TIP 14 — TIPs — Documents — Home

Chapter 6—Legal Issues in Outcomes Monitoring¹

Outcomes monitoring for alcohol and other drug (AOD) treatment is essential if advances are to be made. However, information about all persons receiving AOD abuse assessment, referral, and treatment services is protected by Federal laws and regulations (42 U.S.C.§§290dd-3 and ee-3 and 42 Code of Federal Regulations, Part 2).² Designed to protect patients' privacy rights in order to encourage people to enter treatment, the Federal confidentiality laws and regulations concerning AOD-related information are more restrictive of communications in many instances than, for example, either the doctor-patient or the attorney-client privilege.³ Outcomes monitoring systems must be designed with these rules in mind.

In addition, those designing outcomes monitoring systems that place burdens on AOD patients (for example, the burden of submitting to interviews) should obtain patients' informed consent to participate in the research. This kind of consent is different from the kind of patient consent that authorizes a program to release confidential information. In some outcomes monitoring systems, both kinds of consent will be called for. This chapter describes both kinds of patient consent.

The larger portion of this chapter examines how, given the restrictions on disclosure of information about patients in treatment, outcomes monitors can gain access to sufficient information to evaluate AOD programs. Although most treatment providers are familiar with the Federal regulations protecting patient-identified information, the rules are worth reviewing in the outcomes monitoring context. For example, do outcomes monitoring systems incorporating followup interviewing of patients require that patients sign consent forms permitting the release of information? How can those monitoring outcomes track patients in other social service systems? These kinds of questions are addressed in this chapter.

The chapter is divided into five parts. The first section outlines the scope of the Federal confidentiality laws and regulations. The rules governing researchers' access to information from AOD programs are described in the second section. The third section addresses the issues raised by research designs calling for followup with patients and with collateral sources, such as relatives, schools, and employers. Getting patients' informed consent to participate in outcomes monitoring systems that place a burden on them (such as submitting to interviews or permitting contact with others) is also discussed. The third section also examines the special challenges raised by outcomes monitoring that seeks to track patients to see whether they reenter the treatment system, receive social welfare benefits, or have encounters with the criminal justice system. The final section addresses mandatory reporting laws and coding information about patients.

The Federal confidentiality laws and regulations prohibit disclosure of information about patients who have applied for or received any alcohol or drug abuse-related services—including assessment, diagnosis, counseling, group counseling, treatment, or referral for treatment—from a covered program. The restrictions on disclosure apply to any information that would identify a patient as an alcohol or drug abuser, either directly or by implication. The general rule applies from the time the patient makes an appointment. It also applies to patients who are civilly or involuntarily committed, minor patients, patients who are mandated into treatment by the criminal justice system, and former patients. The rule applies whether or not the person making an inquiry already has the information, has other ways of getting it has official status, is authorized by State law, or comes armed with a subpoena or search warrant.

Any program that specializes, in whole or in part, in providing treatment, counseling and/or assessment, and referral services for patients with alcohol or drug problems must comply with the Federal confidentiality regulations (§§2.12(e)). The Federal regulations apply only to programs that receive Federal assistance, including indirect forms of Federal aid such as tax-exempt status, or State or local government funding coming (in whole or in part) from the Federal Government.⁴

Obtaining Information From AOD Programs

The Federal confidentiality regulations provide three ways for researchers to obtain information from AOD programs:

• The regulations permit AOD abuse treatment programs to give researchers access to information about patients when no patient-identifying information is revealed.⁵
• The regulations permit AOD programs to give researchers patient-identifying information without patients' consent when certain criteria are met.
• Researchers may also obtain information that is protected by the Federal confidentiality regulations if patients sign proper consent forms.

Access to data that do not contain patient-identifying information. The Federal regulations permit programs to disclose information about patients if the programs reveal no patient identifying information. "Patient-identifying information" is information that identifies an individual as an alcohol or drug abuser. Thus, a program can give researchers aggregate data about its population or some portion of its population. For example, a program staff member could tell a researcher engaged in outcomes monitoring that during the last year, 42 patients completed the treatment program, 67 dropped out in less than 6 months, and 25 left the program between 6 and 12 months.

The research, audit, and evaluation exceptions. The confidentiality regulations permit programs to disclose patient-identifying information to researchers, auditors, and evaluators without patient consent, providing certain safeguards are met (§§2.52, 2.53).

