § 732.503 In addition, if a court has not made a judicial appointment as described herein and the inmate has not designated a person in a self-proved last will, a personal representative also means one of the following individuals:
    1. A surviving spouse.
    2. If there is no surviving spouse, a surviving adult child of the inmate.
    3. If there is not surviving spouse or adult child, a parent of the inmate.
With respect to a living inmate, a personal representative means a health care surrogate, proxy, guardian, or other person with authority under Florida law to make decisions related to the inmate’s health care.
    (i) Privacy Officer – as used in this rule, refers to a designated employee in the Office of Health Services who is responsible for the development and implementation of the policies and procedures related to the HIPAA Privacy Rule. The privacy officer is the Department’s contact person for HIPAA.
    (j) Protected health information (PHI) – where used herein, refers to inmate or offender information that is created or received by the Department of Corrections, whether oral, recorded, transmitted, or maintained in any form or medium, that relates to the past, present, or future physical or mental health or condition of an inmate or offender, the provision of health care to an inmate or offender, or the past, present, or future payment for the provision of health care to an inmate or offender and identifies an inmate or offender or there is a reasonable basis to believe the information can be used to identify an inmate or offender.
    (k) Psychotherapy notes – refers to notes recorded by a mental health professional documenting or analyzing the contents of conversation during a private or group session. The term does not include medication prescription and monitoring, session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following: diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.
    (l) Substance abuse clinical file – refers to the department’s inmate file containing all written documents, records and forms compiled to detail an inmate’s substance abuse history, substance abuse screening, assessment, intervention, and other substance abuse services, including the results of urinalysis testing done for treatment, program participation, and admission and discharge summaries.
    (m) Substance abuse progress notes – refers to notes recorded by a substance abuse health care professional documenting or analyzing the contents of conversation during a private or group session. The term does not include session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following: diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.
    (n) Use – refers to, with respect to protected health information, the sharing, employment, application, utilization, examination, or analysis of such information within the Department.
    (3) Inmate and offender access to their own protected health information in a designated records set.
    (a) Except as otherwise provided in this rule, an inmate shall be allowed to have access to his or her own protected health information contained in a designated records set. An inmate desiring access to his or her own medical file or Reception Medical Center hospital file shall submit a written request using Form DC6-236, Inmate Request, to the health services administrator or his or her designee. An inmate desiring access to his own substance abuse clinical file shall submit a written request using DC6-236, Inmate Request, to the substance abuse program manager or his or her designee. Form DC6-236 is incorporated by reference in Fl. Admin. Code R. 33-103.005
    (b) The department does not maintain medical files or substance abuse clinical files on offenders under community supervision. Access to records maintained by treatment providers under contract with the department should be requested by contacting the treatment provider.
    (c)1. Inmates shall have no access to psychotherapy notes or substance abuse progress notes maintained in the department’s records.
    2. Inmates shall have no access to protected health information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.
    3. Inmates shall have no access to protected health information maintained by the Department that is subject to the Clinical Laboratory Improvements Amendments of 1988, 42 U.S.C. § 263a, to the extent that the provision of access to the inmate is prohibited by law, or is exempt from the Clinical Laboratory Improvement Amendments of 1988, pursuant to 42 C.F.R. § 493.3(a)(2).
    (d) An inmate’s request for access shall be denied in whole or in part due to any of the following reasons:
    1. The request is for records or information identified in paragraph (c), above.
    2. The request is for protected health information that was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would with reasonable likelihood reveal the source of the information.
    3. The request is for information not maintained or no longer maintained by the department in its files.
    4. There has been a determination by a licensed or certified health care professional that:
    a. The requested access is reasonably likely to endanger the life or physical safety of the inmate or another person;
    b. The requested access is to protected health information that makes reference to another person (other than a health care provider) and such access is reasonably likely to cause substantial harm to such other person; or
    c. The access is requested by a personal representative of the inmate and such access is likely to cause substantial harm to the inmate.
