[Code of Federal Regulations]
[Title 42, Volume 1, Parts 1 to 399]
[Revised as of October 1, 1997]
From the U.S. Government Printing Office via GPO Access
[CITE: 42CFR2]
[Page 7-26]
TITLE 42--PUBLIC HEALTH
CHAPTER I--PUBLIC HEALTH SERVICE, DEPARTMENT OF HEALTH AND HUMAN SERVICES
PART 2--CONFIDENTIALITY OF ALCOHOL AND DRUG ABUSE PATIENT RECORDS
Subpart A--Introduction
Sec.
2.1 Statutory authority for confidentiality of drug abuse patient
records.
2.2 Statutory authority for confidentiality of alcohol abuse patient
records.
2.3 Purpose and effect.
2.4 Criminal penalty for violation.
2.5 Reports of violations.
Subpart B--General Provisions
2.11 Definitions.
2.12 Applicability.
2.13 Confidentiality restrictions.
2.14 Minor patients.
2.15 Incompetent and deceased patients.
2.16 Security for written records.
2.17 Undercover agents and informants.
2.18 Restrictions on the use of identification cards.
2.19 Disposition of records by discontinued programs.
2.20 Relationship to State laws.
2.21 Relationship to Federal statutes protecting research subjects
against compulsory disclosure of their identity.
2.22 Notice to patients of Federal confidentiality requirements.
2.23 Patient access and restriction on use.
Subpart C--Disclosures With Patient's Consent
2.31 Form of written consent.
2.32 Prohibition on redisclosure.
2.33 Disclosures permitted with written consent.
2.34 Disclosures to prevent multiple enrollments in detoxification and
maintenance treatment programs.
2.35 Disclosures to elements of the criminal justice system which have
referred patients.
Subpart D--Disclosures Without Patient Consent
2.51 Medical emergencies.
2.52 Research activities.
2.53 Audit and evaluation activities.
Subpart E--Court Orders Authorizing Disclosures and Use
2.61 Legal effect of order.
2.62 Order not applicable to records disclosed without consent to
researchers, auditors and evaluators.
2.63 Confidential communications.
2.64 Procedures and criteria for orders authorizing disclosures for
noncriminal purposes.
2.65 Procedures and criteria for orders authorizing disclosure and use
of records to criminally investigate or prosecute patients.
2.66 Procedures and criteria for orders authorizing disclosure and use
of records to investigate or prosecute a program or the person
holding the records.
2.67 Orders authorizing the use of undercover agents and informants to
criminally investigate employees or agents of a program.
Authority: Sec. 408 of Pub. L. 92-255, 86 Stat. 79, as amended by
sec. 303 (a), (b) of Pub L. 93-282, 83 Stat. 137, 138; sec. 4(c)(5)(A)
of Pub. L. 94-237, 90 Stat. 244; sec. 111(c)(3) of Pub. L. 94-581, 90
Stat. 2852; sec. 509 of Pub. L. 96-88, 93 Stat. 695; sec. 973(d) of Pub.
L. 97-35, 95 Stat. 598; and transferred to sec. 527 of the Public Health
Service Act by sec. 2(b)(16)(B) of Pub. L. 98-24, 97 Stat. 182 and as
amended by sec. 106 of Pub. L. 99-401, 100 Stat. 907 (42 U.S.C. 290ee-3)
and sec. 333 of Pub. L. 91-616, 84 Stat. 1853, as amended by sec. 122(a)
of Pub. L. 93-282, 88 Stat. 131; and sec. 111(c)(4) of Pub. L. 94-581,
90 Stat. 2852 and transferred to sec. 523 of the Public Health Service
Act by sec. 2(b)(13) of Pub. L. 98-24, 97 Stat. 181 and as amended by
sec. 106 of Pub. L. 99-401, 100 Stat. 907 (42 U.S.C. 290dd-3), as
amended by sec. 131 of Pub. L. 102-321, 106 Stat. 368, (42 U.S.C. 290dd-
2).
Source: 52 FR 21809, June 9, 1987, unless otherwise noted.
Subpart A--Introduction
Sec. 2.1 Statutory authority for confidentiality of drug abuse patient
records.
The restrictions of these regulations upon the disclosure and use of
drug abuse patient records were initially authorized by section 408 of
the Drug Abuse Prevention, Treatment, and Rehabilitation Act (21 U.S.C.
1175). That section as amended was transferred by Pub. L. 98-24 to
section 527 of the Public Health Service Act which is codified
[[Page 8]]
at 42 U.S.C. 290ee-3. The amended statutory authority is set forth
below:
Sec. 290ee-3. Confidentiality of patient records.
(a) Disclosure authorization
Records of the identity, diagnosis, prognosis, or treatment of any
patient which are maintained in connection with the performance of any
drug abuse prevention function conducted, regulated, or directly or
indirectly assisted by any department or agency of the United States
shall, except as provided in subsection (e) of this section, be
confidential and be disclosed only for the purposes and under the
circumstances expressly authorized under subsection (b) of this section.
(b) Purposes and circumstances of disclosure affecting consenting
patient and patient regardless of consent
(1) The content of any record referred to in subsection (a) of this
section may be disclosed in accordance with the prior written consent of
the patient with respect to whom such record is maintained, but only to
such extent, under such circumstances, and for such purposes as may be
allowed under regulations prescribed pursuant to subsection (g) of this
section.
(2) Whether or not the patient, with respect to whom any given
record referred to in subsection (a) of this section is maintained,
gives his written consent, the content of such record may be disclosed
as follows:
(A) To medical personnel to the extent necessary to meet a bona fide
medical emergency.
(B) To qualified personnel for the purpose of conducting scientific
research, management audits, financial audits, or program evaluation,
but such personnel may not identify, directly or indirectly, any
individual patient in any report of such research, audit, or evaluation,
or otherwise disclose patient identities in any manner.
(C) If authorized by an appropriate order of a court of competent
jurisdiction granted after application showing good cause therefor. In
assessing good cause the court shall weigh the public interest and the
need for disclosure against the injury to the patient, to the physician-
patient relationship, and to the treatment services. Upon the granting
of such order, the court, in determining the extent to which any
disclosure of all or any part of any record is necessary, shall impose
appropriate safeguards against unauthorized disclosure.
(c) Prohibition against use of record in making criminal charges or
investigation of patient
Except as authorized by a court order granted under subsection
(b)(2)(C) of this section, no record referred to in subsection (a) of
this section may be used to initiate or substantiate any criminal
charges against a patient or to conduct any investigation of a patient.
(d) Continuing prohibition against disclosure irrespective of status
as patient
The prohibitions of this section continue to apply to records
concerning any individual who has been a patient, irrespective of
whether or when he ceases to be a patient.
(e) Armed Forces and Veterans' Administration; interchange of
records; report of suspected child abuse and neglect to State or local
authorities
The prohibitions of this section do not apply to any interchange of
records--
(1) within the Armed Forces or witrhin those components of the
Veterans' Administration furnishing health care to veterans, or
(2) between such components and the Armed Forces.
The prohibitions of this section do not apply to the reporting under
State law of incidents of suspected child abuse and neglect to the
appropriate State or local authorities.
(f) Penalty for first and subsequent offenses
Any person who violates any provision of this section or any
regulation issued pursuant to this section shall be fined not more than
$500 in the case of a first offense, and not nore than $5,000 in the
case of each subsequent offense.
(g) Regulations; interagency consultations; definitions, safeguards,
and procedures, including procedures and criteria for issuance and scope
of orders
Except as provided in subsection (h) of this section, the Secretary,
after consultation with the Administrator of Veterans' Affairs and the
heads of other Federal departments and agencies substantially affected
thereby, shall prescribe regulations to carry out the purposes of this
section. These regulations may contain such definitions, and may provide
for such safeguards and procedures, including procedures and criteria
for the issuance and scope of orders under subsection (b)(2)(C) of this
section, as in the judgment of the Secretary are necessary or proper to
effectuate the purposes of this section, to prevent circumvention or
evasion thereof, or to facilitate compliance therewith.
(Subsection (h) was superseded by section 111(c)(3) of Pub. L. 94-581.
