jects Regulations, 45 CFR Part 46. Those regulations are applicable to all Department of Health, Education and Welfare grants and contracts supporting research, development and related activities involving human subjects.

(i) It is apparent that the foregoing rationale for requiring informed consent does not apply to the same degree in situations involving the disclosure of clinical records for research in the form of follow-up or retrospective studies. Under these circumstances the risk to the subject is that some disclosure or misuse of information from which he could be identified might result in embarrassment, lost opportunities, or other forms of psychological or social injury. While that possibility of harm could be reduced by requiring consent to every review of clinical records for research purposes, a similar result can be achieved by the less restrictive method of limiting further disclosure of identifying information by the researcher. Given the applicability of this alternative, equally effective means for protecting a patient or subject from the possibility of a harmful public disclosure, it is unreasonable to insist upon informed consent to every review of clinical records for the purposes of conducting legitimate research, particularly since such insistence could lead to the ultimate absurdity of prohibiting efforts to identify the nature and source of an unknown plague simply because the patients or researcher lacked the clairvoyance to have consent forms signed prior to the onset of the affliction.

(j) In sum, there are restraints on certain means of governmental acquisition of information about individuals which are operative irrespective of how the information is used, and there are restraints on the uses of information which are independent of how or by whom it is acquired, but they do not and should not add up to the proposition that the use of information about a person is either morally or legally the absolute prerogative of that person to determine.

(k) For all of these reasons, the authorizing legislation expressly provides that patient consent is not required with respect to disclosures for re

search, audit, and evaluation, nor does it prohibit individual patient identification in connection with such disclosures. While it is entirely appropriate to impose safeguards and procedures in connection with these activities, it would be wholly inappropriate to use the rulemaking process to impose an absolute requirement of patient consent with respect to activities which by statute may be conducted without it.

(1) Classification of activities. It is clear that Congress intended a balancing of the social interest in the validity of the results of inquiry, on the one hand, with the individual interest in anonymity, on the other, all within the limits set by the legislation and the constitution. With that objective in mind, we may now turn to the various categories of activities which come within the purview of this subpart.

(m) These activities may be classified first, in regard to whether participation is voluntary from the standpoint of the program, and second, as to whether the objective is to ascertain compliance with predetermined standards (examinations as defined in § 2.54, and program evaluation as defined in § 2.11(g)(1)), or to ascertain the validity of a given standard or hypothesis (scientific research, and program evaluation as defined in §2.11(g)(2)). The application of the foregoing classifications logically results in the creation of four categories of activities. Three of them are specifically dealt with in the succeeding sections of this subpart and need not detain us here; the fourth is discussed below.

(n) Scientific research and evaluation. Beyond the bare restatement of the authorizing legislation set forth in § 2.52, these regulations are deliberately silent with respect to purely voluntary scientific research and program evaluation in the sense defined in §2.11(g)(2). Testimony and written comments received on the August 22, 1974 draft regulations were noteworthy in two respects. First, no instances of abuse on the part of persons acquiring patient identifying information under these circumstances were cited. Second, while there was some well

founded criticism of the attempt in that draft to provide guidelines for determining what is scientific research and who is qualified to do it, no usable alternatives-indeed, almost no alternatives at all-were forthcoming.

(0) In one of the written comments, the writer cautioned against any assumption "that our major remaining problems in drug and alcohol abuse treatment are prevention of illicit diversion and protection of confidnentiality," and suggested "that we still have a problem in discovering, testing and evaluating improved treatment techniques. To do this," he continued, "one should place minimal obstacles in the way of bona fide clinical and epidemiologic research!"

(p) The result of leaving the rule as it is in the statute, without attempting to sharpen its outlines or define its terms, will be to leave it for interpretation on a case-by-case basis by those who must apply it in practice: the researchers who seek the information, and the programs which supply it. This does not foreclose the possibility of amending the regulations on the basis of experience if it appears either that clinicians are becoming so cautious that research and evaluation studies are being choked off, or that abuses are occurring in the use of information disclosed. But until a need for more detailed regulation in this area is demonstrated, we think its imposition would do more harm than good.

§ 2.53 Governmental agencies.—Rules.

(a) In general. Where research, audit, or evaluation functions are performed by or on behalf of a State or Federal governmental agency, the minimum qualifications of personnel performing such functions may be determined by such agency, subject to the provisions of this part, with particular reference to the organizational requirements and limitations on the categories of records subject to review by different categories of personnel.

(b) Financial and administrative records. Where program records are reviewed by personnel who lack either the responsibility for, or appropriate training and supervision for, conduct

ing scientific research, determining adherence to treatment standards, or evaluating treatment as such, such review should be confined as far as practicable to administrative and financial records. Under no circumstances should such personnel be shown caseworker or counsellor notes, or similar clinical records. Programs should organize their records so that financial and administrative matters can be reviewed without disclosing clinical information and without disclosing patient identifying information except where necessary for audit verification.

(c) Scientific research and long-term evaluation studies. No State and no agency or political subdivision of a State may require, as a condition to funding, licensing, or otherwise, that any program furnish patient identifying information for the purpose of conducting scientific research or longterm evaluation studies unless the recipient of such information is legally required to hold such information in confidence, is prohibited from taking any administrative, investigative, or other action with respect to any individual patient on the basis of such information, and is prohibited from identifying, directly or indirectly, any individual patient in any report of such research or evaluation, or otherwise disclosing patient identities in any manner.