Research. AOD programs can disclose patient-identifying information to persons conducting "scientific research" if the program director determines that the researcher 1) is qualified to conduct the research, 2) has a protocol under which patient-identifying information will be kept in accordance with the regulations' security provisions (see §§2.16),⁶ and 3) has provided a written statement from a group of three or more independent individuals who have reviewed the protocol and determined that it protects patients' rights.

Researchers are prohibited from identifying any individual patient in any report or otherwise disclosing any patient identities except back to the program. This provision is addressed more fully below, as it is particularly important when a research design calls for followup research with the patient or collateral sources or for tracking patients in other health, social welfare, or criminal justice systems.

Audit and evaluation. Patient records may be reviewed on the program's premises for the purposes of conducting an audit or evaluation by the following entities:

• Federal, State, and local government agencies that fund or are authorized to regulate a program
• Private entities that fund or provide third-party payments to a program
• Peer review entities performing utilization or quality control review in order to conduct an audit or evaluation.⁷

Any person or entity reviewing patient records to perform an audit or conduct an evaluation must agree in writing that it will use the information only to carry out the audit or evaluation and that it will redisclose patient information only 1) back to the program, 2) in accordance with a court order to investigate or prosecute the program (§§2.66), or 3) to a government agency overseeing a Medicare or Medicaid audit or evaluation (§§2.53(a), (c), (d)). Any other person or entity that is determined by the program director to be qualified to conduct an audit or evaluation and that agrees in writing to abide by the restrictions on redisclosure can also review patient records. Again, the prohibition on redisclosure is particularly important when research designs include followup.

When a researcher seeking to interview patients or former patients meets the requirements of §§2.52 or 2.53, the Federal confidentiality regulations do not require that a program obtain a patient's consent under §§2.31 to release his or her name to the researcher. However, it is always better practice to obtain patients' consent to the release of their names to researchers, auditors, or evaluators seeking to approach them for interviews.

Consent

Researchers can also obtain patient-identifying information if the patient has agreed to the release of the information by signing a valid consent form that has not expired or been revoked (§§2.31). The regulations' requirements regarding consent are somewhat unusual and strict and must be carefully followed.

A proper consent form must be in writing and must contain each of the items contained in §§2.31:

• The name or general description of the program or person making the disclosure
• The name or title of the individual or organization that will receive the disclosure
• The name of the patient who is the subject of the disclosure
• The purpose or need for the disclosure
• How much and what kind of information will be disclosed
• A statement that the patient may revoke the consent at any time, except to the extent that the program or person authorized to make a disclosure has already acted in reliance on it
• The date, event, or condition upon which the consent expires, if not previously revoked
• The signature of the patient (and, in some States, his or her parent)
• The date on which the consent is signed.

A sample consent form is shown in Exhibit 6-1. A general medical release form or any consent form that does not contain all of the elements listed above is not acceptable.

Several items on this list merit further explanation:

The purpose of the disclosure and how much and what kind of information will be disclosed. These two items are closely related. All disclosures, and especially those made pursuant to a consent form, must be limited to information that is necessary to accomplish the need or purpose for the disclosure (§§2.13(a)). If the recipient of the information needs only one specific piece of information, it would be improper to disclose anything more.

In completing a consent form, it is important to determine the purpose or need for the communication of information. Once this need has been identified, it is easier to determine how much and what kind of information will be disclosed, tailoring it to the essentials needed to accomplish the identified need or purpose.

For example, a researcher may want to study length of stay in different treatment programs. If the researcher decides to use consent forms to obtain permission from patients to obtain this information from each program, he or she would specify the purpose of the disclosure as "verification of length of treatment" and the amount and kind of information to be disclosed as "enrollment and termination dates." The disclosure would then be limited to informing the

researcher of the dates of enrollment and termination for each patient.

Another example involves a researcher who wants to study not only the length of stay but also the reasons for termination from treatment. The consent form would specify the purpose of the disclosure as "verification of length of treatment and reasons for termination" and the amount and kind of information to be disclosed as "enrollment and termination dates and reasons for termination."⁸

The patient's right to revoke consent. The patient may revoke consent at any time and the consent form must include a statement to this effect. Revocation need not be in writing. If a program has already given information to a research or evaluation entity prior to the revocation, the program has acted in reliance on the consent and is not required to try to retrieve the information it has already disclosed.