The responsibility of the Administrator of Veterans' Affairs to write
regulations to provide for confidentiality of drug abuse patient records
under Title 38 was moved from 21 U.S.C. 1175 to 38 U.S.C. 4134.)
Sec. 2.2 Statutory authority for confidentiality of alcohol abuse
patient records.
The restrictions of these regulations upon the disclosure and use of
alcohol
[[Page 9]]
abuse patient records were initially authorized by section 333 of the
Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and
Rehabilitation Act of 1970 (42 U.S.C. 4582). The section as amended was
transferred by Pub. L. 98-24 to section 523 of the Public Health Service
Act which is codified at 42 U.S.C. 290dd-3. The amended statutory
authority is set forth below:
Sec. 290dd-3. Confidentiality of patient records
(a) Disclosure authorization
Records of the identity, diagnosis, prognosis, or treatment of any
patient which are maintained in connection with the performance of any
program or activity relating to alcoholism or alcohol abuse education,
training, treatment, rehabilitation, or research, which is conducted,
regulated, or directly or indirectly assisted by any department or
agency of the United States shall, except as provided in subsection (e)
of this section, be confidential and be disclosed only for the purposes
and under the circumstances expressly authorized under subsection (b) of
this section.
(b) Purposes and circumstances of disclosure affecting consenting
patient and patient regardless of consent
(1) The content of any record referred to in subsection (a) of this
section may be disclosed in accordance with the prior written consent of
the patient with respect to whom such record is maintained, but only to
such extent, under such circumstances, and for such purposes as may be
allowed under regulations prescribed pursuant to subsection (g) of this
section.
(2) Whether or not the patient, with respect to whom any given
record referred to in subsection (a) of this section is maintained,
gives his written consent, the content of such record may be disclosed
as follows:
(A) To medical personnel to the extent necessary to meet a bona fide
medical emergency.
(B) To qualified personnel for the purpose of conducting scientific
research, management audits, financial audits, or program evaluation,
but such personnel may not identify, directly or indirectly, any
individual patient in any report of such research, audit, or evaluation,
or otherwise disclose patient identities in any manner.
(C) If authorized by an appropriate order of a court of competent
jurisdiction granted after application showing good cause therefor. In
assessing good cause the court shall weigh the public interest and the
need for disclosure against the injury to the patient, to the physician-
patient relationship, and to the treatment services. Upon the granting
of such order, the court, in determining the extent to which any
disclosure of all or any part of any record is necessary, shall impose
appropriate safeguards against unauthorized disclosure.
(c) Prohibition against use of record in making criminal charges or
investigation of patient
Except as authorized by a court order granted under subsection
(b)(2)(C) of this section, no record referred to in subsection (a) of
this section may be used to initiate or substantiate any criminal
charges against a patient or to conduct any investigation of a patient.
(d) Continuing prohibition against disclosure irrespective of status
as patient
The prohibitions of this section continue to apply to records
concerning any individual who has been a patient, irrespective of
whether or when he ceases to be a patient.
(e) Armed Forces and Veterans' Administration; interchange of record
of suspected child abuse and neglect to State or local authorities
The prohibitions of this section do not apply to any interchange of
records--
(1) within the Armed Forces or within those components of the
Veterans' Administration furnishing health care to veterans, or
(2) between such components and the Armed Forces.
The prohibitions of this section do not apply to the reporting under
State law of incidents of suspected child abuse and neglect to the
appropriate State or local authorities.
(f) Penalty for first and subsequent offenses
Any person who violates any provision of this section or any
regulation issued pursuant to this section shall be fined not more than
$500 in the case of a first offense, and not more than $5,000 in the
case of each subsequent offense.
(g) Regulations of Secretary; definitions, safeguards, and
procedures, including procedures and criteria for issuance and scope of
orders
Except as provided in subsection (h) of this section, the Secretary
shall prescribe regulations to carry out the purposes of this section.
These regulations may contain such definitions, and may provide for such
safeguards and procedures, including procedures and criteria for the
issuance and scope of orders under subsection(b)(2)(C) of this section,
as in the judgment of the Secretary are necessary or proper to
effectuate the purposes of this section, to prevent circumvention or
evasion thereof, or to facilitate compliance therewith.
(Subsection (h) was superseded by section 111(c)(4) of Pub. L. 94-581.
The responsibility of the Administrator of Veterans' Affairs to write
regulations to provide for confidentiality of alcohol abuse patient
records under Title 38 was moved from 42 U.S.C. 4582 to 38 U.S.C. 4134.)
[[Page 10]]
Sec. 2.3 Purpose and effect.
(a) Purpose. Under the statutory provisions quoted in Secs. 2.1 and
2.2, these regulations impose restrictions upon the disclosure and use
of alcohol and drug abuse patient records which are maintained in
connection with the performance of any federally assisted alcohol and
drug abuse program. The regulations specify:
(1) Definitions, applicability, and general restrictions in subpart
B (definitions applicable to Sec. 2.34 only appear in that section);
(2) Disclosures which may be made with written patient consent and
the form of the written consent in subpart C;
(3) Disclosures which may be made without written patient consent or
an authorizing court order in subpart D; and
(4) Disclosures and uses of patient records which may be made with
an authorizing court order and the procedures and criteria for the entry
and scope of those orders in subpart E.
(b) Effect. (1) These regulations prohibit the disclosure and use of
patient records unless certain circumstances exist. If any circumstances
exists under which disclosure is permitted, that circumstance acts to
remove the prohibition on disclosure but it does not compel disclosure.
Thus, the regulations do not require disclosure under any circumstances.
(2) These regulations are not intended to direct the manner in which
substantive functions such as research, treatment, and evaluation are
carried out. They are intended to insure that an alcohol or drug abuse
patient in a federally assisted alcohol or drug abuse program is not
made more vulnerable by reason of the availability of his or her patient
record than an individual who has an alcohol or drug problem and who
does not seek treatment.
(3) Because there is a criminal penalty (a fine--see 42 U.S.C.
290ee-3(f), 42 U.S.C. 290dd-3(f) and 42 CFR 2.4) for violating the
regulations, they are to be construed strictly in favor of the potential
violator in the same manner as a criminal statute (see M. Kraus &
Brothers v. United States, 327 U.S. 614, 621-22, 66 S. Ct. 705, 707-08
(1946)).
Sec. 2.4 Criminal penalty for violation.
Under 42 U.S.C. 290ee-3(f) and 42 U.S.C. 290dd-3(f), any person who
violates any provision of those statutes or these regulations shall be
fined not more than $500 in the case of a first offense, and not more
than $5,000 in the case of each subsequent offense.
Sec. 2.5 Reports of violations.
(a) The report of any violation of these regulations may be directed
to the United States Attorney for the judicial district in which the
violation occurs.
(b) The report of any violation of these regulations by a methadone
program may be directed to the Regional Offices of the Food and Drug
Administration.
Subpart B--General Provisions
Sec. 2.11 Definitions.
For purposes of these regulations:
Alcohol abuse means the use of an alcoholic beverage which impairs
the physical, mental, emotional, or social well-being of the user.
Drug abuse means the use of a psychoactive substance for other than
medicinal purposes which impairs the physical, mental, emotional, or
social well-being of the user.
Diagnosis means any reference to an individual's alcohol or drug
abuse or to a condition which is identified as having been caused by
that abuse which is made for the purpose of treatment or referral for
treatment.
Disclose or disclosure means a communication of patient indentifying
information, the affirmative verification of another person's
communication of patient identifying information, or the communication
of any information from the record of a patient who has been identified.
Informant means an individual:
(a) Who is a patient or employee of a program or who becomes a
patient or employee of a program at the request of a law enforcement
agency or official: and
(b) Who at the request of a law enforcement agency or official
observes one or more patients or employees of
[[Page 11]]
the program for the purpose of reporting the information obtained to the
law enforcement agency or official.
Patient means any individual who has applied for or been given
diagnosis or treatment for alcohol or drug abuse at a federally assisted
program and includes any individual who, after arrest on a criminal
charge, is identified as an alcohol or drug abuser in order to determine
that individual's eligibility to participate in a program.
