(1) The service provider must:

(a) Keep all client record information confidential;

(b) Ensure the department's right to have access to and copies of any records as requested or needed; and

(c) Provide access to and copies of client records to the client, or the client's legal representative upon their request.

(2) The service provider must have an authorized release of information form for any transfer or inspection of records, other than those specified in subsection (1) of this section. The authorization form must:

(a) Be specific to the type of information about the transfer or inspection; and

(b) Be signed by the client or client's legal representative.

(3) A signed release of information is valid for up to one year from the date of signature.