    (e) Except as otherwise provided in this rule, all requests shall be granted, including providing access or copies or both, or denied, in whole or in part, by the health services administrator or his designee or substance abuse program manager or his designee in writing within 30 days of the date of receipt of the request. However, if the requested files are not maintained on-site, the department shall provide or deny access, in whole or in part, within 60 days from receipt of the request. If the department is unable to grant or deny, in whole or in part, the request for access within the 30 or 60 day time periods, the department is authorized to extend the time for such action an additional 30 days by providing the inmate a written statement that the time period has been extended for 30 days and the reason(s) for the extension. This extension is available only one time.
    (f) Denials must provide:
    1. The basis for the denial;
    2. Information on where the requested information is maintained if subparagraph (d)3. applies, and the department knows where the information is maintained;
    3. Notification that the inmate may request a review of a denial based on subparagraph (d)4., by submitting a written request to the health services administrator or his or her designee in the case of medical files, or the substance abuse program manager or his or her designee in the case of substance abuse clinical files; and,
    4. That the inmate may grieve the denial through the inmate grievance process pursuant to chapter 33-103, F.A.C.
    5. Upon written request of the inmate to the staff member designated above, denials based on subparagraph (d)4., shall be reviewed by a licensed or certified health care professional who is designated by the health services administrator or his or her designee or substance abuse program manager or his or her designee, and who did not participate in the original decision to deny the request. Review of the denial must be completed within a reasonable time after receipt of the request for review. Immediately upon determination on review, the inmate shall be notified in writing of the decision.
    (g) Where a request for access to an inmate’s medical file or substance abuse clinical file is denied in part, the department shall provide access to the requested file after excluding the information for which access was denied.
    (h) Providing Access:
    1. Before any inmate reviews his or her medical file or substance abuse clinical file the Department will verify the inmate’s identity using the inmate’s ID card.
    2. Medical and hospital files and substance abuse clinical files must be reviewed in a secure area in the presence of health record staff or the health service administrator.
    3. No information shall be copied or removed from the file by the inmate at the time of the review. Form DC6-236, Inmate Request, shall be submitted by the inmate to obtain any copies.
    (i) Copies will be provided upon receipt of payment as provided in subsection 33-601.901(2), F.A.C., except that when providing the inmate a copy of the requested information would jeopardize either the health, safety, security, custody of the inmate or of other inmates; or the safety of any officer, employee, or other person at the correctional institution or a person responsible for the transporting of the inmate, no copies shall be provided. A denial of copies on this basis shall not be subject to review under subparagraph (3)(f)3., above.
    (4) Requesting Restrictions on the Use and Disclosure of Protected Health Information in a designated records set.
    (a) An inmate may request that the Department restrict the uses and disclosures of his or her protected health information to carry out treatment, payment, health care operations, and for notification for involvement in the inmate’s care. Inmates shall submit requests for restrictions on Form DC6-236, Inmate Request, to the health services administrator and provide a reason to support the requested restriction.
    (b) In accordance with 45 C.F.R. § 164.522 the Department is not required to agree to a request for restriction and the Department shall not restrict disclosures of protected health information to other government agencies providing benefits or services to the inmate, to government agencies that oversee health care providers, or that are required by law.
    (c) The Department shall notify the inmate of the denial or acceptance of the request to restrict information and a copy of the notice of denial or acceptance shall be filed in the inmate’s designated record set and sent to other workforce members with a need to know. The written request and notification of denial or acceptance must be kept for six years from the date it was created or the date it was last in effect, whichever is later.
    (d) If the Department agrees to the restriction, the Department and its business associates shall honor the restriction unless the inmate is in need of emergency treatment and the restricted information is needed to provide the emergency treatment. If restricted information is disclosed to a health care provider for emergency treatment, the Department shall request that the health care provider not further use or disclose the information.
    (e) The Department shall terminate its agreement to a restriction, if:
    1. The inmate agrees to or requests the termination in writing;
    2. The inmate orally agrees to the termination and the oral agreement is documented; or
    3. The Department informs the inmate that it is terminating its agreement to a restriction. The termination is only effective for protected health information created or received after the Department informed the inmate of the termination.