Expiration of consent form. The form must also contain a date, event, or condition on which it will expire if not previously revoked. A consent must last "no longer than reasonably necessary to serve the purpose for which it is given" (§§2.31(a)(9)). The consent form does not need to contain a specific expiration date, but may instead specify an event or condition.

The signature when the patient is a minor (and the issue of parental consent). A minor must always sign the consent form in order for a program to release information, even to his or her parent or guardian. The program must get the parent's signature in addition only if the program was required by State law to obtain parental permission before providing treatment to the minor (§§2.14). ("Parent" includes parent, guardian, or other person legally responsible for the minor.)

In other words, if State law does not require the program to obtain parental consent in order to provide services to a minor, then parental consent is not required to make disclosures (§§2.14(b)). If State law requires parental consent in order to provide services to minors, then parental consent is required to make any disclosures. The program must always obtain the minor's consent for disclosures and cannot rely on the parent's signature alone.

Required notice against redisclosing information. Persons who receive patient identifying information from AOD programs are strictly prohibited from redisclosing that information (§§2.32). However, patients may sign consent forms authorizing redisclosures.

Research that follows patients for any period after they leave treatment presents special challenges. First, under the Federal regulations, no information the researcher or evaluator gained from the AOD program with the patient's consent or through the research, audit, and evaluation exceptions may be disclosed to anyone else. Yet, the researcher must locate the patient in order to collect followup data. Second, any research that can be perceived as imposing a burden on patients (for example, the burden of submitting to interviews) or that may require the researcher to contact either collateral sources or persons who can help locate patients in the future will require patients' informed consent to participate. This question is discussed first.

Obtaining Informed Consent

The best practice is to obtain patients' informed consent to participate in research that will impose a burden on them or that may require the researcher to contact others to inquire about the patient. This kind of consent is different from the consent discussed above, which authorizes an AOD program or researcher to disclose information to a third party.

Obtaining informed consents from patients ensures that they agree to participate in the research project; that they understand that, as part of the project, efforts will be made to locate them through the persons whose names they submit (or that they or collateral sources will be interviewed); and that they appreciate the risks of participation (see Exhibit 6-2). In research that involves followup, the risk to the patient is most likely limited to a disclosure that he or she was in AOD treatment. Obtaining informed consent does not authorize a researcher to make a disclosure of patient- identifying information to third parties. As will be discussed below, if followup research is designed and conducted with care, it need not involve disclosures to third parties. If disclosure will be made to third parties, the researcher must obtain patients' consent in accordance with §§2.31.

Conducting Followup Research

Locating and interviewing former patients without making any prohibited disclosures. To ensure that patients can be located months or years after they leave treatment, researchers sometimes ask for the names of persons with whom the patients are likely to have continued contact. Making inquiries in order to locate a former patient might seem at first glance to pose no risk to a patient's right to confidentiality; nevertheless, it does. For example, if a research entity were to tell a landlord, either directly or by implication, that was looking for Marvin Moe in order to see how well he was doing after treatment, it would be letting the landlord know that Marvin Moe had been in treatment. The Federal regulations clearly prohibit this kind of disclosure, unless the patient consents. Thus, when researchers and evaluators are trying to locate a patient, they must do so without disclosing to others any information about the patient's connection to AOD abuse treatment.

If followup contact is to be attempted over the telephone, the caller has to be sure he or she is talking to the patient before identifying himself or herself or mentioning a connection to the AOD program. For example, asking for Sally Soe when her husband or child answers the phone and announcing that the caller is from the Capitol City AOD Program (or the Drug Research Corporation) violates the regulations. The program (or research agency) may form another entity, without a hint of drugs or alcohol in its name (for example, Health Research, Inc.), that can contact former patients without worrying about disclosing information simply by giving its name.

When a representative of such an entity calls former patients, however, he or she still has to be careful that the patients are personally on the line before revealing any connection to the AOD program. It is a good idea for the research entity to have a set of scripted answers the caller can give when questioned by others about the purpose of the inquiry about the former patient.

If followup is to be done by mail, the return address should not disclose any information that could lead someone seeing the envelope to conclude that the former patient was in treatment.

Followup with collateral sources. Outcomes monitoring that collects data about patients from collateral sources raises a similar issue to that raised by followup with patients themselves: How can an inquiry be made of relatives (including parents), employers, schools, or social welfare agencies without violating the Federal regulations?