Patient identifying information means the name, address, social
security number, fingerprints, photograph, or similar information by
which the identity of a patient can be determined with reasonable
accuracy and speed either directly or by reference to other publicly
available information. The term does not include a number assigned to a
patient by a program, if that number does not consist of, or contain
numbers (such as a social security, or driver's license number) which
could be used to identify a patient with reasonable accuracy and speed
from sources external to the program.
Person means an individual, partnership, corporation, Federal, State
or local government agency, or any other legal entity.
Program means:
(a) An individual or entity (other than a general medical care
facility) who holds itself out as providing, and provides, alcohol or
drug abuse diagnosis, treatment or referral for treatment; or
(b) An identified unit within a general medical facility which holds
itself out as providing, and provides, alcohol or drug abuse diagnosis,
treatment or referral for treatment; or
(c) Medical personnel or other staff in a general medical care
facility whose primary function is the provision of alcohol or drug
abuse diagnosis, treatment or referral for treatment and who are
identified as such providers. (See Sec. 2.12(e)(1) for examples.)
Program director means:
(a) In the case of a program which is an individual, that
individual:
(b) In the case of a program which is an organization, the
individual designated as director, managing director, or otherwise
vested with authority to act as chief executive of the organization.
Qualified service organization means a person which:
(a) Provides services to a program, such as data processing, bill
collecting, dosage preparation, laboratory analyses, or legal, medical,
accounting, or other professional services, or services to prevent or
treat child abuse or neglect, including training on nutrition and child
care and individual and group therapy, and
(b) Has entered into a written agreement with a program under which
that person:
(1) Acknowledges that in receiving, storing, processing or otherwise
dealing with any patient records from the progams, it is fully bound by
these regulations; and
(2) If necessary, will resist in judicial proceedings any efforts to
obtain access to patient records except as permitted by these
regulations.
Records means any information, whether recorded or not, relating to
a patient received or acquired by a federally assisted alcohol or drug
program.
Third party payer means a person who pays, or agrees to pay, for
diagnosis or treatment furnished to a patient on the basis of a
contractual relationship with the patient or a member of his family or
on the basis of the patient's eligibility for Federal, State, or local
governmental benefits.
Treatment means the management and care of a patient suffering from
alcohol or drug abuse, a condition which is identified as having been
caused by that abuse, or both, in order to reduce or eliminate the
adverse effects upon the patient.
Undercover agent means an officer of any Federal, State, or local
law enforcement agency who enrolls in or becomes an employee of a
program for the purpose of investigating a suspected violation of law or
who pursues that purpose after enrolling or becoming employed for other
purposes.
[52 FR 21809, June 9, 1987, as amended by 60 FR 22297, May 5, 1995]
Sec. 2.12 Applicability.
(a) General--(1) Restrictions on disclosure. The restrictions on
disclosure in
[[Page 12]]
these regulations apply to any information, whether or not recorded,
which:
(i) Would identify a patient as an alcohol or drug abuser either
directly, by reference to other publicly available information, or
through verification of such an identification by another person; and
(ii) Is drug abuse information obtained by a federally assisted drug
abuse program after March 20, 1972, or is alcohol abuse information
obtained by a federally assisted alcohol abuse program after May 13,
1974 (or if obtained before the pertinent date, is maintained by a
federally assisted alcohol or drug abuse program after that date as part
of an ongoing treatment episode which extends past that date) for the
purpose of treating alcohol or drug abuse, making a diagnosis for that
treatment, or making a referral for that treatment.
(2) Restriction on use. The restriction on use of information to
initiate or substantiate any criminal charges against a patient or to
conduct any criminal investigation of a patient (42 U.S.C. 290ee-3(c),
42 U.S.C. 290dd-3(c)) applies to any information, whether or not
recorded which is drug abuse information obtained by a federally
assisted drug abuse program after March 20, 1972, or is alcohol abuse
information obtained by a federally assisted alcohol abuse program after
May 13, 1974 (or if obtained before the pertinent date, is maintained by
a federally assisted alcohol or drug abuse program after that date as
part of an ongoing treatment episode which extends past that date), for
the purpose of treating alcohol or drug abuse, making a diagnosis for
the treatment, or making a referral for the treatment.
(b) Federal assistance. An alcohol abuse or drug abuse program is
considered to be federally assisted if:
(1) It is conducted in whole or in part, whether directly or by
contract or otherwise by any department or agency of the United States
(but see paragraphs (c)(1) and (c)(2) of this section relating to the
Veterans' Administration and the Armed Forces);
(2) It is being carried out under a license, certification,
registration, or other authorization granted by any department or agency
of the United States including but not limited to:
(i) Certification of provider status under the Medicare program;
(ii) Authorization to conduct methadone maintenance treatment (see
21 CFR 291.505); or
(iii) Registration to dispense a substance under the Controlled
Substances Act to the extent the controlled substance is used in the
treatment of alcohol or drug abuse;
(3) It is supported by funds provided by any department or agency of
the United States by being:
(i) A recipient of Federal financial assistance in any form,
including financial assistance which does not directly pay for the
alcohol or drug abuse diagnosis, treatment, or referral activities; or
(ii) Conducted by a State or local government unit which, through
general or special revenue sharing or other forms of assistance,
receives Federal funds which could be (but are not necessarily) spent
for the alcohol or drug abuse program; or
(4) It is assisted by the Internal Revenue Service of the Department
of the Treasury through the allowance of income tax deductions for
contributions to the program or through the granting of tax exempt
status to the program.
(c) Exceptions--(1) Veterans' Administration. These regulations do
not apply to information on alcohol and drug abuse patients maintained
in connection with the Veterans' Administration provisions of hospital
care, nursing home care, domiciliary care, and medical services under
title 38, United States Code. Those records are governed by 38 U.S.C.
4132 and regulations issued under that authority by the Administrator of
Veterans' Affairs.
(2) Armed Forces. These regulations apply to any information
described in paragraph (a) of this section which was obtained by any
component of the Armed Forces during a period when the patient was
subject to the Uniform Code of Military Justice except:
(i) Any interchange of that information within the Armed Forces; and
(ii) Any interchange of that information between the Armed Forces
and
[[Page 13]]
those components of the Veterans Administration furnishing health care
to veterans.
(3) Communication within a program or between a program and an
entity having direct administrative control over that program. The
restrictions on disclosure in these regulations do not apply to
communications of information between or among personnel having a need
for the information in connection with their duties that arise out of
the provision of diagnosis, treatment, or referral for treatment of
alcohol or drug abuse if the communications are
(i) Within a program or
(ii) Between a program and an entity that has direct administrative
control over the program.
(4) Qualified Service Organizations. The restrictions on disclosure
in these regulations do not apply to communications between a program
and a qualified service organization of information needed by the
organization to provide services to the program.
(5) Crimes on program premises or against program personnel. The
restrictions on disclosure and use in these regulations do not apply to
communications from program personnel to law enforcement officers
which--
(i) Are directly related to a patient's commission of a crime on the
premises of the program or against program personnel or to a threat to
commit such a crime; and
(ii) Are limited to the circumstances of the incident, including the
patient status of the individual committing or threatening to commit the
crime, that individual's name and address, and that individual's last
known whereabouts.
(6) Reports of suspected child abuse and neglect. The restrictions
on disclosure and use in these regulations do not apply to the reporting
under State law of incidents of suspected child abuse and neglect to the
appropriate State or local authorities. However, the restrictions
continue to apply to the original alcohol or drug abuse patient records
maintained by the program including their disclosure and use for civil
or criminal proceedings which may arise out of the report of suspected
child abuse and neglect.
(d) Applicability to recipients of information--(1) Restriction on
use of information. The restriction on the use of any information
subject to these regulations to initiate or substantiate any criminal
charges against a patient or to conduct any criminal investigation of a
patient applies to any person who obtains that information from a
federally assisted alcohol or drug abuse program, regardless of the
status of the person obtaining the information or of whether the
information was obtained in accordance with these regulations. This
restriction on use bars, among other things, the introduction of that
information as evidence in a criminal proceeding and any other use of
the information to investigate or prosecute a patient with respect to a
suspected crime. Information obtained by undercover agents or informants
(see Sec. 2.17) or through patient access (see Sec. 2.23) is subject to
the restriction on use.
