The administrator shall ensure that the facility develops and implements written policies and procedures concerning patients’ rights and responsibilities, including but not limited to: The opportunity to participate in planning their medical treatment; and Confidentiality of medical records and the right to approve or refuse release of records to any individual outside the facility, except as provided by federal or State law.