Conditions of Participation · 42 CFR Part 484
§484.40 Condition of participation: Release of patient identifiable OASIS information.
The regulation text and CMS’s interpretive guidelines for every survey tag under this condition, quoted from the State Operations Manual, Appendix B (Rev. 245).
§484.40 Condition of participation: Release of patient identifiable OASIS information.
On the 2567: Release Of Patient Identifiable Oasis Info.
The HHA and agent acting on behalf of the HHA in accordance with a written contract must ensure the confidentiality of all patient identifiable information contained in the clinical record, including OASIS data, and may not release patient identifiable OASIS information to the public.
CMS’s guidance for this tag
Interpretive Guidelines §484.40
An agent acting on behalf of the HHA is a person or organization, other than an employee of the agency that performs certain functions on behalf of, or provides certain services under contract or arrangement. HHAs often contract with specialized software vendors to submit OASIS data and are commonly referred to by the HHA as the Third-Party vendor.
HHAs and their agents must develop and implement policies and procedures to protect the security of all patient identifiable information contained in electronic format that they create, receive, maintain, and transmit. The agreements between the HHA and OASIS vendors must address policies and procedures to protect the security of such electronic records in order to: • Ensure the confidentiality, integrity, and availability of all electronic records they create, receive, maintain, or transmit; • Identify and protect against reasonably anticipated threats to the security or integrity of the electronic records; • Protect against reasonably anticipated, impermissible uses or disclosures; and, • Ensure compliance by their workforce
The HHA is ultimately responsible for compliance with these confidentiality requirements and is the responsible party if the agent does not meet the requirements. (See also §484.50(c)(6) Patient Rights)
(Rev. 219; Issued: 04-12-24; Effective: 04-12-24; Implementation: 04-12-24)
Current CFR text, 42 CFR 484.40 as revised 2025-10-01 (govinfo)
§ 484.40 Condition of participation: Release of patient identifiable OASIS information.
The HHA and agent acting on behalf of the HHA in accordance with a written contract must ensure the confidentiality of all patient identifiable information contained in the clinical record, including OASIS data, and may not release patient identifiable OASIS information to the public.
Read with this
Source: State Operations Manual, Appendix B - Guidance to Surveyors: Home Health Agencies (Rev. 245, issued 08-05-26), text extracted from the PDF with pdftotext, retrieved 2026-10-09, and 42 CFR Part 484, annual edition revised as of October 1, 2025 (govinfo XML granules). Works of the US Government are in the public domain.
The monthly home health regs digest
What CMS changed, what's due next, and what to do about it — one email a month, no fluff. Read the first issue