There are two ways to approach this problem. First, the outcomes monitor can structure the data gathering to avoid revealing that the patient was in AOD treatment. To accomplish this, the name of the entity that conducts the monitoring must be neutral, revealing nothing about an AOD connection. The questions asked of the collateral sources must also be drafted so that they offer those sources no information that would directly or implicitly link the patient with AOD abuse or treatment.

The second way an entity conducting outcomes monitoring can gather information from collateral sources is to obtain the patients' consent to disclose to the collateral source the fact that the patient was in AOD treatment. The special consent form required by §§2.31 of the regulations must be used to obtain the patient's consent. As outlined above, this form requires the research entity to state on the consent form the purpose of the disclosure—in this instance, outcomes monitoring research—and how much and what kind of information will be disclosed, in this instance, the fact that the patient was in AOD treatment. The form must also have an expiration date and a statement that consent can be revoked at any time.

Using a consent form to gather information from collateral sources may require more work initially—to obtain consent forms from all patients—but it provides more freedom to the researcher. With consent forms from patients, the researcher may ask questions about AOD use. However, care must still be taken to reveal only the limited information specified on the consent form. The researcher should have a system to keep track of the expiration dates of the consent forms being used.

Tracking patients in social welfare and criminal justice systems. In some cases, outcomes monitors will want to determine, by tracking patients, whether patients reenter the treatment system or receive other medical or social welfare benefits or have encounters with the criminal justice system. Because of the Federal confidentiality laws and regulations, special care must be taken in the design of any research in which an attempt is made to compare the names of patients who are receiving or have received AOD treatment with 1) the names of patients who previously received AOD treatment or who subsequently enter the treatment system, 2) the names of persons receiving other medical or social benefits, or 3) the names of persons arrested for criminal activity.

Clearly, the entity conducting outcomes monitoring cannot simply turn over the names of the patients of the programs it is evaluating to other AOD programs, medical or welfare authorities, or officials in the criminal justice system with a request that a search be made for the names. How, then, can these tasks be accomplished?

Tracking patients in the AOD system. Tracking whether or not patients reenter the treatment system generally requires the creation and continual updating of a database of patients' names. Over the course of the study, researchers compare the names submitted by treatment programs to the names already in the database. This kind of study can be accomplished in any one of three ways:

• Using patients' consents. All patients can sign consent forms that comply with §§2.31, permitting programs to disclose patient identifying information to researchers. The consent forms must specify the reason for the disclosure, what information will be disclosed to researchers, and an expiration date. (Note that this simple consent form does not permit the entity operating the database to disclose information to a treatment program or to anyone else.)
• Using the research, audit, and evaluation exception. If the entity conducting the outcome monitoring satisfies the requirements of §§2.52 or 2.53, programs can disclose patient-identifying information for entry into and comparison with a database of patients' names. Again, no information from one treatment program can be disclosed to another.
• Using the qualified service organization exception. The Federal confidentiality regulations permit AOD programs to enter into an agreement, called a qualified service organization agreement (QSOA), when they routinely need to share certain information with an outside agency that provides services to them. A QSOA is a written agreement between a program and a person or entity providing services to the program, in which that person or entity does the following (§§2.11, 2.12(c)(4)):

  1)Acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records from a program, it is fully bound by [the Federal confidentiality] regulations

  2)Promises that, if necessary, it will resist in judicial proceedings any efforts to obtain access to patient records except as permitted by these regulations.

An entity performing outcomes monitoring is providing a service to the program by studying how effective treatment is and how it might be improved. Disclosures made to an entity conducting outcomes monitoring with which programs have signed QSOAs must be limited to information that is needed to conduct the research. (See sample QSOA form in Exhibit 6-3.)

• Using the internal communications exception. The Federal regulations permit programs to disclose information to an entity that has direct administrative control over them if that entity needs "the information in connection with [its] duties that arise out of the provision of diagnosis, treatment or referral for treatment of alcohol or drug abuse" (§§2.12(c)(3).). If the entity conducting the outcomes monitoring is the single State agency (SSA), the programs it runs could disclose the information it needs in order to conduct that monitoring under this exception, without patients' consent. However, the SSA could not redisclose patient-identifying information to anyone else.