    (5) Requesting Confidential Communications.
    (a) An inmate or offender may request that the Department communicate protected health information with him or her by alternative means or at alternative locations. Inmates must make requests for confidential communication in writing on Form DC6-236, Inmate Request. The Department shall refuse an inmate’s request if the inmate has not specified a reasonable method of communication or if the request would jeopardize or disrupt the safety, security or operations of the institution. The health services administrator shall notify the inmate that the request for confidential communication was denied or accepted.
    (b) The Department shall retain the inmate’s request and notification of denial or acceptance for a minimum of six years in the inmate’s medical file.
    (6) Request to amend protected health information in a designated record set.
    (a) An inmate may request that the Department amend a designated record set for as long as the Department maintains the protected health information in the designated record set. Inmates shall make requests for amendments in writing on Form DC6-236, Inmate Request, and provide a reason to support the requested amendment.
    (b) In accordance with 45 C.F.R. § 164.526, the Department shall act on the inmate’s request for an amendment no later than 60 days after receipt of the request. If the Department is unable to act on the amendment within 60 days, the Department may extend the time by no more than 30 days, provided that within 60 days, the Department provided the inmate with a written statement of the reasons for the delay and the date by which the Department will complete its action on the request. The Department shall have one time extension for action on the request.
    (c) If the Department is informed by another health care provider of an amendment to an inmate’s protected information, the Department shall amend the protected information in its designated record sets.
    (d) Pursuant to 45 C.F.R. § 164.526, the Department shall deny an inmate’s request for an amendment to protected health information if it determines that the protected information:
    1. Was not created by the Department, unless the inmate provides a reasonable basis to believe that the originator of protected information is no longer available to act on the requested amendment;
    2. Is not part of the designated record set;
    3. Is information that is not available for inspection by the inmate as provided in subsection (3), above; or
    4. Is accurate and complete.
    (e) If the Department denies the requested amendment, in whole or in part, the Department shall send the inmate a written denial notice, in plain language that contains:
    1. The basis for the denial;
    2. The inmate’s right to submit a written statement disagreeing with the denial and how the inmate may submit such a statement on Form DC6-236, Inmate Request;
    3. A statement that if the inmate does not submit a statement of disagreement, the inmate may request that the Department provide the inmate’s request for amendment and the denial with any future disclosures of the protected information that is the subject of the amendment; and,
    4. A description of how the inmate may complain through the inmate grievance process.
    (f) The Department shall permit the inmate to submit a written statement disagreeing with the denial of all or part of a requested amendment and the basis of such disagreement. The statement of disagreement is limited to 100 words. The Department shall prepare and submit a written rebuttal to the statement of disagreement.
    (g) The Department shall identify the protected health information in the designated record set that is the subject of the disputed amendment and append the inmate’s request for an amendment, the Department’s denial of the request, the inmate’s statement of disagreement, if any, and the Department’s rebuttal, if any, in the designated record set.
    (h) When a subsequent disclosure of the protected health information is made, the Department shall submit the material required in paragraph (g), with the requested protected health information.
    (i) If the Department accepts the requested amendment, in whole or in part, the Department shall comply with the following requirements:
    1. The Department shall make the amendment to the designated records set by identifying the portions in the record that are affected by the amendment and appending or otherwise providing a link to the location of the amendment.
    2. The Department shall inform the inmate that the amendment is accepted and obtain the inmate’s identification of, and agreement to have the Department notify relevant persons with which the amendment needs to be shared as described below within 60 days.
    3. The Department shall make reasonable efforts to inform and provide the amendment within a reasonable time to:
    a. Persons identified by the inmate as having received protected information about the inmate and needing the amendment; and,
    b. Persons, including business associates, that the Department knows have the protected information that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to the detriment of the inmate.
    (7) Request for Accounting of Disclosures.
    (a) Inmates may request that the Department provide them with an accounting of disclosures of protected health information.
    (b) Inmates shall make requests for an accounting of disclosures on Form DC6-236, Inmate Request to the health services administrator.