(2) Restrictions on disclosures--Third party payers, administrative
entities, and others. The restrictions on disclosure in these
regulations apply to:
(i) Third party payers with regard to records disclosed to them by
federally assisted alcohol or drug abuse programs;
(ii) Entities having direct administrative control over programs
with regard to information communicated to them by the program under
Sec. 2.12(c)(3); and
(iii) Persons who receive patient records directly from a federally
assisted alcohol or drug abuse program and who are notified of the
restrictions on redisclosure of the records in accordance with Sec. 2.32
of these regulations.
(e) Explanation of applicability--(1) Coverage. These regulations
cover any information (including information on referral and intake)
about alcohol and drug abuse patients obtained by a program (as the
terms ``patient'' and ``program'' are defined in Sec. 2.11) if the
program is federally assisted in any manner described in Sec. 2.12(b).
Coverage includes, but is not limited to, those treatment or
rehabilitation programs, employee assistance programs, programs within
general hospitals, school-
[[Page 14]]
based programs, and private practitioners who hold themselves out as
providing, and provide alcohol or drug abuse diagnosis, treatment, or
referral for treatment. However, these regulations would not apply, for
example, to emergency room personnel who refer a patient to the
intensive care unit for an apparent overdose, unless the primary
function of such personnel is the provision of alcohol or drug abuse
diagnosis, treatment or referral and they are identified as providing
such services or the emergency room has promoted itself to the community
as a provider of such services.
(2) Federal assistance to program required. If a patient's alcohol
or drug abuse diagnosis, treatment, or referral for treatment is not
provided by a program which is federally conducted, regulated or
supported in a manner which constitutes Federal assistance under
Sec. 2.12(b), that patient's record is not covered by these regulations.
Thus, it is possible for an individual patient to benefit from Federal
support and not be covered by the confidentiality regulations because
the program in which the patient is enrolled is not federally assisted
as defined in Sec. 2.12(b). For example, if a Federal court placed an
individual in a private for-profit program and made a payment to the
program on behalf of that individual, that patient's record would not be
covered by these regulations unless the program itself received Federal
assistance as defined by Sec. 2.12(b).
(3) Information to which restrictions are applicable. Whether a
restriction is on use or disclosure affects the type of information
which may be available. The restrictions on disclosure apply to any
information which would identify a patient as an alcohol or drug abuser.
The restriction on use of information to bring criminal charges against
a patient for a crime applies to any information obtained by the program
for the purpose of diagnosis, treatment, or referral for treatment of
alcohol or drug abuse. (Note that restrictions on use and disclosure
apply to recipients of information under Sec. 2.12(d).)
(4) How type of diagnosis affects coverage. These regulations cover
any record of a diagnosis identifying a patient as an alcohol or drug
abuser which is prepared in connection with the treatment or referral
for treatment of alcohol or drug abuse. A diagnosis prepared for the
purpose of treatment or referral for treatment but which is not so used
is covered by these regulations. The following are not covered by these
regulations:
(i) Diagnosis which is made solely for the purpose of providing
evidence for use by law enforcement authorities; or
(ii) A diagnosis of drug overdose or alcohol intoxication which
clearly shows that the individual involved is not an alcohol or drug
abuser (e.g., involuntary ingestion of alcohol or drugs or reaction to a
prescribed dosage of one or more drugs).
[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987, as amended at 60
FR 22297, May 5, 1995]
Sec. 2.13 Confidentiality restrictions.
(a) General. The patient records to which these regulations apply
may be disclosed or used only as permitted by these regulations and may
not otherwise be disclosed or used in any civil, criminal,
administrative, or legislative proceedings conducted by any Federal,
State, or local authority. Any disclosure made under these regulations
must be limited to that information which is necessary to carry out the
purpose of the disclosure.
(b) Unconditional compliance required. The restrictions on
disclosure and use in these regulations apply whether the holder of the
information believes that the person seeking the information already has
it, has other means of obtaining it, is a law enforcement or other
official, has obtained a subpoena, or asserts any other justification
for a disclosure or use which is not permitted by these regulations.
(c) Acknowledging the presence of patients: Responding to requests.
(1) The presence of an identified patient in a facility or component of
a facility which is publicly identified as a place where only alcohol or
drug abuse diagnosis, treatment, or referral is provided may be
acknowledged only if the patient's written consent is obtained in
accordance with subpart C of these regulations or if an authorizing
court order is entered in accordance with subpart E of these
regulations. The regulations permit acknowledgement
[[Page 15]]
of the presence of an identified patient in a facility or part of a
facility if the facility is not publicy identified as only an alcohol or
drug abuse diagnosis, treatment or referral facility, and if the
acknowledgement does not reveal that the patient is an alcohol or drug
abuser.
(2) Any answer to a request for a disclosure of patient records
which is not permissible under these regulations must be made in a way
that will not affirmatively reveal that an identified individual has
been, or is being diagnosed or treated for alcohol or drug abuse. An
inquiring party may be given a copy of these regulations and advised
that they restrict the disclosure of alcohol or drug abuse patient
records, but may not be told affirmatively that the regulations restrict
the disclosure of the records of an identified patient. The regulations
do not restrict a disclosure that an identified individual is not and
never has been a patient.
Sec. 2.14 Minor patients.
(a) Definition of minor. As used in these regulations the term
``minor'' means a person who has not attained the age of majority
specified in the applicable State law, or if no age of majority is
specified in the applicable State law, the age of eighteen years.
(b) State law not requiring parental consent to treatment. If a
minor patient acting alone has the legal capacity under the applicable
State law to apply for and obtain alcohol or drug abuse treatment, any
written consent for disclosure authorized under subpart C of these
regulations may be given only by the minor patient. This restriction
includes, but is not limited to, any disclosure of patient identifying
information to the parent or guardian of a minor patient for the purpose
of obtaining financial reimbursement. These regulations do not prohibit
a program from refusing to provide treatment until the minor patient
consents to the disclosure necessary to obtain reimbursement, but
refusal to provide treatment may be prohibited under a State or local
law requiring the program to furnish the service irrespective of ability
to pay.
(c) State law requiring parental consent to treatment. (1) Where
State law requires consent of a parent, guardian, or other person for a
minor to obtain alcohol or drug abuse treatment, any written consent for
disclosure authorized under subpart C of these regulations must be given
by both the minor and his or her parent, guardian, or other person
authorized under State law to act in the minor's behalf.
(2) Where State law requires parental consent to treatment the fact
of a minor's application for treatment may be communicated to the
minor's parent, guardian, or other person authorized under State law to
act in the minor's behalf only if:
(i) The minor has given written consent to the disclosure in
accordance with subpart C of these regulations or
(ii) The minor lacks the capacity to make a rational choice
regarding such consent as judged by the program director under paragraph
(d) of this section.
(d) Minor applicant for services lacks capacity for rational choice.
Facts relevant to reducing a threat to the life or physical well being
of the applicant or any other individual may be disclosed to the parent,
guardian, or other person authorized under State law to act in the
minor's behalf if the program director judges that:
(1) A minor applicant for services lacks capacity because of extreme
youth or mental or physical condition to make a rational decision on
whether to consent to a disclosure under subpart C of these regulations
to his or her parent, guardian, or other person authorized under State
law to act in the minor's behalf, and
(2) The applicant's situation poses a substantial threat to the life
or physical well being of the applicant or any other individual which
may be reduced by communicating relevant facts to the minor's parent,
guardian, or other person authorized under State law to act in the
minor's behalf.
Sec. 2.15 Incompetent and deceased patients.
(a) Incompetent patients other than minors--(1) Adjudication of
incompetence. In the case of a patient who has been adjudicated as
lacking the capacity, for any reason other than insufficient age, to
manage his or her own affairs,
[[Page 16]]
any consent which is required under these regulations may be given by
the guardian or other person authorized under State law to act in the
patient's behalf.
(2) No adjudication of incompetency. For any period for which the
program director determines that a patient, other than a minor or one
who has been adjudicated incompetent, suffers from a medical condition
that prevents knowing or effective action on his or her own behalf, the
program director may exercise the right of the patient to consent to a
disclosure under subpart C of these regulations for the sole purpose of
obtaining payment for services from a third party payer.