Tracking patients in health, social welfare, and criminal justice systems. The Federal confidentiality regulations' restrictions on the disclosure and redisclosure of patient-identifying information generally make it difficult to track whether or not patients seek treatment from other medical or mental healthcare providers, apply for welfare benefits, or are arrested by law enforcement authorities. As noted above, the entity conducting outcome monitoring cannot simply turn over the names in its database to medical or welfare authorities or to officials of the criminal justice system, since the Federal confidentiality regulations prohibit this kind of disclosure. How can an entity conducting outcomes monitoring compare a database of patients' names with a similar database created by the healthcare, welfare, or criminal justice systems?

A comparison of the names of patients in AOD programs with the names of patients receiving other medical or mental healthcare or welfare benefits can be accomplished in one of two ways:

• If the entity conducting the outcomes monitoring is an SSA that also administers programs and has jurisdiction over mental and mental healthcare and/or welfare.

As noted above, the Federal regulations permit programs to disclose information to an entity that has direct administrative control over them if that entity needs "the information in connection with [its] duties that arise out of the provision of diagnosis, treatment, or referral for treatment of alcohol or drug abuse" (§§2.12(c)(3)). If the entity conducting the outcomes monitoring is the SSA that runs AOD programs and also has jurisdiction over medical and mental healthcare, the AOD, medical, and mental healthcare providers under its jurisdiction could disclose the information the SSA needs in order to conduct outcomes monitoring under this exception. However, the SSA must resist the temptation to use this data for another purpose. For example, it could not redisclose the information (names) it receives from AOD treatment providers to other AOD treatment providers or to mental healthcare providers or welfare authorities.

• If the entity conducting the outcome monitoring is an SSA with jurisdiction solely over AOD treatment or is any other organization.

Using patients' consents. All AOD patients can sign consent forms that comply with §§2.31, permitting programs to disclose patient-identifying information to the entity conducting the research. The consent forms must specify the reason for the disclosure, what information will be disclosed to researchers, and an expiration date. Patients receiving care from other medical or mental healthcare providers can sign appropriate consent forms permitting those providers to disclose their names to the entity conducting the outcomes monitoring. No patient-identifying information that entity receives from AOD treatment programs can be redisclosed.

Using the research, audit, and evaluation exception for AOD information and patients' consents for other information. If the entity conducting the outcomes monitoring satisfies the requirements of §§2.52 or 2.53, programs can disclose patient-identifying information for entry into and comparison with a database of patients' names submitted by other medical and mental healthcare providers with patient consent.

Using the qualified service organization exception for AOD information and patients' consents for other information. The entity conducting outcomes monitoring could collect information from AOD programs by using a QSOA, as outlined above, and from medical care, mental health, and welfare authorities by using appropriate patient consent.

Tracking patients through the criminal justice system is particularly difficult. While an entity conducting outcomes monitoring can use any one of the mechanisms listed here to obtain the names of AOD patients, it may have difficulty obtaining information from the criminal justice system because of State laws protecting the confidentiality of that information.

Research and Mandatory Reporting Laws

If a researcher uncovers child abuse or neglect while reviewing a patient's chart or interviewing the patient, must he or she make a report to State authorities? How can a report be made under the Federal confidentiality laws and regulations?

Is the researcher required to report? All 50 States have statutes requiring reporting when there is reasonable cause to believe or suspect child abuse or neglect. While many State statutes are similar, each has different rules about what kinds of conditions must be reported,⁹ who must report, and when and how reports must be made. Most States now require not only physicians but also educators and social service workers to report child abuse. What is unclear, however, is whether or not persons conducting research are mandated reporters.¹⁰ This question is important because, as noted below, only those who are mandated by State law to report child abuse and neglect may do so under the Federal laws and regulations.

Because of the variation in State laws, researchers who are concerned about this issue should consult an attorney familiar with State law to determine whether they are mandated to report child abuse.

How can a researcher make a report? In 1986, the Federal confidentiality regulations were amended to permit AOD programs to comply with mandatory child abuse reporting laws. The Federal laws and regulations now permit compliance with State laws that require the reporting of child abuse and neglect. However, this exception to the general rule prohibiting disclosure of any information about a patient applies only to initial reports of child abuse or neglect. Programs and others cannot respond to followup requests for information or even subpoenas for additional information, even if the records are sought for use in civil or criminal proceedings resulting from the researcher's initial report, unless the patient consents or the appropriate court issues a special court order (see §§2.64 and 2.65).

Any researcher contemplating making a child abuse report would be wise to check with the program to see if a report has already been made.

