 
|
| Home | Documents | Information Exchange Services |
Special Topics |
Resources | State Information |
Online Resources |
|
This page contains links to external Web sites. Federal Register of TAP 11: Treatment for Alcohol and Other Drug Abuse: Opportunities for Coordination FEDERAL REGISTER/Vol. 52, No. 110/Tuesday, June 9, 1987/Rules and RegulationsDEPARTMENT OF HEALTH AND HUMAN SERVICES Public Health Service 42 CFR Part 2 Confidentiality of Alcohol and Drug Abuse Patient Records AGENCY: Alcohol, Drug Abuse, and Mental Health Administration, PHS, HHS. ACTION: Final rule. SUMMARY: This rule makes editorial and substantive changes in the "Confidentiality of Alcohol and Drug Abuse Patient Records" regulations. These changes are an outgrowth of the Department's commitment to make its regulations more understandable and less burdensome. The Final Rule clarifies and shortens the regulations and eases the burden of compliance. EFFECTIVE DATE: August 10, 1987. FOR FURTHER INFORMATION CONTACT:Judith T. Galloway (301) 443B3200. SUPPLEMENTARY INFORMATION: The "Confidentiality of Alcohol and Drug Abuse Patient Records" regulations, 42 CFR Part 2, implement two Federal statutory provisions applicable to alcohol abuse patient records (42 U.S.C. 290dd-3) and drug abuse patient records (42 U.S.C. 290ee-3). The regulations were originally promulgated in 1975 (40 FR 27802). In 1980 the Department invited public comment on 15 substantive issues arising out of its experience interpreting and implementing the regulations (45 FR 53). More than 450 public responses to that invitation were received and taken into consideration in the preparation of a 1983 Notice of Proposed Rule-making (48 FR 38758). Approximately 150 comments were received in response to the Notice of Proposed Rule-making and were taken into consideration in the preparation of this Final Rule. The proposed rule made both editorial and substantive changes in the regulations and shortened them by half. This Final Rule adopts most of those changes, with some significant substantive modifications and relatively few editorial and clarifying alterations. Synopsis of Substantive Provisions The Confidentiality of Alcohol and Drug Abuse Patient Record regulations (42 CFR Part 2) cover any program that is specialized to the extent that it holds itself out as providing and provides alcohol or drug abuse diagnosis, treatment, or referral for treatment and which is federally assisted, directly or indirectly (§ 2.12 (a) and (b)). The regulations prohibit disclosure or use of patient records ("records" meaning any information whether recorded or not) unless permitted by the regulations (§ 2.13). They do not prohibit giving a patient access to his or her own records (§ 2.23). However, the regulations alone do not compel disclosure in any case (§ 2.3(b)). The prohibition on disclosure applies to information obtained by the program which would identify a patient as an alcohol or drug abuser (§ 2.12(a)(1)). The restriction on use of information to investigate or to bring criminal charges against a patient applied to any alcohol or drug abuse information obtained by the program (§ 2.12(a)(2)). Any disclosure permitted under the regulations must be limited to that information which is necessary to carry out the purpose of the disclosure (§ 2.13). The regulations permit disclosure of information if the patient consents in writing in accordance with § 2.31. Any information disclosed with the patient's consent must be accompanied by a statement which prohibits further disclosure unless the consent expressly permits further disclosures or the redisclosure is otherwise permitted by the regulations (§ 2.32). Special rules govern disclosures with the patient's consent for the purpose of preventing multiple enrollments (§ 2.34) and for criminal justice referrals (§ 2.35). The regulations permit disclosure without patient consent if the disclosure is to medical personnel to meet any individual's bona fide medical emergency (§ 2.51) or to qualified personnel for research (§ 2.52), audit, or program evaluation (§ 2.53). Qualified personnel may not include patient identifying information in any report or otherwise disclose patient identities except back to the program which was the source of the information (§ 2.52(b) and 2.53(d)). The regulations permit disclosure pursuant to a court order after the court has made a finding that "good cause" exists. A court order may authorize disclosure for noncriminal purposes (§ 2.64); for the purpose of investigating or prosecuting a patient if the crime involved is extremely serious (§ 2.65); for the purpose of investigating or prosecuting a program or a person holding the records (§ 2.66); and for the purpose of placing an undercover agent or informant to criminally investigate employees or agents of the program (§ 2.67). A court order may not authorize disclosure of confidential communications unless disclosure is necessary to protect against an existing threat to life or serious bodily injury of another person; to investigate or prosecute an extremely serious crime; or if the patient brings the matter up in any legal proceedings (§ 2.63). A court order may not authorize qualified personnel who received information without patient consent for the purpose of conducting research, audit, or program evaluation, to disclose that information or to use it to conduct any criminal investigation or prosecution of a patient (§ 2.62). Information obtained under a court order to investigate or prosecute a program or other person holding the records or to place an undercover agent or informant may not be used to conduct any investigation or prosecution of a patient or as the basis for a court order to criminally investigate or prosecute a patient (§ 2.66(d)(2) and § 2.67(e)). These regulations do not apply to the Veteran's Administration, to exchanges within the Armed Forces or between the Armed Forces and the Veterans' Administration; to the reporting under State law of incidents of suspected child abuse and neglect to appropriate State or local authorities; to communications within a program or between a program and an entity having direct administrative control over the program; to communications between a program and a qualified service organization; and the disclosures to law enforcement officers concerning a patient's commission of (or threat to commit) crime at the program or against personnel of the program (§ 2.12(c)). If a person is not now and never has been a patient, there is no patient record and the regulations do not apply (§ 2.13(c)(2)). Any answer to a request for a disclosure of patient records which is not permitted must not affirmatively reveal that an identified individual has been or is an alcohol or drug patient. One way to make such an answer is to give a copy of the confidentiality regulations to the person who asked for the information along with general advice that the regulations restrict the disclosure of alcohol or drug abuse patient records and without identifying any person as an alcohol or drug abuse patient (§ 2.13(c)). Each patient must be told about these confidentiality provisions and furnished a summary in writing (§ 2.22). There is a criminal penalty for violating the regulations: not more than $500 for a first offense and not more than $5,000 for each subsequent offense. (§2.4). COMPARISON WITH PROPOSED RULE Subpart A–Introduction Reports of Violations Both the existing and proposed rules provide for the reporting of any violations of the regulations to the United States Attorney for the judicial district in which the violations occur, for reporting of violations on the part of methadone programs to the Regional Offices of the Food and Drug Administration, and for reporting violations by a Federal grantee or contractor to the Federal agency monitoring the grant or contract. (See §§ 2.7 and 2.5, respectively.) Inasmuch as it is the Department of Justice which has ultimate and sole responsibility for prosecuting violations of these regulations, the Final Rule continues.to provide for the reference of reports of any violations to the United States Attorney for the judicial district in which the violations occur. It also continues to provide for the reference to the Regional Offices of the Food and Drug Administration of any reports of violations by a methadone program. As a regulatory agency, the Food and Drug Administration has both the organization and authority to respond to alleged violations. The Final Rule no longer directs reports of violations by a Federal grantee or contractor to the Federal agency monitoring the grant or contract or, as in the proposed revision of the rules, violations by a Federal agency to the Federal agency responsible for the program. This change is made in recognition of the lack of investigative tools available to granting and contracting agencies and of the ultimate referral which must be made to the Department of Justice. Of course, if alleged violations come to the attention of the Department of Health and Human Services, they will be forwarded to an appropriate representative of the Department of Justice. Subpart B–General Provisions Specialized Programs Like the proposed rule at § 2.12, the Final Rule is applicable to any alcohol and drug abuse information obtained by a federally assisted alcohol or drug abuse program. "Program" is defined in § 2.11 as a person which says it provides and which actually provides alcohol or drug abuse diagnosis, treatment, or referral for treatment. A program may provide other services in addition to alcohol and drug abuse services, for example mental health or psychiatric services, and nevertheless be an alcohol or drug abuse program within the meaning of these regulations so long as the entity is specialized by holding itself out to the community as providing diagnosis, treatment, or referral for treatment for alcohol and/or drug abuse. If a facility is a provider of general medical care, it will not be viewed in whole or in part as a program unless it has either (1) an identified unit, i.e., a location that is set aside for the provision of alcohol or drug abuse diagnosis, treatment, or referral for treatment, or (2) it has personnel who are identified as providers of diagnosis, treatment, or referral for treatment and whose primary function is the provision of those alcohol or drug abuse services. Regardless of whether an entire legal entity is a program or if a part of the entity is a program, the confidentiality protections cover alcohol or drug abuse patient records within any federally assisted program, as "program" is defined in these regulations. Those comments opposed to limiting applicability of the regulations to "specialized" programs focused on the desirability of full and uniform applicability of confidentiality standards to any alcohol or drug abuse patient record irrespective of the type of facility delivering the services. The Department takes the position that limiting applicability to specialized programs, i.e., to those programs that hold themselves out as providing and which actually provide alcohol or drug abuse diagnosis, treatment, and referral for treatment, will simplify administration of the regulations without significantly affecting the incentive to seek treatment provided by the confidentiality protections. Applicability to specialized programs will lessen the adverse economic impact of the current regulations on a substantial number of facilities which provide alcohol and drug abuse care only as an incident to the provision of general medical care. We do not foresee that elimination of hospital emergency rooms and general medical or surgical wards from coverage will act as a significant deterrent to patients seeking assistance for alcohol and drug abuse. While some commenters suggested that there will be an increased administrative burden for organizations operating both a specialized alcohol and/or drug abuse program and providing other health services, we view this as the same burden facing all general medical care facilities under the existing rule. In many instances it is questionable whether applicability to general medical care facilities addresses the intent of Congress to enhance treatment incentives for alcohol and drug abuse inasmuch as many alcohol and/or drug abuse patients are treated in a general medical care facility not because they have made a decision to seek alcohol and drug abuse treatment but because they have suffered a trauma or have an acute condition with a primary diagnosis of other than alcohol or drug abuse. In sum, we are not persuaded that the existing burden on general medical care facilities is warranted by the benefit to patients in that setting. Therefore, the Final Rule retains the language of the proposed rule at § 2.11 defining "program" and making the regulations applicable at § 2.12 to any information about alcohol and/or drug abuse patients which is obtained by a federally assisted alcohol or drug abuse program for the purpose of treating, making a diagnosis for treatment, or making a referral for treatment of alcohol or drug abuse. Communications between a Program and an Entity Having Direct Administrative Control The existing regulations at § 2.11(p)(1) and the proposed rule at § 2.12(c)(3) exempt from the restrictions on disclosure communications of information within a program between or among personnel in connection with their duties or in connection with provision of patient care, respectively. The Department has previously interpreted the existing provision to mean that communications within a program may include communications to an administrative entity having direct control over the program. The Final Rule has incorporated that legal opinion into the text by amending § 2.12(C)(3) to exempt from restrictions on disclosure "communications of information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis treatment, or referral for treatment of alcohol or drug abuse" if the communications are