(b) Deceased patients--(1) Vital statistics. These regulations do
not restrict the disclosure of patient identifying information relating
to the cause of death of a patient under laws requiring the collection
of death or other vital statistics or permitting inquiry into the cause
of death.
(2) Consent by personal representative. Any other disclosure of
information identifying a deceased patient as an alcohol or drug abuser
is subject to these regulations. If a written consent to the disclosure
is required, that consent may be given by an executor, administrator, or
other personal representative appointed under applicable State law. If
there is no such appointment the consent may be given by the patient's
spouse or, if none, by any responsible member of the patient's family.
Sec. 2.16 Security for written records.
(a) Written records which are subject to these regulations must be
maintained in a secure room, locked file cabinet, safe or other similar
container when not in use; and
(b) Each program shall adopt in writing procedures which regulate
and control access to and use of written records which are subject to
these regulations.
Sec. 2.17 Undercover agents and informants.
(a) Restrictions on placement. Except as specifically authorized by
a court order granted under Sec. 2.67 of these regulations, no program
may knowingly employ, or enroll as a patient, any undercover agent or
informant.
(b) Restriction on use of information. No information obtained by an
undercover agent or informant, whether or not that undercover agent or
informant is placed in a program pursuant to an authorizing court order,
may be used to criminally investigate or prosecute any patient.
[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987]
Sec. 2.18 Restrictions on the use of identification cards.
No person may require any patient to carry on his or her person
while away from the program premises any card or other object which
would identify the patient as an alcohol or drug abuser. This section
does not prohibit a person from requiring patients to use or carry cards
or other identification objects on the premises of a program.
Sec. 2.19 Disposition of records by discontinued programs.
(a) General. If a program discontinues operations or is taken over
or acquired by another program, it must purge patient identifying
information from its records or destroy the records unless--
(1) The patient who is the subject of the records gives written
consent (meeting the requirements of Sec. 2.31) to a transfer of the
records to the acquiring program or to any other program designated in
the consent (the manner of obtaining this consent must minimize the
likelihood of a disclosure of patient identifying information to a third
party); or
(2) There is a legal requirement that the records be kept for a
period specified by law which does not expire until after the
discontinuation or acquisition of the program.
(b) Procedure where retention period required by law. If paragraph
(a)(2) of this section applies, the records must be:
(1) Sealed in envelopes or other containers labeled as follows:
``Records of [insert name of program] required to be maintained under
[insert citation to statute, regulation, court order or other legal
authority requiring that records be kept] until a date not later than
[insert appropriate date]''; and
[[Page 17]]
(2) Held under the restrictions of these regulations by a
responsible person who must, as soon as practicable after the end of the
retention period specified on the label, destroy the records.
Sec. 2.20 Relationship to State laws.
The statutes authorizing these regulations (42 U.S.C. 290ee-3 and 42
U.S.C. 290dd-3) do not preempt the field of law which they cover to the
exclusion of all State laws in that field. If a disclosure permitted
under these regulations is prohibited under State law, neither these
regulations nor the authorizing statutes may be construed to authorize
any violation of that State law. However, no State law may either
authorize or compel any disclosure prohibited by these regulations.
Sec. 2.21 Relationship to Federal statutes protecting research subjects
against compulsory disclosure of their identity.
(a) Research privilege description. There may be concurrent coverage
of patient identifying information by these regulations and by
administrative action taken under: Section 303(a) of the Public Health
Service Act (42 U.S.C. 242a(a) and the implementing regulations at 42
CFR part 2a); or section 502(c) of the Controlled Substances Act (21
U.S.C. 872(c) and the implementing regulations at 21 CFR 1316.21). These
``research privilege'' statutes confer on the Secretary of Health and
Human Services and on the Attorney General, respectively, the power to
authorize researchers conducting certain types of research to withhold
from all persons not connected with the research the names and other
identifying information concerning individuals who are the subjects of
the research.
(b) Effect of concurrent coverage. These regulations restrict the
disclosure and use of information about patients, while administrative
action taken under the research privilege statutes and implementing
regulations protects a person engaged in applicable research from being
compelled to disclose any identifying characteristics of the individuals
who are the subjects of that research. The issuance under subpart E of
these regulations of a court order authorizing a disclosure of
information about a patient does not affect an exercise of authority
under these research privilege statutes. However, the research privilage
granted under 21 CFR 291.505(g) to treatment programs using methadone
for maintenance treatment does not protect from compulsory disclosure
any imformation which is permitted to be disclosed under those
regulations. Thus, if a court order entered in accordance with subpart E
of these regulations authorizes a methadone maintenance treatment
program to disclose certain information about its patients, that program
may not invoke the research privilege under 21 CFR 291.505(g) as a
defense to a subpoena for that information.
Sec. 2.22 Notice to patients of Federal confidentiality requirements.
(a) Notice required. At the time of admission or as soon threreafter
as the patient is capable of rational communication, each program shall:
(1) Communicate to the patient that Federal law and regulations
protect the confidentiality of alcohol and drug abuse patient records;
and
(2) Give to the patient a summary in writing of the Federal law and
regulations.
(b) Required elements of written summary. The written summary of the
Federal law and regulations must include:
(1) A general description of the limited circumstances under which a
program may acknowledge that an individual is present at a facility or
disclose outside the program information identifying a patient as an
alcohol or drug abuser.
(2) A statement that violation of the Federal law and regulations by
a program is a crime and that suspected violations may be reported to
appropriate authorities in accordance with these regulations.
(3) A statement that information related to a patient's commission
of a crime on the premises of the program or against personnel of the
program is not protected.
(4) A statement that reports of suspected child abuse and neglect
made under State law to appropriate State or local authorities are not
protected.
[[Page 18]]
(5) A citation to the Federal law and regulations.
(c) Program options. The program may devise its own notice or may
use the sample notice in paragraph (d) to comply with the requirement to
provide the patient with a summary in writing of the Federal law and
regulations. In addition, the program may include in the written summary
information concerning State law and any program policy not inconsistent
with State and Federal law on the subject of confidentiality of alcohol
and drug abuse patient records.
(d) Sample notice.
Confidentiality of Alcohol and Drug Abuse Patient Records
The confidentiality of alcohol and drug abuse patient records
maintained by this program is protected by Federal law and regulations.
Generally, the program may not say to a person outside the program that
a patient attends the program, or disclose any information identifying a
patient as an alcohol or drug abuser Unless:
(1) The patient consents in writing:
(2) The disclosure is allowed by a court order; or
(3) The disclosure is made to medical personnel in a medical
emergency or to qualified personnel for research, audit, or program
evaluation.
Violation of the Federal law and regulations by a program is a
crime. Suspected violations may be reported to appropriate authorities
in accordance with Federal regulations.
Federal law and regulations do not protect any information about a
crime committed by a patient either at the program or against any person
who works for the program or about any threat to commit such a crime.
Federal laws and regulations do not protect any information about
suspected child abuse or neglect from being reported under State law to
appropriate State or local authorities.
(See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR
part 2 for Federal regulations.)
(Approved by the Office of Management and Budget under control number
0930-0099)
Sec. 2.23 Patient access and restrictions on use.
(a) Patient access not prohibited. These regulations do not prohibit
a program from giving a patient access to his or her own records,
including the opportunity to inspect and copy any records that the
program maintains about the patient. The program is not required to
obtain a patient's written consent or other authorization under these
regulations in order to provide such access to the patient.
(b) Restriction on use of information. Information obtained by
patient access to his or her patient record is subject to the
restriction on use of his information to initiate or substantiate any
criminal charges against the patient or to conduct any criminal
investigation of the patient as provided for under Sec. 2.12(d)(1).
Subpart C--Disclosures With Patient's Consent
Sec. 2.31 Form of written consent.
(a) Required elements. A written consent to a disclosure under these
regulations must include:
(1) The specific name or general designation of the program or
person permitted to make the disclosure.
(2) The name or title of the individual or the name of the
organization to which disclosure is to be made.
(3) The name of the patient.