    (c) Pursuant to 45 C.F.R. § 164.528 the Department shall provide the accounting of disclosures within 60 days of the request. If the Department is unable to provide the accounting within 60 days, it shall inform the inmate of the reason for the delay and when it expects to provide the accounting. One extension of 30 days is permitted per request. Inmates may request an accounting of disclosures for up to six years prior to the date on which the accounting is requested. Disclosures made prior to April 14, 2003 are excluded from this requirement.
    (d) The Department shall provide the inmate with a written account that includes the following information:
    1. The date of the disclosure;
    2. The name and address of the entity or person who received the protected health information;
    3. A brief description of the protected health information disclosed; and,
    4. A brief statement of the purpose of the disclosure or a copy of a written request from the entity or person that received the protected information.
    (e) The accounting of disclosures is not required to contain the following disclosures of protected health information:
    1. Disclosures for the purpose of treatment, payment and health care operations;
    2. Disclosures to law enforcement or correctional officers for the health and safety of the inmate, other inmates, officers, employees of the correctional institution or others at the correctional institution;
    3. Disclosures to law enforcement on the premises of the correctional institutions;
    4. Disclosures for the administration and maintenance of the safety, security, and good order of the correctional institution;
    5. Disclosures for national security or intelligence purposes;
    6. Disclosures made to inmates of their own protected information;
    7. Disclosures made as part of a limited data set;
    8. Disclosures made to third parties pursuant to the inmate’s request written authorization; and,
    9. Disclosures made prior to April 14, 2003.
    (f) If the Department made multiple disclosures of protected information to the same entity for a single purpose, the accounting for a given period of time shall provide:
    1. The required information listed above for the first disclosure; and,
    2. The frequency, periodicity, or number of disclosures made; and the date of the last disclosure.
    (g) The Department shall provide the first accounting to an inmate in any 12-month period without charge.
    (h) If the second or subsequent request for disclosure within a 12-month period requires duplication, the inmate shall pay the cost of duplication in accordance with subsection 33-601.901(2), F.A.C., and the inmate will sign a receipt for such copies.
    (i) The Department shall document the following information regarding accounting of disclosures:
    1. The date of disclosure;
    2. The information listed in the accounting;
    3. Written accounting that is provided to the inmate; and,
    4. The titles and names of the people who were responsible for receiving and processing the request.
    (j) The documentation shall be retained for six years.
    (k) The Department shall track disclosures other than for treatment, payment and health care operations. This includes the following disclosures even if the disclosure was to a business associate. The Department shall track disclosures:
    1. To other government agencies providing benefits or services to the inmate;
    2. To government agencies that oversee health care providers;
    3. For research; and,
    4. Which are required by law.
    (l) The following specific information about each disclosure shall be included and documented in the medical file on Form DC4-534, Health Care Information Request Record. Form DC4-534 is hereby incorporated by reference. Copies of the form are available from the Forms Control Administrator, 501 South Calhoun Street, Tallahassee, Florida 32399-2500, http://www.flrules.org/Gateway/reference.asp?No=Ref-02949. The effective date of this form is 4-15-10.
    1. The date of the disclosure;
    2. The name and address of the entity or person who received the protected information;
    3. A brief description of the protected health information disclosed;
    4. A brief statement of the purpose of the disclosure; and,
    5. Written account that was provided to the inmate.
    (m) In accordance with 45 C.F.R. § 164.528, the Department shall temporarily suspend an inmate’s right to receive an accounting of disclosures to a health care oversight agency with authority by law to oversee the health care system of the department or a law enforcement official upon written statement from the oversight agency or law enforcement official. The written statement shall specify that the accounting to the inmate would be reasonably likely to impede the agency or official’s activities and the time period for which such suspension is required.
    (n) Although the accounting of disclosures is not released during a suspension, the Department shall continue tracking and storing the information for future releases.