within a program or between a program and an entity that has direct administrative control over the program. Paragraph (d) of that same section is accordingly amended to restrict any further disclosure by an administrative entity which receives information under § 2.12(c)(3). Explanation of Applicability The existing regulations are applicable to patient records maintained in connection with performance of any alcohol abuse or drug abuse prevention function which is federally assisted. Applicability is determined by the nature and purpose of the records, not the status or primary functional capacity of the recordkeeper. The definition of "alcohol abuse or drug abuse prevention function" includes specified activities "even when performed by an organization whose primary mission is in the field of law enforcement or is unrelated to alcohol or drugs." The proposed regulations and the Final Rule at § 2.12 make the regulations applicable to any information about alcohol and drug abuse patients which is obtained by a federally assisted alcohol or drug abuse program. A program is defined to be those persons or legal entities which hold themselves out as providing and which actually provide diagnosis, treatment, or referral for treatment for alcohol and/or drug abuse. Thus, there is a fundamental shift toward determining applicability on the basis of the function of the recordkeeper and away from making that decision based solely on the nature and purpose of the records. No alcohol and drug abuse patient records, whether identified by the nature and purpose of the records or the function of the recordkeeper, are covered by these regulations unless the diagnosis, treatment, or referral for treatment with which the records are connected is federally assisted. Several commenters pointed out that while the regulatory language of the proposed rule on its face applies the rule to information about alcohol and drug abuse patients in federally assisted programs, the explanation of the applicability provision at § 2.12(e)(2) obscures the otherwise forthright statement by an additional standard based on the type of Federal assistance going to the program, i.e., some patient records in a federally assisted program would be covered and others would not. Those who commented on this section urged that coverage distinctions under the explanation in § 2.12(e)(2) be omitted because they result in disparate treatment of patient records within an alcohol and/or drug abuse program based on the type of Federal assistance going to the program. Other commenters asserted that basing coverage on the type of assistance is inconsistent with the clear meaning of the applicability provision in the proposed and Final Rule. The Final Rule revises the proposed explanatory material at § 2.12(e)(2) to show that all alcohol and drug abuse patient records within a covered program are protected by the confidentiality provisions and that the record of an individual patient in an uncovered program, whose care is federally supported in some way which does not constitute Federal assistance to the program under § 2.l2(b), is not afforded confidentiality protections. Thus, where a Federal payment is made to a program on behalf of an individual patient and that program is not otherwise federally assisted under § 2.l2(b), the record of that individual will not be covered by the regulations. Although the Department expects them to be rare, it would be possible for such instances to occur. For example, if a Federal court places an individual in a for-profit program that is not certified under the Medicare program, that is not authorized to conduct methadone treatment, and is not otherwise federally assisted in any manner provided in § 2.12(b), the patient record of that individual would not be covered by the regulations even though the Federal court paid for the individual's treatment. Comments to the proposed rule were persuasive that the type of assistance should not affect the scope of records covered within a covered program. When the determination of covered records was based on the purpose and nature of each record, it was consistent to view Federal assistance from the perspective of each individual record. However, when the determination of which records are covered is based on who is keeping the records, as in the proposed and Final Rule, it is consistent with the approach to view Federal assistance from the program level as applying to all alcohol and drug abuse patient records within the program. Determining coverage based on Federal assistance to the program rather than to an individual represents a change in policy from the current regulations under which the Department views a Federal payment made on behalf of an individual as sufficient to cover that individual's record. However, any disadvantage in not covering individual records in those rare cases which may occur is outweighed by the advantages of consistency and efficiency in management of the program as a result of all alcohol and drug abuse patient records in the program being subject to the same confidentiality provisions. The Final Rule includes new material at § 2.12(e)(3) which briefly explains the types of information to which the restrictions are applicable, depending on whether a restriction is on disclosure or on use. A restriction on disclosure applies to any information which would identify a patient as an alcohol or drug abuser. The restriction on use of information to bring criminal charges or investigate a patient for a crime applies to any information obtained by the program for the purpose of diagnosis, treatment, or referral for treatment of alcohol or drug abuse. Several commenters strongly urged the explicit inclusion of school-based education and prevention programs in the applicability of the regulations. School-based education and prevention activities may fall within the definition of a program if they provide alcohol or drug abuse diagnosis, treatment, or referral for treatment and if they hold themselves out as so doing. That is reflected in the Final Rule at § 2.12(e)(1) with the inclusion of "school-based programs" in the list of entities which may come under the regulations. An example of how diagnosis affects coverage has been omitted at § 2.12(e)(3)(ii). It is omitted not because the example could never occur under the Final Rule, but because it is very unlikely that a "specialized" program, as program is defined under these regulations, would be treating a patient for a condition which is not related to alcohol or drug abuse such that the reference to a patient's alcohol or drug abuse history would not be related to the condition for which treatment is rendered. Inasmuch as the regulations only apply to programs, this example is more likely to confuse than provide guidance and for that reason has been taken out. Notifying a Parent or Guardian of a Minor's Application for Treatment The proposed rule at § 2.14 reorganized and revised but did not substantively amend the existing § 2.15 dealing with the subject of minor patients. Under both the existing and proposed rules, a minor patient's consent is generally required prior to notifying the minor's parent or guardian of his or her application for treatment. This is true even though without notification it is impossible to obtain parental consent in those cases where State law requires a parent, guardian, or other person to consent to alcohol or drug abuse treatment of a minor. While this issue was not raised in the proposed rule, the Department has received several inquiries on it from the public since the proposed rule was published suggesting that in those States, where the parent's or guardian's consent is needed for the minor's treatment, the program should be free to notify the parent or guardian of the minor's application for treatment without constraint. The Department has considered this issue and decided to make no substantive changes in the existing section dealing with minor patients. Although both the current rule and the proposed rule generally prohibit parental notification without the minor's consent, they also provide for an exception. Under this exception such notification would be permitted when, in the program director's judgment, the minor lacks the capacity to make a rational decision on the issue of notification, the situation poses a substantial threat to the physical well-being of the minor or any other person, and this threat may be alleviated by notifying the parent or guardian. Under this provision, the program director is vested with the authority to determine when the circumstances permitting parental notification arise. In discussing the Department's philosophy behind this provision, § 2.15B1(e) of the existing rule states: AIt [this provision] is based upon the theory that where a person is actually as well as legally incapable of acting in his own interest, disclosures to a person who is legally responsible for him may be made to the extent that the best interests of the patient clearly so require." While this exception would not permit parental notification without constraint, whenever the program director feels it is appropriate, the Department believes it does provide the program director with significant discretion and does permit parental notification in the most egregious cases where the "best interests of the patient clearly so require." Accordingly, the Department has determined not to make any substantive changes in the manner in which the existing rule handles the issue of parental notification. However, proposed § 2.14 has been revised to clarify that no change in meaning is intended from the current rule. Finally, it should be noted that this rule in no way compels a program to provide services to a minor without parental consent. Separation of Clinical from Financial/Administrative Records The current rules governing research, audit, or evaluation functions by a governmental agency at § 2.53 state that "programs should organize their records so that financial and administrative matters can be reviewed without disclosing clinical information and without disclosing patient identifying information except where necessary for audit verification." The proposed rule transformed this hortatory provision for maintenance of financial/administrative records apart from clinical records into a requirement in § 2.16 dealing with security for written records. Several commenters predicted that such a requirement will pose an extremely cumbersome burden on programs, perhaps tantamount to requiring maintenance of two systems of files. The Final Rule has adopted the recommendation of those commenters to drop this requirement, primarily on the basis of the potential administrative and recordkeeping problems it poses in the varied treatment settings to which these regulations are applicable. While it is desirable to withhold clinical information from any research, audit, or program evaluation function for which that clinical information is not absolutely essential, the Final Rule does not require recordkeeping practices designed to guarantee that outcome. The Final Rule does, of course, implement the statutory provisions which prohibits those who receive patient identifying information for the purpose of research, audits, or program evaluation from identifying, directly or indirectly, any individual patient in any report of such research, audit, or evaluation or otherwise disclosing patient identities in any manner (see §§ 2.52(b) and 2.53(d)). Subpart C–Disclosures with Patient's Consent " Notice to Patients Like the proposed rule, the Final Rule at § 2.22 requires that notice be given to patients that Federal law and regulations protect the confidentiality of alcohol and drug abuse patient records. The response to this provision in the proposed rule reflects strong support for notifying patients of confidentiality protections, although many stressed that the notice should be simplified in order to be useful rather than confusing to the patient. Some of those who recommended against adoption of a notice provision did so on grounds that the notice as proposed is too complex. Therefore, in response to many who supported the notice provision and those who opposed it on grounds that it is too complex, the Final Rule substantially revises the elements which must be included in the written notice to each patient and accordingly rewrites the sample notice which a program may adopt at its option in fulfillment of the notice requirement. Form of Written Consent The proposed rule retains the requirements in § 2.31 of the existing regulations for written consent to disclosure of information which would identify an individual as an alcohol or drug abuser. There was a great deal of support among those who commented on this provision for the retention of the existing elements of written consent on grounds that the present system is working well and that the elements which go to make up written consent are sufficiently detailed to assure an opportunity for a patient to make an informed consent to disclose patient identifying information. Others recommended a more generalized consent form. The Final Rule retains all elements previously required for written consent, though in one instance it will permit a more general description of the required information. The first of the required elements of written consent in both the existing and proposed rule (§ 2.31 (a)(1)) asks for the name of the program which is to make the disclosure. The Final Rule will amend that element by calling for A(1) The specific name or general designation of the program or person permitted to make the disclosure." This change will permit a patient to consent to disclosure from a category of facilities or from a single specified program. For example, a patient who chooses to authorize disclosure of all his or her records without the necessity of completing multiple consent forms or individually designating each program on a single consent form would consent