(4) The purpose of the disclosure.
(5) How much and what kind of information is to be disclosed.
(6) The signature of the patient and, when required for a patient
who is a minor, the signature of a person authorized to give consent
under Sec. 2.14; or, when required for a patient who is incompetent or
deceased, the signature of a person authorized to sign under Sec. 2.15
in lieu of the patient.
(7) The date on which the consent is signed.
(8) A statement that the consent is subject to revocation at any
time except to the extent that the program or person which is to make
the disclosure has already acted in reliance on it. Acting in reliance
includes the provision of treatment services in reliance on a valid
consent to disclose information to a third party payer.
(9) The date, event, or condition upon which the consent will expire
if not revoked before. This date, event, or condition must insure that
the consent will last no longer than reasonably necessary to serve the
purpose for which it is given.
[[Page 19]]
(b) Sample consent form. The following form complies with paragraph
(a) of this section, but other elements may be added.
1. I (name of patient) {time} Request {time} Authorize:
2. (name or general designation of program which is to make the
disclosure)
_______________________________________________________________________
3. To disclose: (kind and amount of information to be disclosed)
_______________________________________________________________________
4. To: (name or title of the person or organization to which disclosure
is to be made)
_______________________________________________________________________
5. For (purpose of the disclosure)
_______________________________________________________________________
6. Date (on which this consent is signed)
_______________________________________________________________________
7. Signature of patient
_______________________________________________________________________
8. Signature of parent or guardian (where required)
_______________________________________________________________________
9. Signature of person authorized to sign in lieu of the patient (where
required)
_______________________________________________________________________
10. This consent is subject to revocation at any time except to the
extent that the program which is to make the disclosure has already
taken action in reliance on it. If not previously revoked, this consent
will terminate upon: (specific date, event, or condition)
(c) Expired, deficient, or false consent. A disclosure may not be
made on the basis of a consent which:
(1) Has expired;
(2) On its face substantially fails to conform to any of the
requirements set forth in paragraph (a) of this section;
(3) Is known to have been revoked; or
(4) Is known, or through a reasonable effort could be known, by the
person holding the records to be materially false.
(Approved by the Office of Management and Budget under control number
0930-0099)
Sec. 2.32 Prohibition on redisclosure.
Notice to accompany disclosure. Each disclosure made with the
patient's written consent must be accompanied by the following written
statement:
This information has been disclosed to you from records protected by
Federal confidentiality rules (42 CFR part 2). The Federal rules
prohibit you from making any further disclosure of this information
unless further disclosure is expressly permitted by the written consent
of the person to whom it pertains or as otherwise permitted by 42 CFR
part 2. A general authorization for the release of medical or other
information is NOT sufficient for this purpose. The Federal rules
restrict any use of the information to criminally investigate or
prosecute any alcohol or drug abuse patient.
[52 FR 21809, June 9, 1987; 52 FR 41997, Nov. 2, 1987]
Sec. 2.33 Disclosures permitted with written consent.
If a patient consents to a disclosure of his or her records under
Sec. 2.31, a program may disclose those records in accordance with that
consent to any individual or organization named in the consent, except
that disclosures to central registries and in connection with criminal
justice referrals must meet the requirements of Secs. 2.34 and 2.35,
respectively.
Sec. 2.34 Disclosures to prevent multiple enrollments in detoxification
and maintenance treatment programs.
(a) Definitions. For purposes of this section:
Central registry means an organization which obtains from two or
more member progams patient identifying information about individuals
applying for maintenance treatment or detoxification treatment for the
purpose of avoiding an individual's concurrent enrollment in more than
one program.
Detoxification treatment means the dispensing of a narcotic drug in
decreasing doses to an individual in order to reduce or eliminate
adverse physiological or psychological effects incident to withdrawal
from the sustained use of a narcotic drug.
Maintenance treatment means the dispensing of a narcotic drug in the
treatment of an individual for dependence upon heroin or other morphine-
like drugs.
Member program means a detoxification treatment or maintenance
treatment program which reports patient identifying information to a
central registry and which is in the same State as that central registry
or is not more than 125 miles from any border of the State in which the
central registry is located.
(b) Restrictions on disclosure. A program may disclose patient
records to a
[[Page 20]]
central registry or to any detoxification or maintenance treatment
program not more than 200 miles away for the purpose of preventing the
multiple enrollment of a patient only if:
(1) The disclosure is made when:
(i) The patient is accepted for treatment;
(ii) The type or dosage of the drug is changed; or
(iii) The treatment is interrupted, resumed or terminated.
(2) The disclosure is limited to:
(i) Patient identifying information;
(ii) Type and dosage of the drug; and
(iii) Relevant dates.
(3) The disclosure is made with the patient's written consent
meeting the requirements of Sec. 2.31, except that:
(i) The consent must list the name and address of each central
registry and each known detoxification or maintenance treatment program
to which a disclosure will be made; and
(ii) The consent may authorize a disclosure to any detoxification or
maintenance treatment program established within 200 miles of the
program after the consent is given without naming any such program.
(c) Use of information limited to prevention of multiple
enrollments. A central registry and any detoxification or maintenance
treatment program to which information is disclosed to prevent multiple
enrollments may not redisclose or use patient identifying information
for any purpose other than the prevention of multiple enrollments unless
authorized by a court order under subpart E of these regulations.
(d) Permitted disclosure by a central registry to prevent a multiple
enrollment. When a member program asks a central registry if an
identified patient is enrolled in another member program and the
registry determines that the patient is so enrolled, the registry may
disclose--
(1) The name, address, and telephone number of the member program(s)
in which the patient is already enrolled to the inquiring member
program; and
(2) The name, address, and telephone number of the inquiring member
program to the member program(s) in which the patient is already
enrolled. The member programs may communicate as necessary to verify
that no error has been made and to prevent or eliminate any multiple
enrollment.
(e) Permitted disclosure by a detoxification or maintenance
treatment program to prevent a multiple enrollment. A detoxification or
maintenance treatment program which has received a disclosure under this
section and has determined that the patient is already enrolled may
communicate as necessary with the program making the disclosure to
verify that no error has been made and to prevent or eliminate any
multiple enrollment.
Sec. 2.35 Disclosures to elements of the criminal justice system which
have referred patients.
(a) A program may disclose information about a patient to those
persons within the criminal justice system which have made participation
in the program a condition of the disposition of any criminal
proceedings against the patient or of the patient's parole or other
release from custody if:
(1) The disclosure is made only to those individuals within the
criminal justice system who have a need for the information in
connection with their duty to monitor the patient's progress (e.g., a
prosecuting attorney who is withholding charges against the patient, a
court granting pretrial or posttrial release, probation or parole
officers responsible for supervision of the patient); and
(2) The patient has signed a written consent meeting the
requirements of Sec. 2.31 (except paragraph (a)(8) which is inconsistent
with the revocation provisions of paragraph (c) of this section) and the
requirements of paragraphs (b) and (c) of this section.
(b) Duration of consent. The written consent must state the period
during which it remains in effect. This period must be reasonable,
taking into account:
(1) The anticipated length of the treatment;
(2) The type of criminal proceeding involved, the need for the
information in connection with the final disposition of that proceeding,
and when the final disposition will occur; and
(3) Such other factors as the program, the patient, and the
person(s)
[[Page 21]]
who will receive the disclosure consider pertinent.
(c) Revocation of consent. The written consent must state that it is
revocable upon the passage of a specified amount of time or the
occurrence of a specified, ascertainable event. The time or occurrence
upon which consent becomes revocable may be no later than the final
disposition of the conditional release or other action in connection
with which consent was given.
(d) Restrictions on redisclosure and use. A person who receives
patient information under this section may redisclose and use it only to
carry out that person's official duties with regard to the patient's
conditional release or other action in connection with which the consent
was given.
Subpart D--Disclosures Without Patient Consent
Sec. 2.51 Medical emergencies.
(a) General Rule. Under the procedures required by paragraph (c) of
this section, patient identifying information may be disclosed to
medical personnel who have a need for information about a patient for
the purpose of treating a condition which poses an immediate threat to
the health of any individual and which requires immediate medical
intervention.