Coding Patients' Identities

If a researcher codes patients' names to protect their identities, can the intricate rules of the Federal confidentiality laws and regulations be disregarded? It depends. As noted above, the Federal regulations protect "patient-identifying information." Section 2.11 of the regulations defines this to mean the name, address, social security number, fingerprints, photograph, or similar information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information. The term does not include a number assigned to a patient by a program, if that number does not consist of or contain numbers (such as a social security or a driver's license number) that could be used to identify a patient with reasonable accuracy and speed from sources external to the program.

Thus, if a research entity can truly code a patient's name so that the number created for each patient cannot be "used to identify a patient with reasonable accuracy and speed from sources external to the program," it need no longer be concerned with safeguarding information about the patient.

Outcomes monitoring systems must be designed with patients' interests in mind. Since both informed consent and issues of confidentiality can be central to research design, researchers should seek the advice of an attorney familiar with these issues to ensure that patients' rights are protected.

1. This chapter was written for the consensus panel by Margaret K. Brooks, Esq. The Center for Substance Abuse Treatment has published another document Confidentiality of Patient Records for Alcohol and Other Drug Treatment (Technical Assistance Publication Series 13) that addresses these issues.

2. Hereinafter, citations in this section in the form "§§2..." refer to specific sections of 42 C.F.R., Part 2, implementing the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act of 1970 (42 U.S.C. §§290dd-3) and the Drug Abuse Prevention, Treatment and Rehabilitation Act (42 U.S.C. §§290ee-3).

3. Violating the regulations by disclosing information is punishable by a fine of up to $500 for a first offense or up to $5,000 for each subsequent offense (§§2.4).

4. Two additional Federal laws permit the U.S. Attorney General and the Secretary of the U.S. Department of Health and Human Services (DHHS) to authorize researchers to withhold the names and identities of research subjects. The statute authorizing the Secretary of HHS to issue confidentiality certificates specifies that it applies to "persons engaged in biomedical, behavioral, clinical, or other research (including research on mental health, including research on the use and effect of alcohol and other psychoactive drugs)...." Once such authorization is issued, the researcher "may not be compelled in any Federal, State or local civil, criminal, administrative, legislative, or other proceeding to identify the subjects of research for which such authorization was obtained," (42 U.S.C. §§241(d) permits the Secretary of HHS to issue confidentiality certificates; 21 U.S.C. §§872(c) permits the U.S. Attorney General to issue confidentiality certificates).

These statutes may not be particularly useful for those conducting outcomes monitoring because most of the information they will gather will already be protected by the Federal confidentiality regulations. However, depending upon who gathers followup information from patients, it is possible that this information will not be protected by 42 C.F.R., Part 2, as it could be argued that the former patients are making voluntary disclosures of information about themselves directly to data gatherers. As with many questions about the design of outcomes monitoring, it is best to check with an attorney familiar with Federal and State laws and regulations for guidance.

5. "Patient-identifying information means the name, address, social security number, fingerprints, photograph, or similar information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information. The term does not include a number assigned to a patient by a program, if that number does not consist of or contain numbers (such as social security, or driver's license number) which could be used to identify a patient with reasonable accuracy and speed from sources external to the program" (§§2.11).

6. Section 2.16 requires programs to keep written records in a secure room, a locked file cabinet, a safe, or other similar container. The program should have written procedures that regulate access to and use of patients' records. Either the program director or a single staff person should be designated to process inquiries and requests for information.

7. These particular entities may also copy or remove records, but only if they agree in writing to maintain patient-identifying information in accordance with the regulations' security requirements (see §§2.16), to destroy all patient-identifying information when the audit or evaluation is completed, and to redisclose patient information only 1) back to the program, 2) in accordance with a court order to investigate or prosecute the program (§§2.66), or 3) to a government agency overseeing a Medicare or Medicaid audit or evaluation (§§2.53(b).

8. For a discussion of this issue in the context of a consent form permitting interviews with collateral sources, see the discussion on "Followup with collateral sources."

9. For instance, in some States, certain professionals are required to report pregnant women who abuse drugs to State authorities. If such a requirement is part of the State's mandatory child abuse reporting law, the Federal regulations permit the report. If a separate statute mandates the report, the Federal regulations probably do not permit the report.

10. Some State statutes are worded to require reports only from those persons who have face-to-face interaction with a child or adult who discloses abuse.

Last Updated 11-7-02