to disclosure from all programs in which the patient has been enrolled as an alcohol or drug abuse patient. Or, a patient might narrow the scope of his or her consent to disclosure by permitting disclosure from all programs located in a specified city, from all programs operated by a named organization, or as now, the patient might limit consent to disclosure from a single named facility. (In this connection, the Department interprets the existing written consent requirements to permit consent to disclosure of information from many programs in one consent form by listing specifically each of those programs on the form.) This change generalizes the consent form with respect to only one element without diminishing the potential for a patient's making an informed consent to disclose patient identifying information. The patient is in position to be informed of any programs in which he or she was previously enrolled and from which he or she is willing to have information disclosed. With regard to deficient written consents, the Final Rule at § 2.31(c) reverts to language from the existing regulations rather than using the language of the proposed rule to express the idea that a disclosure may not be made on the basis of a written consent which does not contain all required elements in compliance with paragraph (a) of § 2.31. There was no intention in drafting the proposed rule to establish a different or more stringent standard than currently exists prohibiting disclosures without a conforming written consent. Because that was misunderstood by some, the Final Rule will not permit disclosures on the basis of a written consent which, "On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section . . ." Express Consent to Redisclosure Permitted Both the existing and proposed rules at § 2.32 prohibit redisclosure by a person who receives information from patient records pursuant to the written consent of the patient and who has been notified that the information is protected by Federal rules precluding redisclosure except as permitted by those Federal rules. However, the statement of the prohibition on redisclosure at § 2.32 does not make evident the Department's interpretation that it is possible for a patient, at the same time consent to disclosure is given, to consent to redisclosure in accordance with the Federal rules. The Final Rule rewords the statement of prohibition on redisclosure and adds the phrase shown in quotes below to the second sentence as follows:
The purpose of the added phrase is to acknowledge that redisclosure of information may be expressly permitted in the patient's written consent to disclosure. For example, a patient may consent to disclose pertinent information to an employment agency and at the same time permit the employment agency to redisclose this information to potential employers, thus making unnecessary additional consent forms for redisclosures to individual employers. Similarly, a patient may consent to disclose pertinent information to an insurance company for the purpose of claiming benefits, and at the same time consent to redisclosure by that insurance company to another organization or company for the purpose of administering the contract under which benefits are claimed by or on behalf of the patient. Patient Consent to Unrestricted Communications for the Purpose of Criminal Justice System Referrals Most of those who commented on the revision of § 2.35 generally supported the proposed changes. However, two State commenters encouraged retention of language in the existing regulations which explicitly permits a patient to consent to "unrestricted communications." Otherwise, those commenters say, the revision will act as a deterrent to criminal justice system referrals. Both the proposed and Final Rule omit most limitations on disclosures to which a patient may consent. The criteria for permitting release of information with patient consent under the Final Rule are: (1) A valid consent under § 2.31 and (2) a determination that the information disclosed is necessary to carry out the purpose for which the consent was given (§ 2.13(a)). Although special rules for disclosures in connection with criminal justice system referrals were retained, they do not restrict "how much and what kind of information" a patient may consent to have disclosed under § 2.31. Section 2.31(a)(5) places no restrictions on how much or what kind of information a patient may consent to have disclosed. That section simply requires that each written consent describe how much and what kind of information the patient consents to have disclosed. A patient may consent to disclosure of any information concerning his or her participation in a program. In the case of a consent for the purpose of a criminal justice system referral, consent to disclose "any information concerning my participation in the program" pursuant to § 2.31(a)(5) would permit "unrestricted communications" from the program to appropriate persons within the criminal justice system to the same extent permitted by the existing rule. Therefore, the Final Rule does not substantively alter § 2.35 as proposed. (Paragraph (c) has been reworded for clarity.) Subpart D–Disclosures Without Patient's Consent Elimination of the Requirement to Verify Medical Personnel Status The proposed regulations at § 2.51 implement the statutory provision which permits a disclosure "to medical personnel to the extent necessary to meet a bona fide medical emergency." The proposed rule added a requirement not contained in the existing § 2.51 that the program make a reasonable effort to verify that the recipient of the information is indeed medical personnel. The Final Rule deletes the proposed verification requirement in response to comments from several sources that such a requirement is unnecessary, will cause delay, and could possibly impede emergency treatment. In view of those comments and our interest in easing the burden of compliance where possible, the Final Rule does not require verification of the "medical personnel" status of the recipient of information in the face of a medical emergency. However, the statute permits disclosures only to medical personnel to meet a medical emergency and elimination of the verification requirement does not in any way expand upon the category of persons to whom a disclosure may be made to meet a medical emergency. Neither does elimination of the verification requirement affect the provision in the Final Rule at § 2.51(c) that a program document in the patient's records any disclosure which is made in the face of a medical emergency. Assessment of Research Risks The proposed regulations at § 2.52 modified and streamlined existing provisions in §§ 2.52 and 2.53 governing disclosures for scientific research. The proposal clarified that the determination of whether an individual is qualified to conduct scientific research would be left to the program director, and required that such qualified personnel have a research protocol which includes safeguards for storing patient identifying information and prohibits redisclosures except as allowed by these regulations. The Final Rule adds an additional condition: The program director must ensure that a written statement is furnished by the researcher that the research protocol has been reviewed by an independent group of three or more individuals who found that the rights of patients would be adequately protected and that the potential benefits of the research outweigh any potential risks to patient confidentiality posed by the disclosure of records. This revision was prompted by comment from both the public and private sectors that review of the research protocol for the purpose of ensuring the protection of human subjects participating in the research (in this case, the patients whose records are proposed for use in research) is imperative prior to permitting disclosure of patient identifying information for the conduct of scientific research. The requirement that researchers state in writing that the protocol has been reviewed for the protection of human subjects will provide an additional point of reference for the program director in determining whether to release patient identifying information for research purposes. Researchers who receive support from the Department and many other Federal agencies are required under regulations for the protection of human subjects to obtain review of their protocol from an "institutional review board (IRB)." Such boards generally are set up by the institution employing the researcher. Regulations require that IRBs be composed of persons with professional competence to review research, as well as persons who can judge sensitivity to community attitudes and ethical concerns. Documentation of review and approval by an IRB or by another group of at least three individuals, appropriately constituted to make judgments on issues concerning the protection of human subjects, would meet the new requirement in § 2.52(a)(3). Audit and Evaluation Activities by Nongovernmental Entities The proposed regulations at § 2.53 simplify and shorten the provisions on audit and evaluation activities and divide them into two categories: (1) Those activities that do not require copying or removal of patient records, and (2) those that require copying or removal of patient records. The proposed rule permits governmental agencies to conduct audit and evaluation activities in both categories. In addition, if no copying or removal of the records is involved, the program director may determine that other persons are "qualified personnel" for the purpose of conducting audit and evaluation activities. There is no provision for nongovernmental entities to perform any audit or evaluation activity if copying or removal of records is involved. In response to the proposed rule the Department received comment that third party payers should be permitted to copy or remove records containing patient identifying information as is permitted by governmental agencies that finance or regulate alcohol or drug abuse programs. Recognizing that private organizations, like governmental agencies, have a stake in the financial and programmatic integrity of treatment programs arising out of their financing of alcohol and drug abuse programs directly, out of peer review responsibilities, and as third party payers, the Final Rule permits access to patient identifying information for audit and evaluation activities by private organizations in circumstances identical to the access afforded governmental agencies. Specifically, if a private organization provides financial assistance to a program, is a third-party payer covering patients in the program, or is a peer review organization performing a utilization or quality control review, the Final Rule permits the private organization to have access to patient identifying information for the purpose of participating in audit and evaluation activities to the same extent and under the same conditions as a governmental agency. Audit and Evaluation of Medicare or Medicaid Programs In response to specific questions which have come to the Department's attention and in recognition of the continued importance of the integrity of the Medicare and Medicaid programs to the delivery of alcohol and drug abuse services, the Final Rule includes a new paragraph (c) in § 2.53 which clarifies the audit and evaluation provisions as they pertain to Medicare or Medicaid. Specifically, the new paragraph clarifies that the audit and evaluation function includes investigation for the purpose of administrative enforcement of any remedy imposed by law by any Federal, State, or local agency which has responsibility for oversight of the Medicare or Medicaid programs. The new paragraph makes explicit that the term "program" includes employees of or providers of medical services under an alcohol or drug abuse program. Finally, it clarifies that a peer review organization may communicate patient identifying information for the purpose of a Medicare or Medicaid audit or evaluation to the agency responsible for oversight of the Medicare or Medicaid program being evaluated or audited. Subpart E–Court Orders Authorizing Disclosure and Use Court-Ordered Disclosure of Confidential Communications The existing regulations at § 2.63 limit a court order to "objective" data and prohibit court-ordered disclosure of "communications by a patient to personnel of the program." The proposed regulations delete the provision restricting a court order to objective data and precluding an order from reaching "communications by a patient to personnel of the program." Deletion of that provision provoked considerable discussion and concern on the part of a large number of persons, 85% of whom opposed allowing court-ordered disclosure of non-objective data. The Final Rule at § 2.63 restores protection for many "communications by a patient to personnel of the program" and information which is of a non-objective nature, but it does not protect that information from court order in the face of an existing threat to a third party or in connection with an investigation or prosecution of an extremely serious crime. Because the existing regulations seem to be dealing uniformly with two related but not necessarily identical types of information, i.e., "objective" data and "communications by a patient to personnel of the program," the Final Rule drops those terms in favor of the term "confidential communications," a term in use since 1975 in existing § 2.63B1. "Confidential communications" are the essence of those matters to be afforded protection and are as readily identified as "objective" data. Furthermore, protection of "confidential communications" is more relevant to maintaining patient trust in a program than is protection of "communications by a patient to personnel of the program," a term which does not distinguish between the innocuous and the highly sensitive communication. Most comments in opposition to relaxing the court order