(b) Special Rule. Patient identifying information may be disclosed
to medical personnel of the Food and Drug Administration (FDA) who
assert a reason to believe that the health of any individual may be
threatened by an error in the manufacture, labeling, or sale of a
product under FDA jurisdiction, and that the information will be used
for the exclusive purpose of notifying patients or their physicians of
potential dangers.
(c) Procedures. Immediately following disclosure, the program shall
document the disclosure in the patient's records, setting forth in
writing:
(1) The name of the medical personnel to whom disclosure was made
and their affiliation with any health care facility;
(2) The name of the individual making the disclosure;
(3) The date and time of the disclosure; and
(4) The nature of the emergency (or error, if the report was to
FDA).
(Approved by the Office of Management and Budget under control number
0930-0099)
Sec. 2.52 Research activities.
(a) Patient identifying information may be disclosed for the purpose
of conducting scientific research if the program director makes a
determination that the recipient of the patient identifying information:
(1) Is qualified to conduct the research;
(2) Has a research protocol under which the patient identifying
information:
(i) Will be maintained in accordance with the security requirements
of Sec. 2.16 of these regulations (or more stringent requirements); and
(ii) Will not be redisclosed except as permitted under paragraph (b)
of this section; and
(3) Has provided a satisfactory written statement that a group of
three or more individuals who are independent of the research project
has reviewed the protocol and determined that:
(i) The rights and welfare of patients will be adequately protected;
and
(ii) The risks in disclosing patient identifying information are
outweighed by the potential benefits of the research.
(b) A person conducting research may disclose patient identifying
information obtained under paragraph (a) of this section only back to
the program from which that information was obtained and may not
identify any individual patient in any report of that research or
otherwise disclose patient identities.
[52 FR 21809, June 9, 1987, as amended at 52 FR 41997, Nov. 2, 1987]
Sec. 2.53 Audit and evaluation activities.
(a) Records not copied or removed. If patient records are not copied
or removed, patient identifying information may be disclosed in the
course of a review of records on program premises to any person who
agrees in writing to comply with the limitations on redisclosure and use
in paragraph (d) of this section and who:
[[Page 22]]
(1) Performs the audit or evaluation activity on behalf of:
(i) Any Federal, State, or local governmental agency which provides
financial assistance to the program or is authorized by law to regulate
its activities; or
(ii) Any private person which provides financial assistance to the
program, which is a third party payer covering patients in the program,
or which is a peer review organization performing a utilization or
quality control review; or
(2) Is determined by the program director to be qualified to conduct
the audit or evaluation activities.
(b) Copying or removal of records. Records containing patient
identifying information may be copied or removed from program premises
by any person who:
(1) Agrees in writing to:
(i) Maintain the patient identifying information in accordance with
the security requirements provided in Sec. 2.16 of these regulations (or
more stringent requirements);
(ii) Destroy all the patient identifying information upon completion
of the audit or evaluation; and
(iii) Comply with the limitations on disclosure and use in paragraph
(d) of this section; and
(2) Performs the audit or evaluation activity on behalf of:
(i) Any Federal, State, or local governmental agency which provides
financial assistance to the program or is authorized by law to regulate
its activities; or
(ii) Any private person which provides financial assistance to the
program, which is a third part payer covering patients in the program,
or which is a peer review organization performing a utilization or
quality control review.
(c) Medicare or Medicaid audit or evaluation. (1) For purposes of
Medicare or Medicaid audit or evaluation under this section, audit or
evaluation includes a civil or administrative investigation of the
program by any Federal, State, or local agency responsible for oversight
of the Medicare or Medicaid program and includes administrative
enforcement, against the program by the agency, of any remedy authorized
by law to be imposed as a result of the findings of the investigation.
(2) Consistent with the definition of program in Sec. 2.11, program
includes an employee of, or provider of medical services under, the
program when the employee or provider is the subject of a civil
investigation or administrative remedy, as those terms are used in
paragraph (c)(1) of this section.
(3) If a disclosure to a person is authorized under this section for
a Medicare or Medicaid audit or evaluation, including a civil
investigation or administrative remedy, as those terms are used in
paragraph (c)(1) of this section, then a peer review organization which
obtains the information under paragraph (a) or (b) may disclose the
information to that person but only for purposes of Medicare or Medicaid
audit or evaluation.
(4) The provisions of this paragraph do not authorize the agency,
the program, or any other person to disclose or use patient identifying
information obtained during the audit or evaluation for any purposes
other than those necessary to complete the Medicare or Medicaid audit or
evaluation activity as specified in this paragraph.
(d) Limitations on disclosure and use. Except as provided in
paragraph (c) of this section, patient identifying information disclosed
under this section may be disclosed only back to the program from which
it was obtained and used only to carry out an audit or evaluation
purpose or to investigate or prosecute criminal or other activities, as
authorized by a court order entered under Sec. 2.66 of these
regulations.
Subpart E--Court Orders Authorizing Disclosure and Use
Sec. 2.61 Legal effect of order.
(a) Effect. An order of a court of competent jurisdiction entered
under this subpart is a unique kind of court order. Its only purpose is
to authorize a disclosure or use of patient information which would
otherwise be prohibited by 42 U.S.C. 290ee-3, 42 U.S.C. 290dd-3 and
these regulations. Such an order does not compel disclosure. A subpoena
or a similar legal mandate must be issued in order to compel disclosure.
This mandate may be entered at the same
[[Page 23]]
time as and accompany an authorizing court order entered under these
regulations.
(b) Examples. (1) A person holding records subject to these
regulations receives a subpoena for those records: a response to the
subpoena is not permitted under the regulations unless an authorizing
court order is entered. The person may not disclose the records in
response to the subpoena unless a court of competent jurisdiction enters
an authorizing order under these regulations.
(2) An authorizing court order is entered under these regulations,
but the person authorized does not want to make the disclosure. If there
is no subpoena or other compulsory process or a subpoena for the records
has expired or been quashed, that person may refuse to make the
disclosure. Upon the entry of a valid subpoena or other compulsory
process the person authorized to disclose must disclose, unless there is
a valid legal defense to the process other than the confidentiality
restrictions of these regulations.
[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987]
Sec. 2.62 Order not applicable to records disclosed without consent to
researchers, auditors and evaluators.
A court order under these regulations may not authorize qualified
personnel, who have received patient identifying information without
consent for the purpose of conducting research, audit or evaluation, to
disclose that information or use it to conduct any criminal
investigation or prosecution of a patient. However, a court order under
Sec. 2.66 may authorize disclosure and use of records to investigate or
prosecute qualified personnel holding the records.
Sec. 2.63 Confidential communications.
(a) A court order under these regulations may authorize disclosure
of confidential communications made by a patient to a program in the
course of diagnosis, treatment, or referral for treatment only if:
(1) The disclosure is necessary to protect against an existing
threat to life or of serious bodily injury, including circumstances
which constitute suspected child abuse and neglect and verbal threats
against third parties;
(2) The disclosure is necessary in connection with investigation or
prosecution of an extremely serious crime, such as one which directly
threatens loss of life or serious bodily injury, including homicide,
rape, kidnapping, armed robbery, assault with a deadly weapon, or child
abuse and neglect; or
(3) The disclosure is in connection with litigation or an
administrative proceeding in which the patient offers testimony or other
evidence pertaining to the content of the confidential communications.
(b) [Reserved]
Sec. 2.64 Procedures and criteria for orders authorizing disclosures
for noncriminal purposes.
(a) Application. An order authorizing the disclosure of patient
records for purposes other than criminal investigation or prosecution
may be applied for by any person having a legally recognized interest in
the disclosure which is sought. The application may be filed separately
or as part of a pending civil action in which it appears that the
patient records are needed to provide evidence. An application must use
a fictitious name, such as John Doe, to refer to any patient and may not
contain or otherwise disclose any patient identifying information unless
the patient is the applicant or has given a written consent (meeting the
requirements of these regulations) to disclosure or the court has
ordered the record of the proceeding sealed from public scrunity.
(b) Notice. The patient and the person holding the records from whom
disclosure is sought must be given:
(1) Adequate notice in a manner which will not disclose patient
identifying information to other persons; and
(2) An opportunity to file a written response to the application, or
to appear in person, for the limited purpose of providing evidence on
the statutory and regulatory criteria for the issuance of the court
order.