    (8) Each Department workforce member and the Department’s business associates shall maintain as confidential all medical, mental health, dental and substance abuse information, regarding any inmate or offender that the employee obtains in conjunction with his or her duties and responsibilities, and shall not disseminate the information or discuss the medical, mental health, dental, or substance abuse condition of the inmate or offender with any person except persons directly necessary to the performance of the Department workforce member’s or business associate’s duties and responsibilities. Workforce members of the healthcare, mental health treatment or substance abuse treatment team shall not disseminate inmate medical, mental health, or substance abuse information or discuss the medical, dental, mental health, or substance abuse condition of an inmate with any person except other members of the healthcare team, mental health treatment team, or substance abuse treatment team, release officers or any other employees designated to facilitate continuity of care and treatment upon reentry, officers responsible for transporting inmates, upper level management at the institution or facility level, regional level and central office level, inspectors from the Inspector General’s Office if related to law enforcement on the premises of a correctional institution, classification or security staff if related to maintenance of the safety, security and good order of the correctional institution, department attorneys, or other employees and persons authorized to receive such information in accordance with the Health Insurance Portability and Accountability Act Privacy Rule of 1996, (HIPAA) and Florida law. Breach of this confidentiality shall subject employees of the Department to disciplinary action. Each employee shall acknowledge receipt and review of Form DC2-813, Acknowledgement of Responsibility to Maintain Confidentiality of Medical Information, indicating that he understands the medical and substance abuse confidentiality requirements. Form DC2-813 is hereby incorporated by reference. Copies of the form are available from the Forms Control Administrator, 501 South Calhoun Street, Tallahassee, Florida 32399-2500, http://www.flrules.org/Gateway/reference.asp?No=Ref-02946. The effective date of this form is 8-13.
    (9) Each inmate assigned as an inmate worker, inmate assistant, substance abuse peer facilitator, or other assignment involving possible contact with health or substance abuse information about other inmates shall maintain as confidential all health or substance abuse information that he sees or hears while performing his duties and responsibilities, and shall not disseminate the information or discuss the medical or substance abuse information with any person except health care staff or substance abuse program staff. Failure to keep health or substance abuse information confidential and private shall subject the inmate to disciplinary action. Each inmate assigned as an inmate worker, inmate assistant, substance abuse peer facilitator, or other assignment involving possible contact with health or substance abuse information about other inmates shall acknowledge receipt and review of Form DC1-206, Inmate Acknowledgement of Responsibility to Maintain Confidentiality of Health or Substance Abuse Information, indicating that he understands the medical and substance abuse confidentiality requirements. Form DC1-206 is hereby incorporated by reference. Copies of the form are available from the Forms Control Administrator, 501 South Calhoun Street, Tallahassee, Florida 32399-2500, http://www.flrules.org/Gateway/reference.asp?No=Ref-02948. The effective date of this form is 4-15-10.
    (10) Use and disclosure of protected health information.
    (a) Inmate protected health information shall be used or disclosed in accordance with the Health Insurance Portability and Accountability Act Privacy Rule of 1996 (HIPAA), and Florida law.
    (b) Requests for access to a current inmate’s medical file shall be submitted to the health services administrator at the institution where the inmate is housed. Requests for access to a former inmate’s medical file shall be submitted to: Statewide Record Retention Center, Attention: Inactive Medical Records, 7819 N.W. 228th Street, Raiford, Florida 32083. Requests for access to an inmate’s hospital file shall be submitted to: Reception and Medical Center Hospital, Attention: Hospital Administrator, P.O. Box 628, Lake Butler, Florida 32054.
    (c) All requests for access to an inmate’s protected health information shall be specific and in writing.
    (d) If use or disclosure of an inmate’s protected health information is not otherwise permitted by law, an inmate must authorize the use or disclosure by giving written consent using Form DC4-711B, Consent and Authorization for Use and Disclosure Inspection and Release of Confidential Information, or Form DC4-711Bsp, its Spanish-language version, or a HIPAA compliant release of protected health information form from another governmental agency. Form DC4-711B and Form DC4-711Bsp are incorporated by reference in Fl. Admin. Code R. 33-601.901
    (e) Form DC4-711B, DC4-711Bsp, or any other authorization used for these purposes shall be submitted with the written request for access to an inmate’s protected health information. A copy of the authorization shall be provided to the inmate and the inmate shall acknowledge receipt of the copy by signing in the appropriate location on the authorization. The authorization and acknowledgement of receipt of copy shall become a part of the inmate’s medical file.