limitations on confidential communications said that the potential for court-ordered disclosure of confidential communications will compromise the therapeutic environment, may deter some alcohol and drug abusers from entering treatment, and will yield information which may be readily misinterpreted or abused. While freedom to be absolutely candid in communicating with an alcohol or drug abuse program may have therapeutic benefits and may be an incentive to treatment, it is the position of the Department that those therapeutic benefits cannot take precedence over two circumstances which merit court-ordered disclosure of confidential communications. The first of these is a circumstance in which the patient poses a threat to any third party. Existing rules do not permit a court to authorize disclosure of any communication by a patient to a program; for example, that the patient is abusing a child or has expressed an intention to kill or seriously harm another person. The balance between patient confidentiality and an existing threat posed by the patient to life or of serious bodily injury to another person must be weighted in favor of permitting a court to order disclosure of confidential communications which are necessary to protect against such an existing threat. The second of these circumstance is one in which a patient's confidential communications to a program are necessary in connection with investigation or prosecution of an extremely serious crime, such as a crime which directly threatens loss of life or serious bodily injury. The Department takes the position that it is consistent with the intent of Congress and in the best interest of the Nation to permit the exercise of discretion by a court, within the context of the confidentiality law and regulations, to determine whether to authorize disclosure or use of confidential communications from a patient's treatment record in connection with such an investigation or prosecution. Our aim is to strike a balance between absolute confidentiality for "confidential communications" on one side and on the other, to protect against any existing threat to life or serious bodily harm to others and to bring to justice those being investigated or prosecuted for an extremely serious crime who may have inflicted such harm in the past. While many confidential communications will remain beyond the reach of a court order, revised § 2.63 of the Final Rule will permit a court to authorize disclosure of confidential communications if the disclosure is necessary to protect against an existing threat to life or serious bodily injury, if disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, or, as in the existing rule if disclosure is in connection with a legal proceeding in which the patient himself/herself offers testimony or evidence concerning the confidential communications. Open Hearing on Patient Request in Connection with a Court Order Courts authorizing disclosure for noncriminal purposes are required at § 2.64(c) of the Final Rule to conduct any oral argument, review of evidence, or hearing in the judge's chambers or in some manner that ensures patient identifying information is not disclosed to anyone who is not a party to the proceeding, to a party holding the record, or to the patient. The existing rules provide that a patient may request an open hearing. The proposed rule did not provide for the patient to request an open hearing. The existing and proposed rule provides that a patient may consent to use of his or her name rather than a fictitious name in any application for an order authorizing disclosure for noncriminal purposes. The existing rule requires "voluntary and intelligent" consent. The proposed rule ensures the quality of the consent by requiring that it be in writing and in compliance with § 2.31. Upon reconsideration, the Department has reinstated the provision permitting a patient to consent to an open hearing in a noncriminal proceeding but with the same formality as is required by the proposed rule for a consent by the patient to use his or her name in an application for an order. Therefore, the Final Rule at § 2.64(c) requires that any hearing be held in such a way as to maintain the patient's confidentiality "unless the patient requests an open hearing in a manner which meets the written consent requirements of these regulations." Content of Court Order–Sealing of Record as an Example The content of a court order authorizing disclosure for noncriminal purposes and any order for disclosure and use to investigate or prosecute a program or the person holding the records is limited at § 2.64(e) to essential information and limits disclosure to those persons who have a need for the information. In addition, the court is required to take such other measures as are necessary to limit disclosure to protect the patient, the physician-patient relationship, and the treatment services. We have included at § 2.64(e)(3) an example of one such measure which may be necessary: sealing the record of any proceeding for which disclosure of a patient's records has been ordered. It is the Department's experience that heightened awareness of this possibility by members of the treatment community and legal profession can limit dissemination of patient identifying information to those for whom the court determined "good cause" exists without turning all or a part of a patient's treatment record into public information. The Final Rule adds as an example of a measure which the court might take to protect the patient, the physician-patient relationship and the treatment service "sealing from public scrutiny the record of any proceeding for which disclosure of a patient's record has been ordered." A similar change has also been made in § 2.67(d)(4). Extremely Serious Crime as a Criterion for a Court Order to Investigate or Prosecute a Patient The proposed rule at § 2.64 purported to retain the existing standard with regard to court orders which may be issued for the purpose of investigating or prosecuting a patient; i.e., the standard that no court order may authorize disclosure and use of patient records for investigation or prosecution of nonserious crimes. In an effort to clarify the nature of those crimes for which a court may order disclosure and use of patient records to investigate or prosecute the patient, the proposed rule dropped the term "extremely serious" crime in favor of a more specific functional definition of a crime which "causes or directly threatens loss of life or serious bodily injury." While the proposed rule purported to retain the existing standard, comments received from law enforcement agencies have contested that outcome, asserting that the criterion as proposed would be significantly narrowed. Arguing in favor of a broader standard, law enforcement interests advocated a more flexible criterion which would permit courts to weigh relevant factors on a case-by-case basis. Inasmuch as the change in the proposed rule was intended to clarify–not to further limit–those crimes for which a court may authorize use of a patient's record to investigate or prosecute the patient, the Final Rule reinstates the existing language, "extremely serious." This broader criterion will permit more flexibility and discretion by the courts in deciding whether a crime is of a caliber which merits use of a patient's treatment record to investigate or prosecute the patient. The Final Rule names as examples of "extremely serious" crimes homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, and child abuse and neglect. Deleted from the list of proposed examples is "sale of illicit drugs." Based on the view that most patients in drug abuse treatment are vulnerable to a charge of sale of illicit drugs, many commenters asked that "sale of illicit drugs" not be categorically named as an extremely serious crime. To do so, they asserted, would make almost all patients in drug rehabilitation or treatment programs vulnerable to investigation or prosecution by means of court-ordered use of their own treatment records. While the Final Rule eliminates "sale of illicit drugs" as an example of an extremely serious crime, it does not alter the authority of a court to find that under appropriate circumstances sale of an illicit drug is, in fact, an extremely serious crime, and it reflects a decision to leave any such determination up to a court of competent jurisdiction which is called upon to order the use of a patient's treatment records to prosecute the patient in view of any circumstances known to the court. New Law To Permit Reporting of Child Abuse and Neglect Section 106 of Pub. L 99-401, the Children's Justice and Assistance Act of 1986, amends sections 523(e) and 527(e) of the Public Health Service Act (42 U.S.C. 29-0dd-(3)(e) and 42 U.S.C. 290ee-3(e)) to permit the reporting of suspected child abuse and neglect to appropriate State or local authorities in accordance with State law. The amended sections of the Public Health Service Act provide: The prohibitions of this section do not apply to the reporting under State law of incidents of suspected child abuse and neglect to the appropriate State or local authorities. This newly enacted statutory exception to the restrictions on disclosure of information which would identify an alcohol or drug abuse patient provides a straightforward avenue for making reports of incidents of suspected child abuse and neglect in accordance with State law without resort to devices explained in the preamble to the proposed rule, i.e., obtaining a court order, reporting without identifying the patient as an alcohol or drug abuser, getting the patient's written consent, entering into a qualified service organization agreement, or reporting a medical emergency to medical personnel. While the potential still exists for using the devices described in the proposed rule, there is no foreseeable reason to use them to report suspected child abuse and neglect in view of the amendment. Although the new law excepts reports of suspected child abuse and neglect from the statutory restrictions on disclosure and use, it does not affect the applicability of the restrictions to the original alcohol and drug abuse patient record maintained by the program. Accordingly, if, following a report of suspected child abuse or neglect, the appropriate State authorities wish to subpoena patient records (or program personnel to testify about patient records) for civil or criminal proceedings relating to the child abuse or neglect, appropriate authorization would be required under the statutes and regulations. While written patient consent would suffice for a civil proceeding, it would be necessary to obtain an authorizing court order under paragraph (b)(2)(C) of the confidentiality statutes and § 2.65 of the regulations for use of the record to criminally investigate or prosecute a patient. Editorial Changes The Final Rule makes very few editorial or clarifying changes to the regulations as proposed. Number, tense, punctuation, and sequential numbering are changed where appropriate. Definitions applicable only to prevention of multiple enrollments in detoxification and maintenance treatment programs are moved from the definitions section to § 2.34. Section 2.35(c) has been rewritten for clarity. A clarifying phrase or word is added to the definition of "patient identifying information" at § 2.11, to §2.19(a)(1) and (b)(1) and to § 2.31(a)(8). The phrase "or other" has been added to § 2.53(c) because a court order under § 2.66 may be issued to investigate a program for criminal or administrative purposes. At § 2.65(d)(3) alternative language is adopted consistent with language used elsewhere to express a similar thought. At § 2.65 (d)(4) the term "program" is used in lieu of "person holding the records" inasmuch as none but a program will be providing services to patient. Regulatory Procedures Executive Order 12291 This is not a major rule under Executive Order 12291. Overall costs to general medical care facilities will be reduced as a result of the decision to apply the regulations only to specialized alcohol and drug abuse treatment programs. Cost to covered programs will be reduced somewhat by simplification of the rules. The amendments do not have an annual effect on the economy of $100 million or more or otherwise meet the criteria for a major rule under the Executive Order. Thus, no regulatory analysis is required. Regulatory Flexibility Act As a result of the decision to apply the regulations only to specialized alcohol and drug abuse treatment programs, the Final Rule will not have a significant economic impact on a substantial number of small entities. The regulations will no longer apply to general medical care providers which render alcohol or drug abuse services incident to their general medical care functions; thus, the number of small entities affected will be less than substantial. The economic impact will be less than significant because much of that impact arises from the cost of determining that the records of a general medical care patient are subject to the regulations and thereafter treating those records differently than all others in the general medical care facility. It is anticipated that programs covered by these rules will realize a small savings as a result of the simplification of the rules. Information Collection Requirements Information collection requirements in this Final Rule are: (1) Obtaining written patient consent (§ 2.31(a)). (2) Notifying each patient of confidentiality provisions (§ 2.22), and (3) Documenting any disclosure to meet a medical emergency (§ 2.51). The information collection requirements contained in these final regulations have been approved by the Office of Management and Budget under section 3504(h) of the Paperwork Reduction Act of 1980 and have been assigned control number 0930-0099, approved for use through April 30, 1989. List of Subjects in 42 CFR Part 2 Alcohol abuse, Alcoholism Confidentiality, Drug abuse, Health records, Privacy.