(c) Review of evidence: Conduct of hearing. Any oral argument,
review of evidence, or hearing on the application must be held in the
judge's chambers or in some manner which ensures that patient
identifying information is not
[[Page 24]]
disclosed to anyone other than a party to the proceeding, the patient,
or the person holding the record, unless the patient requests an open
hearing in a manner which meets the written consent requirements of
these regulations. The proceeding may include an examination by the
judge of the patient records referred to in the application.
(d) Criteria for entry of order. An order under this section may be
entered only if the court determines that good cause exists. To make
this determination the court must find that:
(1) Other ways of obtaining the information are not available or
would not be effective; and
(2) The public interest and need for the disclosure outweigh the
potential injury to the patient, the physician-patient relationship and
the treatment services.
(e) Content of order. An order authorizing a disclosure must:
(1) Limit disclosure to those parts of the patient's record which
are essential to fulfill the objective of the order;
(2) Limit disclosure to those persons whose need for information is
the basis for the order; and
(3) Include such other measures as are necessary to limit disclosure
for the protection of the patient, the physician-patient relationship
and the treatment services; for example, sealing from public scrutiny
the record of any proceeding for which disclosure of a patient's record
has been ordered.
Sec. 2.65 Procedures and criteria for orders authorizing disclosure and
use of records to criminally investigate or prosecute
patients.
(a) Application. An order authorizing the disclosure or use of
patient records to criminally investigate or prosecute a patient may be
applied for by the person holding the records or by any person
conducting investigative or prosecutorial activities with respect to the
enforcement of criminal laws. The application may be filed separately,
as part of an application for a subpoena or other compulsory process, or
in a pending criminal action. An application must use a fictitious name
such as John Doe, to refer to any patient and may not contain or
otherwise disclose patient identifying information unless the court has
ordered the record of the proceeding sealed from public scrutiny.
(b) Notice and hearing. Unless an order under Sec. 2.66 is sought
with an order under this section, the person holding the records must be
given:
(1) Adequate notice (in a manner which will not disclose patient
identifying information to third parties) of an application by a person
performing a law enforcement function;
(2) An opportunity to appear and be heard for the limited purpose of
providing evidence on the statutory and regulatory criteria for the
issuance of the court order; and
(3) An opportunity to be represented by counsel independent of
counsel for an applicant who is a person performing a law enforcement
function.
(c) Review of evidence: Conduct of hearings. Any oral argument,
review of evidence, or hearing on the application shall be held in the
judge's chambers or in some other manner which ensures that patient
identifying information is not disclosed to anyone other than a party to
the proceedings, the patient, or the person holding the records. The
proceeding may include an examination by the judge of the patient
records referred to in the application.
(d) Criteria. A court may authorize the disclosure and use of
patient records for the purpose of conducting a criminal investigation
or prosecution of a patient only if the court finds that all of the
following criteria are met:
(1) The crime involved is extremely serious, such as one which
causes or directly threatens loss of life or serious bodily injury
including homicide, rape, kidnapping, armed robbery, assault with a
deadly weapon, and child abuse and neglect.
(2) There is a reasonable likelihood that the records will disclose
information of substantial value in the investigation or prosecution.
(3) Other ways of obtaining the information are not available or
would not be effective.
(4) The potential injury to the patient, to the physician-patient
relationship and to the ability of the program to provide services to
other patients is outweighed by the public interest and the need for the
disclosure.
[[Page 25]]
(5) If the applicant is a person performing a law enforcement
function that:
(i) The person holding the records has been afforded the opportunity
to be represented by independent counsel; and
(ii) Any person holding the records which is an entity within
Federal, State, or local government has in fact been represented by
counsel independent of the applicant.
(e) Content of order. Any order authorizing a disclosure or use of
patient records under this section must:
(1) Limit disclosure and use to those parts of the patient's record
which are essential to fulfill the objective of the order;
(2) Limit disclosure to those law enforcement and prosecutorial
officials who are responsible for, or are conducting, the investigation
or prosecution, and limit their use of the records to investigation and
prosecution of extremely serious crime or suspected crime specified in
the application; and
(3) Include such other measures as are necessary to limit disclosure
and use to the fulfillment of only that public interest and need found
by the court.
[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987]
Sec. 2.66 Procedures and criteria for orders authorizing disclosure and
use of records to investigate or prosecute a program or the
person holding the records.
(a) Application. (1) An order authorizing the disclosure or use of
patient records to criminally or administratively investigate or
prosecute a program or the person holding the records (or employees or
agents of that program or person) may be applied for by any
administrative, regulatory, supervisory, investigative, law enforcement,
or prosecutorial agency having jurisdiction over the program's or
person's activities.
(2) The application may be filed separately or as part of a pending
civil or criminal action against a program or the person holding the
records (or agents or employees of the program or person) in which it
appears that the patient records are needed to provide material
evidence. The application must use a fictitious name, such as John Doe,
to refer to any patient and may not contain or otherwise disclose any
patient identifying information unless the court has ordered the record
of the proceeding sealed from public scrutiny or the patient has given a
written consent (meeting the requirements of Sec. 2.31 of these
regulations) to that disclosure.
(b) Notice not required. An application under this section may, in
the discretion of the court, be granted without notice. Although no
express notice is required to the program, to the person holding the
records, or to any patient whose records are to be disclosed, upon
implementation of an order so granted any of the above persons must be
afforded an opportunity to seek revocation or amendment of that order,
limited to the presentation of evidence on the statutory and regulatory
criteria for the issuance of the court order.
(c) Requirements for order. An order under this section must be
entered in accordance with, and comply with the requirements of,
paragraphs (d) and (e) of Sec. 2.64 of these regulations.
(d) Limitations on disclosure and use of patient identifying
information: (1) An order entered under this section must require the
deletion of patient identifying information from any documents made
available to the public.
(2) No information obtained under this section may be used to
conduct any investigation or prosecution of a patient, or be used as the
basis for an application for an order under Sec. 2.65 of these
regulations.
Sec. 2.67 Orders authorizing the use of undercover agents and
informants to criminally investigate employees or agents of a
program.
(a) Application. A court order authorizing the placement of an
undercover agent or informant in a program as an employee or patient may
be applied for by any law enforcement or prosecutorial agency which has
reason to believe that employees or agents of the program are engaged in
criminal misconduct.
(b) Notice. The program director must be given adequate notice of
the application and an opportunity to appear and be heard (for the
limited purpose of
[[Page 26]]
providing evidence on the statutory and regulatory criteria for the
issuance of the court order), unless the application asserts a belief
that:
(1) The program director is involved in the criminal activities to
be investigated by the undercover agent or informant; or
(2) The program director will intentionally or unintentionally
disclose the proposed placement of an undercover agent or informant to
the employees or agents who are suspected of criminal activities.
(c) Criteria. An order under this section may be entered only if the
court determines that good cause exists. To make this determination the
court must find:
(1) There is reason to believe that an employee or agent of the
program is engaged in criminal activity;
(2) Other ways of obtaining evidence of this criminal activity are
not available or would not be effective; and
(3) The public interest and need for the placement of an undercover
agent or informant in the program outweigh the potential injury to
patients of the program, physician-patient relationships and the
treatment services.
(d) Content of order. An order authorizing the placement of an
undercover agent or informant in a program must:
(1) Specifically authorize the placement of an undercover agent or
an informant;
(2) Limit the total period of the placement to six months;
(3) Prohibit the undercover agent or informant from disclosing any
patient identifying information obtained from the placement except as
necessary to criminally investigate or prosecute employees or agents of
the program; and
(4) Include any other measures which are appropriate to limit any
potential disruption of the program by the placement and any potential
for a real or apparent breach of patient confidentiality; for example,
sealing from public scrutiny the record of any proceeding for which
disclosure of a patient's record has been ordered.
(e) Limitation on use of information. No information obtained by an
undercover agent or informant placed under this section may be used to
criminally investigate or prosecute any patient or as the basis for an
application for an order under Sec. 2.65 of these regulations.