    (f) Form DC4-711B, DC4-711Bsp, or any other authorization used for these purposes must be notarized unless witnessed by a member of the Department’s workforce. All authorization forms shall be witnessed by at least one person who can verify the fact that he witnessed the signing of the authorization by the inmate and that, to the best of his knowledge, the inmate knew what was signed.
    (g) A disclosure of protected health information may not be made on the basis of an authorization which:
    1. Has expired;
    2. On its face substantially fails to conform to any of the requirements of the Health Insurance Portability and Accountability Act Privacy Rule of 1996;
    3. Is known to have been revoked; or
    4. Is known, or through a reasonable effort could be known, by the person holding the records to be materially false.
    (h) In accordance with 45 C.F.R. § 164.502 and Florida law, a personal representative of a deceased inmate shall have access to or may authorize the disclosure of the deceased inmate’s protected health information that is relevant to the personal representative’s legal authority to act on behalf of the deceased inmate or the deceased inmate’s estate.
    1. The Department shall verify and document the authority of the personal representative to serve in that capacity. All requests for access to a deceased inmate’s protected health information shall be in writing and accompanied with documentation demonstrating the authority of the personal representative to serve in such capacity as specified in paragraph (2)(h), herein.
    2. If the request is made by a person appointed by a court to act as the personal representative, an executor, an administrator, a curator, or a temporary administrator of the deceased inmate’s estate, accompanying documentation shall include a copy of the letter of administration and a copy of the court order appointing such person as the representative of the inmate’s estate.
    3. If the request is made by a person designated by the inmate to act as his or her personal representative in a last will that is self-proved, accompanying documentation shall include a copy of the self-proved last will designating the person as the inmate’s representative.
    4. If the request is made by a surviving spouse, a surviving adult child of the inmate, or a parent of the inmate, accompanying documentation shall include a letter from the person’s attorney verifying the person’s relationship to the inmate and the absence of a court-appointed representative and self-proved last will.
    5. To authorize the disclosure of the deceased inmate’s protected health information, Form DC4-711B, Consent and Authorization for Use and Disclosure Inspection and Release of Confidential Information must be signed by a personal representative.
    (i) In accordance with 45 C.F.R. § 164.502, a personal representative of a living inmate shall have access to or authorize the disclosure of the inmate’s protected health information that is relevant to the personal representative’s legal authority to make health care decisions on behalf of the inmate. Form DC4-711B, Form DC4-711Bsp, or any other authorization used for these purposes shall be signed by the inmate or the inmate’s personal representative in accordance with Florida law. In accordance with 45 C.F.R. § 164.514(h)(1), the Department shall verify and document the authority of the personal representative to serve in that capacity.
    (j) In addition to the access described above, in accordance with Florida Statutes § 395.3025, an inmate’s guardian, curator, personal representative, or in the absence of one of those persons, next of kin of a decedent or the parent of a minor, shall have access to the protected health information contained in an inmate’s hospital file created and maintained by the Reception Medical Center Hospital after the discharge of the inmate.
    (k) In accordance with 45 C.F.R. § 164.514(h), the Department shall verify the identity and the authority of a person requesting access to an inmate’s protected health information if the identity or authority of such person is not known.
    (l) No information concerning test results, or other protected health information, shall be released over the telephone without proper verification that the caller is the person authorized to receive such information. All calls requesting the disclosure of protected health information over the telephone shall be forwarded to the Chief Health Officer, the Nursing Supervisor or their designees.
    (m) Copies of protected health information will be provided upon receipt of payment as provided in subsection 33-601.901(2), F.A.C.
Rulemaking Authority 944.09, 945.10 FS. Law Implemented 119.07, 395.3025, 944.09, 945.10, 945.25, 945.6034 FS. History-New 4-15-10, Amended 8-6-13, 5-25-16, 7-15-18.