Robert E. Windom, Assistant Secretary for Health.
Otis R. Bowen, Secretary. The amendments to 42 CFR Part 2 are hereby adopted as revised and set forth below: PART 2–CONFIDENTIALITY OF ALCOHOL AND DRUG ABUSE PATIENT RECORDS Subpart A–Introduction Sec.
Subpart B–General Provisions
Subpart C–Disclosures With Patient's Consent Sec.
Subpart D–Disclosures Without Patient Consent
Subpart E–Court Orders Authorizing Disclosures and Use
Authority: Sec. 408 of Pub. L. 92-255, 86 Stat. 79, as amended by sec. 303 (a), (b) of Pub. L. 93-282, 83 Stat. 137,138; sec. 4(c)(5)(A) of Pub. L. 94-237, 90 Stat. 244; sec. 111(c)(3) of Pub. L. 94-581, 90 Stat. 2852; sec. 509 of Pub. L. 96-88, 93 Stat. 695; sec. 973(d) of Pub. L. 97-35, 95 Stat. 598; and transferred to sec. 527 of the Public Health Service Act by sec. 2(b)(16)(B) of Pub. L. 98-24, 97 Stat. 182 and as amended by sec. 106 of Pub. L. 99-401, 100 Stat. 907 (42 U.S.C. 290ee-3) and sec. 333 of Pub. L. 91-616, 84 Stat. 1853, as amended by sec. 122(a) of Pub. L. 93-282, 88 Stat. 131; and sec. 111(c)(4) of Pub. L. 94-581, 90 Stat. 2852 and transferred to sec. 523 of the Public Health Service Act by sec. 2(b)(13) of Pub. L. 98-24, 97 Stat. 181 and as amended by sec. 106 of Pub. L. 99-401, 100 Stat. 907 (42 U.S.C. 290dd-3). Subpart A–Introduction § 2.1 Statutory authority for confidentiality of drug abuse patient records. The restrictions of these regulations upon the disclosure and use of drug abuse patient records were initially authorized by section 408 of the Drug Abuse Prevention, Treatment, and Rehabilitation Act (21 U.S.C. 1175). That section as amended was transferred by Pub. L. 98-24 to section 527 of the Public Health Service Act which is codified at 42 U.S.C. 290ee-3. The amended statutory authority is set forth below: Section 290ee-3. Confidentiality of patient records. (a) Disclosure authorization Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any drug abuse prevention function conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b) of this section. (b) Purposes and circumstances of disclosure affecting consenting patient and patient regardless of consent (1) The content of any record referred to in subsection (a) of this section may be disclosed in accordance with the prior written consent of the patient with respect to whom such record is maintained, but only to such extent, under such circumstances, and for such purposes as may be allowed under regulations prescribed pursuant to subsection (g) of this section. (2) Whether or not the patient, with respect to whom any given record referred to in subsection (a) of this section is maintained, gives his written consent, the content of such record may be disclosed as follows: (A) To medical personnel to the extent necessary to meet a bona fide medical emergency. (B) To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual patient in any report of such research, audit, or evaluation, or otherwise disclose patient identities in any manner. (C) If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor. In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure. (c) Prohibition against use of record in making criminal charges or investigation of patient Except as authorized by a court order granted under subsection (b)(2)(C) of this section, no record referred to in subsection (a) of this section may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient. (d) Continuing prohibition against disclosure irrespective of status as patient The prohibitions of this section continue to apply to records concerning any individual who has been a patient, irrespective of whether or when he ceases to be a patient. (e) Armed Forces and Veterans' Administration; interchange of records; report of suspected child abuse and neglect to State or local authorities The prohibitions of this section do not apply to any interchange of records: (1) within the Armed Forces or within those components of the Veterans' Administration furnishing health care to veterans, or (2) between such components and the Armed Forces. The prohibitions of this section do not apply to the report in and under State law of incidents of suspected child abuse and neglect to the appropriate State or local authorities. (f) Penalty for first and subsequent offenses Any person who violates any provision of this section or any regulation issued pursuant to this section shall be fined not more than $500 in the case of a first offense, and not more than $5,000 in the case of each subsequent offense. (g) Regulations; inter-agency consultations; definitions, safeguards, and procedures, including procedures and criteria for issuance and scope of orders Except as provided in subsection (h) of this section, the Secretary, after consultation with the Administrator of Veterans' Affairs and the heads of other Federal departments and agencies substantially affected thereby, shall prescribe regulations to carry out the purposes of this section. These regulations may contain such definitions, and may provide for such safeguards and procedures, including procedures and criteria for the issuance and scope of orders under subsection (b)(2)(C) of this section, as in the judgment of the Secretary are necessary or proper to effectuate the purposes of this section, to prevent circumvention or evasion thereof, or to facilitate compliance therewith. (Subsection (h) was superseded by section 111(c)(3) of Pub. L. 94-581. The responsibility of the Administrator of Veterans' Affairs to write regulations to provide for confidentiality of drug abuse patient records under Title 38 was moved from 21 U.S.C. 1175 to 38 U.S.C. 4134.) § 2.2 Statutory authority for confidentiality of alcohol abuse patient records. The restrictions of these regulations upon the disclosure and use of alcohol abuse patient records were initially authorized by section 333 of the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970 (42 U.S.C. 4582). The section as amended was transferred by Pub. L. 98-24 to section 523 of the Public Health Service Act which is codified at 42 U.S.C. 290ee-3. The amended statutory authority is set forth below: Section 290dd-3. Confidentiality of patient records (a) Disclosure authorization Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to alcoholism or alcohol abuse education, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b) of this section. (b) Purposes and circumstances of disclosure affecting consenting patient and patient regardless of consent (1) The content of any record referred to in subsection (a) of this section may be disclosed in accordance with the prior written consent of the patient with respect to whom such record is maintained, but only to such extent, under such circumstances, and for such purposes as may be allowed under regulations prescribed pursuant to subsection (g) of this section. (2) Whether or not the patient, with respect to whom any given record referred to in subsection (a) of this section is maintained, gives his written consent, the content of such record may be disclosed as follows: (A) To medical personnel to the extent necessary to meet a bona fide medical emergency. (B) To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual patient in any report of such research, audit, or evaluation, or otherwise disclose patient identities in any manner. (C) If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor. In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure. (c) Prohibition against use of record in making criminal charges or investigation of patient Except as authorized by a court order granted under subsection (b)(2)(C) of this section, no record referred to in subsection (a) of this section may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient. (d) Continuing prohibition against disclosures irrespective of status as patient. The prohibitions of this section continue to apply to records concerning any individual who has been a patient, irrespective of whether or when he ceases to be a patient. (e) Armed Forces and Veterans' Administration; interchanges of record of suspected child abuse and neglect to State or local authorities. The prohibitions of this section do not apply to any interchange of records– (1) within the Armed Forces or within those components of the Veterans' Administration furnishing health care to veterans, or (2) between such components and the Armed Forces.The prohibitions of this section do not apply to the reporting under State law of incidents of suspected child abuse and neglect to the appropriate State or local authorities. (f) Penalty for first and subsequent offenses Any person who violates any provision of this section or any regulation issued pursuant to this section shall be fined not more than $500 in the case of a first offense, and not more than $5,000 in the case of each subsequent offense. (g) Regulations of Secretary; definitions, safeguards, and procedures, including procedures and criteria for issuance and scope of orders Except as provided in subsection (h) of this section, the Secretary shall prescribe regulations to carry out the purposes of this section. These regulations may contain such definitions, and may provide for such safeguards and procedures, including procedures and criteria for the issuance and scope of orders under subsection(b)(2)(C) of this section, as in the judgment of the Secretary are necessary or proper to effectuate the purposes of this section, to prevent circumvention or evasion thereof, or to facilitate compliance therewith. (Subsection (h) was superseded by section 111(c)(4) of Pub. L. 94-581. The responsibility of the Administrator of Veterans' Affairs to write regulations to provide for confidentiality of alcohol abuse patient records under Title 38 was moved from 42 U.S.C. 4582 to 38 U.S.C. 4134). § 2.3 Purpose and effect (a) Purpose. Under the statutory provisions quoted in §§ 2.1 and 2.2, these regulations impose restrictions upon the disclosure and use of alcohol and drug abuse patient records which are maintained in connection with the performance of any federally assisted alcohol and drug abuse program. The regulations specify: (1) Definitions, applicability, and general restrictions in Subpart B (definitions applicable to § 2.34 only appear in that section); (2) Disclosures which may be made with written patient consent and the form of the written consent in Subpart C; (3) Disclosures which may be made without written patient consent or an authorizing court order in Subpart D; and (4) Disclosures and uses of patient records which may be made with an authorizing court order and the procedures and criteria for the entry and scope of those orders in Subpart E. (b) Effect. (1) These regulations prohibit the disclosure and use of patient records unless certain circumstances exist. If any circumstances exists under which disclosure is permitted, that circumstance acts to remove the prohibition on disclosure but it does not compel disclosure. Thus, the regulations do not require disclosure under any circumstances. (2) These regulations are not intended to direct the manner in which substantive functions such as research, treatment, and evaluation are carried out. They are intended to insure that an alcohol or drug abuse patient in a federally assisted alcohol or drug abuse program is not made more vulnerable by reason of the availability of his or her patient record than an individual who has an alcohol or drug problem and who does not seek treatment. (3) Because there is a criminal penalty (a fine–see 42 U.S.C. 290ee-3(f), 42 U.S.C. 290dd-3(f) and 42 CFR § 2.4) for violating the regulations, they are to be construed strictly in favor of the potential violator in the same manner as a criminal statute (see M. Kraas & Brothers v. United States, 327 U.S. 614, 621-22, 66 S. Ct. 705, 707-08 (1946)). § 2.4 Criminal penalty for violation. Under 42 U.S.C. 290ee-3(f) and 42 U.S.C. 290dd-3(f), any person who violates any provision of those statutes or these regulations shall be fined not more than $500 in the case of a first offense, and not more than $5,000 in the case of each subsequent offense. § 2.5 Report of violations. (a) The report of any violation of these regulations may be directed to the United States Attorney for the judicial district in which the violation occurs. (b) The report of any violation of these regulations by a methadone program may be directed to the Regional Offices of the Food and Drug Administration. Subpart B–General Provisions § 2.11 Definitions. For purposes of these regulations: Alcohol abuse means the use of an alcoholic beverage which impairs the physical, mental, emotional, or social well-being of the user. Drug abuse means the use of a psychoactive substance for other than medicinal purposes which impairs the physical, mental, emotional, or social well-being of the user. Diagnosis means any reference to an individual's alcohol or drug abuse or to a