2.19—Disposition of records by discontinued programs.
(a) General.
If a program discontinues operations or is taken over or acquired by another program, it must purge patient identifying information from its records or destroy the records unless—
(1)
The patient who is the subject of the records gives written consent (meeting the requirements of § 2.31) to a transfer of the records to the acquiring program or to any other program designated in the consent (the manner of obtaining this consent must minimize the likelihood of a disclosure of patient identifying information to a third party); or
(2)
There is a legal requirement that the records be kept for a period specified by law which does not expire until after the discontinuation or acquisition of the program.
(b) Procedure where retention period required by law.
If paragraph (a)(2) of this section applies, the records must be:
(1)
Sealed in envelopes or other containers labeled as follows: “Records of [insert name of program] required to be maintained under [insert citation to statute, regulation, court order or other legal authority requiring that records be kept] until a date not later than [insert appropriate date]”; and
(2)
Held under the restrictions of these regulations by a responsible person who must, as soon as practicable after the end of the retention period specified on the label, destroy the records.