condition which is identified as having been caused by that abuse which is made for the purpose of treatment or referral for treatment. Disclose or disclosure means a communication of patient identifying information, the affirmative verification of another person's communication of patient identifying information, or the communication of any information from the record of a patient who has been identified. Informant means an individual: (a) Who is a patient or employee of a program or who becomes a patient or employee of a program at the request of a law enforcement agency or official: and (b) Who at the request of a law enforcement agency or official observes one or more patients or employees of the program for the purpose of reporting the information obtained to the law enforcement agency or official. Patient means any individual who has applied for or been given diagnosis or treatment for alcohol or drug abuse at a federally assisted program and includes any individual who, after arrest on a criminal charge, is identified as an alcohol or drug abuser in order to determine that individual's eligibility to participate in a program. Patient identifying information means the name, address, social security number, fingerprints, photograph, or similar information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information. The term does not include a number assigned to a patient by a program, if that number does not consist of, or contain numbers (such as a social security or driver's license number) which could be used to identify a patient with reasonable accuracy and speed from sources external to the program. Person means an individual, partnership, corporation, Federal, State or local government agency, or any other legal entity. Program means a person which in whole or in part holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment, or referral for treatment. For a general medical care facility or any part thereof to be a program, it must have: (a) An identified unit which provides alcohol or drug abuse diagnosis, treatment, or referral for treatment or (b) Medical personnel or other staff whose primary function is the provision of alcohol or drug abuse diagnosis, treatment, or referral for treatment and who are identified as such providers. Program director means: (a) In the case of a program which is an individual, that individual; (b) In the case of a program which is an organization, the individual designated as director, managing director, or otherwise vested with authority to act as chief executive of the organization. Qualified service organization means a person which: (a) Provides services to a program, such as data processing, bill collecting, dosage preparation, laboratory analyses, or legal, medical, accounting, or other professional services, or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy, and (b) Has entered into a written agreement with a program under which that person: (1) Acknowledges that in receiving, storing, processing or otherwise dealing with any patient records from the programs, it is fully bound by these regulations; and (2) If necessary, will resist in judicial proceedings any efforts to obtain access to patient records except as permitted by these regulations. Records means any information, whether recorded or not, relating to a patient received or acquired by a federally assisted alcohol or drug program. Third party payer means a person who pays, or agrees to pay, for diagnosis or treatment furnished to a patient on the basis of a contractual relationship with the patient or a member of his family or on the basis of the patient's eligibility for Federal, State, or local governmental benefits. Treatment means the management and care of a patient suffering from alcohol or drug abuse, a condition which is identified as having been caused by that abuse, or both, in order to reduce or eliminate the adverse effects upon the patient. Undercover agent means an officer of any Federal, State, or local law enforcement agency who enrolls in or becomes an employee of a program for the purpose of investigating a suspected violation of law or who pursues that purpose after enrolling or becoming employed for other purposes. § 2.12 Applicability. (a) General–(1) Restrictions on disclosure. The restrictions on disclosure in these regulations apply to any information whether or not recorded, which: (i) Would identify a patient as an alcohol or drug abuser either directly, by reference to other publicly available information, or through verification of such an identification by another person; and (ii) Is drug abuse information obtained by a federally assisted drug abuse program after March 20, 1972, or is alcohol abuse information obtained by a federally assisted alcohol abuse program after May 13, 1974 (or if obtained before the pertinent date, is maintained by a federally assisted alcohol or drug abuse program after that date as part of an ongoing treatment episode which extends past that date) for the purpose of treating alcohol or drug abuse making a diagnosis for that treatment, or making a referral for that treatment. (2) Restriction on use. The restriction on use of information to initiate or substantiate any criminal charges against a patient or to conduct any criminal investigation of a patient (42 U.S.C. 290ee-3(c) 42 U.S.C. 290dd-3(c)) applies to any information whether or not recorded which is drug abuse information obtained by a federally assisted drug abuse program after March 20, 1972, or is alcohol abuse information obtained by a federally assisted alcohol abuse program after May 13, 1974 (or if obtained before the pertinent date, is maintained by a federally assisted alcohol or drug abuse program after that date as part of an ongoing treatment episode which extends past that date), for the purpose of treating alcohol or drug abuse, making a diagnosis for the treatment, or making a referral for the treatment. (b) Federal assistance. An alcohol abuse or drug abuse program is considered to be federally assisted if: (1) It is conducted in whole or in part, whether directly or by contract or otherwise by any department or agency of the United States (but see paragraphs (c)(1) and (c)(2) of this section relating to the Veterans' Administration and the Armed Forces); (2) It is being carried out under a license, certification, registration, or other authorization granted by any department or agency of the United States including but not limited to: (i) Certification of provider status under the Medicare program, (ii) Authorization to conduct methadone maintenance treatment (see 21 CFR 291.505); or (iii) Registration to dispense a substance under the Controlled Substances Act to the extent the controlled substance is used in the treatment of alcohol or drug abuse; (3) It is supported by funds provided by any department or agency of the United States by being: (i) A recipient of Federal financial assistance in any form, including financial assistance which does not directly pay for the alcohol or drug abuse diagnosis, treatment, or referral activities; or (ii) Conducted by a State or local government until which, through general or special revenue sharing or other forms of assistance, receives Federal funds which could be (but are not necessarily) spent for the alcohol or drug abuse program; or (4) It is assisted by the Internal Revenue Service of the Department of the Treasury through the allowance of income tax deductions for contributions to the program or through the granting of tax exempt status to the program. (c) Exceptions–(1) Veterans' Administration. These regulations do not apply to information on alcohol and drug abuse patients maintained in connection with the Veterans' Administration provisions of hospital care, nursing home care, domiciliary care, and medical services under Title 38, United States Code. Those records are governed by 38 U.S.C. 4132 and regulations issued under that authority by the Administrator of Veterans' Affairs. (2) Armed Forces. These regulations apply to any information described in paragraph (a) of this section which was obtained by any component of the Armed Forces during a period when the patient was subject to the Uniform Code of Military Justice except: (i) Any interchange of that information within the Armed Forces; and (ii) Any interchange of that information between the Armed Forces and those components of the Veterans' Administration furnishing health care to veterans. (3) Communication within a program or between a program and an entity having direct administrative control over that program. The restrictions on disclosure in these regulations do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of alcohol or drug abuse if the communications are (i) within a program or (ii) between a program and an entity that has direct administrative control over the program. (4) Qualified Service Organizations. The restrictions on disclosure in these regulations do not apply to communications between a program and a qualified service organization of information needed by the organization to provide services to the program. (5) Crimes on program premises or against program personnel. The restrictions on disclosure and use in these regulations do not apply to communications from program personnel to law enforcement officers which– (i) Are directly related to a patient's commission of a crime on the premises of the program or against program personnel or to a threat to commit such a crime; and (ii) Are limited to the circumstances of the incident, including the patient status of the individual committing or threatening to commit the crime, that individual's name and address, and that individual's last known whereabouts. (6) Reports of suspected child abuse and neglect. The restrictions on disclosure and use in these regulations do not apply to the reporting under State law of incidents of suspected child abuse and neglect to the appropriate State or local authorities. However, the restrictions continue to apply to the original alcohol or drug abuse patient records maintained by the program including their disclosure and use for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect. (d) Applicability to recipients of information–(1) Restriction on use of information. The restriction on the use of any information subject to these regulations to initiate or substantiate any criminal charges against a patient or to conduct any criminal investigation of a patient applies to any person who obtains that information from a federally assisted alcohol or drug abuse program, regardless of the status of the person obtaining the information or of whether the information was obtained in accordance with these regulations. This restriction on use bars, among other things, the introduction of that information as evidence in a criminal proceeding and any other use of the information to investigate or prosecute a patient with respect to a suspected crime. Information obtained by undercover agents or informants (see § 2.17) or through patient access (see § 2.23) is subject to the restriction on use. (2) Restrictions on disclosures– Third party payers, administrative entities, and others. The restrictions on disclosure in these regulations apply to: (i) Third party payers with regard to records disclosed to them by federally assisted alcohol or drug abuse programs; (ii) Entities having direct administrative control over programs with regard to information communicated to them by the program under § 2.12(c)(3); and (iii) Persons who receive patient records directly from a federally assisted alcohol or drug abuse program and who are notified of the restrictions on redisclosure of the records in accordance with § 2.32 of these regulations. (e) Explanation of applicability–(1) Coverage. These regulations cover any information (including information on referral and intake) about alcohol and drug abuse patients obtained by a program (as the terms "patient" and "program" are defined in § 2.11) if the program is federally assisted in any manner described in § 2.12(b). Coverage includes, but is not limited to, those treatment or rehabilitation programs, employee assistance programs, programs within general hospitals, school-based programs, and private practitioners who hold themselves out as providing, and provide alcohol or drug abuse diagnosis, treatment, or referral for treatment. (2) Federal assistance to program required. If a patient's alcohol or drug abuse diagnosis, treatment, or referral for treatment is not provided by a program which is federally conducted regulated or supported in a manner which constitutes Federal assistance under § 2.12(b) that patient's record is not covered by these regulations. Thus, it is possible for an individual patient to benefit from Federal support and not be covered by the confidentiality regulations because the program in which the patient is enrolled is not federally assisted as defined in § 2.12(b). For example, if a Federal court placed an individual in a private for-profit program and made a payment to the program on behalf of that individual, that patient's record would not be covered by these regulations unless the program itself received Federal assistance as defined by § 2.12(b). (3) Information to which restrictions are applicable. Whether a restriction is on use or disclosure affects the type of information which may be available. The restrictions on disclosure apply to any information which would identify a patient as an alcohol or drug abuser. The restriction on use of information to bring criminal charges against a patient for a crime applies to any information obtained by the program for the purpose of diagnosis, treatment, or referral for treatment of alcohol or drug abuse. (Note that restrictions on use and disclosure apply to recipients of information under § 2.12(d).) (4) How type of diagnosis affects coverage. These regulations cover any record of a diagnosis identifying a patient as an alcohol or drug abuser which is prepared in connection with the treatment or referral for treatment of alcohol or drug abuse. A diagnosis prepared for the purpose of treatment or referral for treatment but which is not so used is covered by these regulations. The following are not covered by these regulations: (i) diagnosis which is made solely for the purpose of providing evidence for use by law enforcement authorities; or (ii) A diagnosis of drug overdose or alcohol intoxication which clearly shows that the individual involved is not an alcohol or drug abuser (e.g., involuntary ingestion of alcohol or drugs or reaction to a prescribed dosage of one or more drugs). § 2.13 Confidentiality restrictions. (a) General. The patient records to which these regulations apply may be disclosed or used only as permitted by these regulations and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, State, or local authority. Any disclosure made under these regulations must be limited to that information which is necessary to carry out the purpose of the disclosure. (b) Unconditional compliance required. The restrictions on disclosure and use in these regulations apply whether the holder of the information believes that the person seeking the information already has it, has other means of obtaining it, is a law enforcement or other official, has obtained a subpoena, or asserts any other justification for a disclosure or use which is not permitted by these regulations. (c) Acknowledging the presence of patients: Responding to requests. (1) The presence of an identified patient in a facility or component of a facility which is publicly identified as a place where only alcohol or drug abuse diagnosis, treatment, or referral is provided may be acknowledged only if the patient's written consent is obtained in accordance with subpart C of these regulations or if an authorizing court order is entered in accordance with Subpart E of these regulations. The regulations permit acknowledgement of the presence of an identified patient in a facility or part of a facility if the facility is not publicly identified as only an alcohol or drug abuse diagnosis, treatment or referral facility, and if the acknowledgement does not reveal that the patient is an alcohol or drug abuser. (2) Any answer to a request for a disclosure of patient records which is not permissible under these regulations must be made in a way that will not affirmatively reveal that an identified individual has been, or is being diagnosed or treated for alcohol or drug abuse. An inquiring party may be given a copy of these regulations and advised that they restrict the disclosure of alcohol or drug abuse patient records, but may not be told affirmatively that the regulations restrict the disclosure of the records of an identified patient. The regulations do not restrict a disclosure that an identified individual is not and never has been a patient. § 2. 14 Minor patients. (a) Definition of minor. As used in these regulations the term "minor" means a person who has not attained the age of majority specified in the applicable State law, or if no age of majority is specified in the applicable State law, the age of eighteen years. (b) State law not requiring parental consent to treatment. If a minor patient acting alone has the legal capacity under the applicable State law to apply for and obtain alcohol or drug abuse treatment, any written consent for disclosure authorized under Subpart C of these regulations may be given only by the minor patient. This restriction includes, but is not limited to, any disclosure of patient identifying information to the parent or guardian of minor patient for the purpose of obtaining financial reimbursement. These regulations do not prohibit a program from refusing to provide treatment until the minor patient consents to the disclosure necessary to obtain reimbursement, but refusal to provide treatment may be prohibited under a State or local law requiring the program to furnish the service irrespective of ability to pay. (c) State law requiring parental consent to treatment. (1): Where State law requires consent of a parent, guardian, or other person for a minor to obtain alcohol or drug abuse treatment, any written consent for disclosure authorized under Subpart C of these regulations must be given by both the minor and his or her parent, guardian, or other person authorized under State law to act in the minors behalf. (2) Where State law requires parental consent to treatment the fact of a minor's application for treatment may be communicated to the minor's parent, guardian, or other person authorized under State law to act in the minor's behalf only if (i) The minor has given written consent to the disclosure in accordance with Subpart C of these regulations or (ii) The minor lacks the capacity to make a rational choice regarding such consent as judged by the program director under paragraph (d) of this section. (d ) Minor applicant for services lacks capacity for rational choice. Facts relevant to reducing a threat to the life or physical well being of the applicant or any other individual may be disclosed to the parent, guardian, or other person authorized under State law to act in the minor's behalf if the program director judges that: (1) A minor applicant for services lacks capacity because of extreme youth or mental or physical condition to make a rational decision on whether to consent to a disclosure under Subpart C of these regulations to his or her parent, guardian or other person authorized under State law to act in the minor's behalf, and (2) The applicant's situation poses substantial threat to the life or physical well being of the applicant or any other individual which may be reduced by communicating relevant facts to the minor's parent, guardian, or other person authorized under State law to act in the minor's behalf. § 2.15 Incompetent and deceased patients. (a) Incompetent patients other than minors–(1) Adjudication of incompetence. In the case of a patient who has been adjudicated as lacking the capacity, for any reason other than insufficient age, to manage his or her own affairs, any consent which is required under these regulations may be given by the guardian or other person authorized under State law to act in the patient's behalf. (2) No adjudication of incompetency. For any period for which the program director determines that a patient, other than a minor or one who has been adjudicated incompetent, suffers from a medical condition that prevents knowing or effective action on his or her own behalf, the program director may exercise the right of the patient to consent to a disclosure under Subpart C of these regulations for the sole purpose of obtaining payment for services from a third party payer. (b) Deceased patients–(1) Vital statistics. These regulations do not restrict the disclosure of patient identifying information relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death. (2) Consent by personal representative. Any other disclosure of information identifying a deceased patient as an alcohol or drug abuser is subject to these regulations. If a written consent to the disclosure is required, that consent may be given by an executor, administrator, or other personal representative appointed under applicable State law. If there is no such appointment the consent may be given by the patient's spouse or, if none, by any responsible member of the patient's family. § 2.16 Security for written records. (a) Written records which are subject to these regulations must be maintained in a secure room, locked file cabinet, safe or other similar container when not in use; and (b) Each program shall adopt in writing procedures which regulate and control access to and use of written records which are subject to these regulations. § 2.17 Undercover agents and informants. (a) Restrictions on placement. Except as specifically authorized by a court order granted under § 2.6 of these regulations, no program may knowingly employ, or enroll as a patient, any undercover agent or informant. (b) Restriction on use of information. No information obtained by an undercover agent or informant, whether or not that undercover agent or informant is placed in a program pursuant to an authorizing court order, may be used to criminally investigate or prosecute any patient. § 2.18 Restrictions on the use of identification cards. No person may require any patient to carry on his or her person while away from the program premises any card or other object which would identify the patient as an alcohol or drug abuser. This section does not prohibit a person from requiring patients to use or carry cards or other identification objects on the premises of a program. § 2.19 Disposition of records by discontinued programs. (a) General. If a program discontinues operations or is taken over or acquired by another program, it must purge patient identifying information from its records or destroy the records unless– (1) The patient who is the subject of the records gives written consent (meeting the requirements of § 2.31) to a transfer of the records to the acquiring program or to any other program designated in the consent (the manner of obtaining this consent must minimize the likelihood of a disclosure of patient identifying information to a third party); or (2) There is a legal requirement that the records be kept for a period specified by law which does not expire until after the discontinuation or acquisition of the program. (b) Procedure where retention period required by law. If paragraph (a)(2) of this section applies, the records must be: (1) Sealed in envelopes or other containers labeled as follows: "Records of [insert name of program] required to be maintained under [insert citation to statute, regulation, court order or other legal authority requiring that records be kept] until a date not later than [insert appropriate date]"; and (2) Held under the restrictions of these regulations by a responsible person who must, as soon as practicable after the end of the retention period specified on the label, destroy the records. § 2.20 Relationship to State laws. The statues authorizing these regulations (42 U.S.C. 290ee-3 and 42 U.S.C. 290dd-3) do not preempt the field of law which they cover to the exclusion of all State laws in that field. If a disclosure permitted under these regulations is prohibited under State law, neither these regulations nor the authorizing statues may be construed to authorize any violation of that State law. However, no State law may either authorize or compel any disclosure prohibited by these regulations. § 2.21 Relationship to Federal statutes protecting research subjects against compulsory disclosure of their identity. (a) Research privilege description. There may be concurrent coverage of patient identifying information by these regulations and by administrative action taken under Section 303 (a) of the Public Health Service Act (42 U.S.C. 242a (a) and the implementing regulations at 42 CFR Part 2a): or section 502 (c) of the Controlled Substances Act (21 U.S.C. 872(c) and the implementing regulations at 21 CFR 1316.21). These "research privilege" statutes confer on the Secretary of Health and Human Services and on the Attorney General, respectively, the power to authorize researchers conducting certain types of research to withhold from all persons not connected with the research the names and other identifying information concerning individuals who are the subjects of the research. (b) Effect of concurrent coverage. These regulations restrict the disclosure and use of information about patients and use of information about patients while administrative action taken under the research privilege statutes and implementing regulations protects a person engaged in applicable research from being compelled to disclose any identifying characteristics of the individuals who are the subjects of that research. The issuance under Subpart E of these regulations of a court order authorizing a disclosure of information about a patient does not affect an exercise of authority under these research privilege statutes. However, the research privilege granted under 21 CFR 291.505(g) to treatment programs using methadone for maintenance treatment does not protect from compulsory disclosure any information which is permitted to be disclosed under those regulations. Thus, if a court order entered in accordance with Subpart E of methadone maintenance treatment program to disclose certain information about its patients, that program may not invoke the research privilege under 21 CFR 291.505(g) as a defense to a subpoena for that information. § 2.22 Notice to patients of Federal confidentiality requirements. (a) Notice required. At the time of admission or as soon thereafter as the patient is capable of rational communication, each program shall: (1) Communicate to the patient that Federal law and regulations protect the confidentiality of alcohol and drug abuse patient records; and (2) Give to the patient a summary in writing of the Federal law and regulations. (b) Required elements of written summary. The written summary of the Federal law and regulations must include: (1) A general description of the limited circumstances under which a program may acknowledge that an individual is present at a facility or disclose outside the program information identifying a patient as an alcohol or drug abuser. (2) A statement that violation of the Federal law and regulations by a program is a crime and that suspected violations may be reported to appropriate authorities in accordance with these regulations. (3) A statement that information related to a patient's commission of a crime on the premises of the program or against personnel of the program is not protected. (4) A statement that reports of suspected child abuse and neglect made under State law to appropriate State or local authorities are not protected. (5) A citation to the Federal law and regulations. (c) Program options. The program may devise its own notice or may use the sample notice in paragraph (d) to comply with the requirement to provide the patient with a summary in writing of the Federal law and regulations. In addition, the program may include in the written summary information concerning State law and any program policy not inconsistent with State and Federal law on the subject of confidentiality of alcohol and drug abuse patient records. (d) Sample notice. Confidentiality of Alcohol and Drug Abuse Patient Records The confidentiality of alcohol and drug abuse patient records maintained by this program is protected by Federal law and regulations. Generally, the program may not say to a person outside the program that a patient attends the program, or disclose any information identifying a patient as an alcohol or drug abuser Unless: (1) The patient consents in writing; (2) The disclosure is allowed by a court order; or (3) The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation. Violation of the Federal law and regulations by a program is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations. Federal law and regulations do not protect any information about a crime committed by a patient either at the program or against any person who works for the program or about any threat to commit such a crime. Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under State law to appropriate State or local authorities. (See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations.)(Approved by the Office of Management and Budget under Control No. 0930-0099.) § 2.23 Patient access and restrictions on use. (a) Patient access not prohibited. These regulations do not prohibit a program from giving a patient access to his or her own records, including the opportunity to inspect and copy any records that the program maintains about the patient. The program is not required to obtain a patient's written consent or other authorization under these regulations in order to provide such access to the patient. (b) Restriction on use of information. Information obtained by patient access to his or her patient record is subject to the restriction on use of his information to initiate or substantiate any criminal charges against the patient or to conduct any criminal investigation of the patient as provided for under § 2.12(d)(1). Subpart C–Disclosures With Patient's Consent § 2.31 Form of written consent. (a) Required elements. A written consent to a disclosure under these regulations must include: (1) The specific name or general designation of the program or person permitted to make the disclosure. (2) The name or title of the individual or the name of the organization to which disclosure is to be made. (3) The name of the patient. (4) The purpose of the disclosure. (5) How much and what kind of information is to be disclosed. (6) The signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent under § 2.14; or, when required for a patient who is incompetent or deceased, the signature of a person authorized to sign under § 2.15 in lieu of the patient. (7) The date on which the consent is signed. (8) A statement that the consent is subject to revocation at any time except to the extent that the program or person which is to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third party payer. (9) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must insure that the consent will last no longer than reasonably necessary to serve the purpose for which it is given. (b) Sample consent form. The following form complies with paragraph (a) of this section, but other elements may be added. 1. I (name of patient) __Request __Authorize: (c) Expired, deficient, or false consent. A disclosure may not be made on the basis of a consent which: (1) Has expired: (2) On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section; (3) Is known to have been revoked: or (4) Is known, or through a reasonable effort could be known, by the person holding the records to be materially false. (Approved by the Office of Management and Budget under Control No. 0990-0099.) § 2.32 Prohibition on redisclosure. (a) Notice to accompany disclosure. Each disclosure made with the patient's written consent must be accompanied by the following written statement: This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient. § 2.33 Disclosures permitted with written consent. If a patient consents to a disclosure of his or her records under § 2.31, a program may disclose those records in accordance with that consent to any individual or organization named in the consent, except that disclosures to central registries and in connection with criminal justice referrals must meet the requirements of § 2.34 and 2.35, respectively. § 2.34 Disclosures to prevent multiple enrollments in detoxification and maintenance treatment programs. (a) Definitions. For purposes of this section: Central registry means an organization which obtains from two or more member programs patient identifying information about individuals applying for maintenance treatment or detoxification treatment for the purpose of avoiding an individual's concurrent enrollment in more than one program. Detoxification treatment means the dispensing of a narcotic drug in decreasing doses to an individual in order to reduce or eliminate adverse physiological or psychological effects incident to withdrawal from the sustained use of a narcotic drug. Maintenance treatment means the dispensing of a narcotic drug in the treatment of an individual for dependence upon heroin or other morphine-like drugs. Member program means a detoxification treatment or maintenance treatment program which reports patient identifying information to a central registry and which is in the same State that central registry or is not more than 125 miles from any border of the State in which the central registry is located. (b) Restrictions on disclosure. A program may disclose patient records to a central registry or to any detoxification or maintenance treatment program not more than 200 miles away for the purpose of preventing the multiple enrollment of a patient only if: (1) The disclosure is made when: (i) The patient is accepted for treatment; (ii) The type or dosage of the drug is changed; or (iii) The treatment is interrupted, resumed or terminated. (2) The disclosure is limited to: (i) Patient identifying information; (ii) Type and dosage of the drug; and (iii) Relevant dates. (3) The disclosure is made with the patient's written consent meeting the requirements of § 2.31, except that: (i) The consent must list the name and address of each central registry and each known detoxification or maintenance treatment program to which a disclosure will be made; and (ii) The consent may authorize a disclosure to any detoxification or maintenance treatment program established within 200 miles of the program after the consent is given without naming any such program. (c) Use of information limited to prevention of multiple enrollments. A central registry and any detoxification or maintenance treatment program to which information is disclosed to prevent multiple enrollments may not redisclose or use patient identifying information for any purpose other than the prevention of multiple enrollments unless authorized by a court order under Subpart E of these regulations. (d) Permitted disclosure by a central registry to prevent a multiple enrollment. When a member program asks a central registry if an identified patient is enrolled in another member program and the registry determines that the patient is so enrolled, the registry may disclose– (1) The name, address, and telephone number of the member program(s) in which the patient is already enrolled to the inquiring member program, and; (2) The name, address, and telephone number of the inquiring member program to the member program(s) in which the patient is already enrolled. The member programs may communicate as necessary to verify that no error has been made and to prevent or eliminate any multiple enrollment. (e) Permitted disclosure by a detoxification or maintenance treatment program to prevent a multiple enrollment. A detoxification or maintenance treatment program which has received a disclosure under this section and has determined that the patient is already enrolled may communicate as necessary with the program making the disclosure to verify that no error has been made and to prevent or eliminate any multiple enrollment. § 2.35 Disclosures to elements of the criminal justice system which have referred patients. (a) A program may disclose information about a patient to those persons within the criminal justice system which have made participation in the program a condition of the disposition of any criminal proceedings against the patient or of the patient's parole or other release from custody if: (1) The disclosure is made only to those individuals within the criminal justice system who have a need for the information in connection with their duty to monitor the patient's progress (e.g., a prosecuting attorney who is withholding charges against the patient, a court granting pre-trial or post trial release, probation or parole officers responsible for supervision of the patient); and (2) The patient has signed a written consent meeting the requirements of § 2.31 (except paragraph (a)(8) which is inconsistent with the revocation provisions of paragraph (c) of this section) and the requirements of paragraphs (b) and (c) of this section. (b) Duration of consent. The written consent must state the period during which it remains in effect. This period must be reasonable, taking into account: (1) The anticipated length of the treatment; (2) The type of criminal proceeding involved, the need for the information in connection with the final disposition of that proceeding, and when the final disposition will occur; and (3) Such other factors as the program, the patient, and the person(s) who will receive the disclosure consider pertinent. (c) Revocation of consent. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which consent was given. (d) Restrictions on redisclosure and use. A person who receives patient information under this section may redisclose and use it only to carry out that person's official duties with regard to the patient's conditional release or other action in connection with which the consent was given. Subpart D–Disclosures Without Patient Consent § 2.51 Medical emergencies. (a) General Rule. Under the procedures required by paragraph (c) of this section, patient identifying information may be disclosed to medical personnel who have a need for information about a patient for the purpose of treating a cond |