(d) Opinion and description to be furnished program. Before any patient identifying information is required to be submitted by a program under the circumstances described in paragraph (c), the program shall be furnished

(1) An opinion by the attorney general or other chief legal officer of the State to the effect that the conditions specified in paragraph (c) of this section are fulfilled with respect to such program or with respect to all programs in such State similarly situated, and

(2) A description of the administrative procedures and physical limitations on access or other measures to provide for the security of the data, but such description shall not be in such detail as to furnish guidance for

Section 2.53 is an implementation of the authority contained in subsection (g) of the authorizing legislation to provide safeguards and procedures to effectuate the purposes of such legislation. It makes clear that whenever information is required of a program, whether by law or by the terms or conditions of a contract or grant, the procedures and safeguards required under this section are applicable.

§ 2.54 Patient identifying information in connection with examinations.-Rules. (a) Definitions. For the purposes of this section

(1) The term "examination" means any examination to which this section is made applicable by paragraph (b) of this section.

(2) The term "examiner" means any individual or any public or private organization, including any Federal, State, or local governmental agency, which conducts an examination to which this section applies.

(b) Applicability. This section applies to any examination of the records of a treatment program which is carried out for the purpose of or as aid to ascertaining the accuracy or adequacy of its financial or other records, or the efficiency or effectiveness of its financial, administrative, or medical management, or its adherence to financial, legal, medical, administrative, or other standards, regardless of whether such examination is called an audit, an evaluation, an inspection, or by any other name.

(c) Statement required for disclosure of patient identifying information in connection with examination. No program may make, and no examiner may require, any disclosure of patient identifying information in connection with an examination unless the examiner furnishes to the program a written statement

(1) That no record of patient identifying information will be made or retained by or on behalf of the examiner in connection with the examination without notice to the program in accordance with paragraph (c)(2) of this section, or

(2) Setting forth the specific purpose for which a record of patient identifying information is being retained by or on behalf of the examiner, the location at which such information will be kept, and the name, official title, address, and telephone number of a responsible individual to whom any inquiries by the program about the disposition of such record should be directed.

(d) Disposition of record of patient identifying information in connection with examination. After any record of patient identifying information retained in connection with an examination has served its purpose, or within the time prescribed in paragraph (e) of this section, whichever is earlier, the examiner shall destroy or return to the program all records (including any copies thereof) containing patient identifying information which have been in its possession in connection with such examination.

(e) Maximum time allowed for disposition. The action required by paragraph (d) of this section shall be completed

(1) Except as provided in paragraph (e)(2) of this section not more than two years after the record was acquired by or on behalf of the examiner, or

(2) Where the record is needed in connection with a formal legal proceeding against the program commenced or to be commenced not more than two years after the record was acquired, and written notice to this effect is furnished to the program within two years after the record was

acquired, not later than the termination of such proceeding.

(f) Notice of final disposition. When an examiner disposes of records as required by paragraph (d) of this section, or not later than the time prescribed by paragraph (e) of this section, whichever is earlier, the examiner shall furnish to the program concerned a written statement

(1) That there has been compliance with this section and with the provisions of this part prohibiting any disclosure of patient identifying information from records held by auditors or evaluators, or

(2) Specifying the particulars in which there has been a failure of compliance.

§2.54-1 Patient identifying information in connection with examinations.-Basis and purpose.

Confidence on the part of treatment program personnel in the integrity of auditing and regulatory processes is important to the effective functioning of the treatment system. It is the purpose of § 2.54 to foster practices which will both justify and engender such confidence.

§2.55 Supervision and regulation of narcotic maintenance and detoxification programs.-Rules.

(a) Definition of "registrant". For the purposes of this section, the term "registrant" means a person who (1) has pending an application for registration under section 303(g) of the Controlled Substances Act (21 U.S.C. 823(g)), or (2) has been registered under such section and whose registration has not expired or been surrendered or revoked.

(b) Drug Enforcement Administration. Duly authorized agents of the Drug Enforcement Administration shall have access to the premises of registrants for the purpose of ascertaining compliance (or ability to comply) with standards established by the Attorney General under section 303(g)(2) of the Controlled Substances Act (21 U.S.C. 823(g)(2)) respecting the security of stocks of narcotic drugs and the maintenance of records (in accordance with section 307 of the Con

trolled Substances Act, 21 U.S.C. 827) on such drugs. Registrants shall maintain such records separate from and in addition to patients' clinical records required to be maintained under 21 CFR 310.505(d)(7)(iii), which shall not be available to such agents except as authorized under a court order in accordance with Subpart E of this part. Records maintained by registrants for the purposes of section 307 of the Controlled Substances Act (21 U.S.C. 827) need not identify patients by name, address, social security number, or otherwise except by an identifying number assigned by the registrant, but where such a system is used, the registrant shall maintain on a current basis a cross-index referencing each identifying number to the name and address of the patient to whom it refers. Upon request at any time and without advance notice, but subject to the provisions of §2.54, such agents shall be granted immediate access to any such index. Such agents may use names and addresses so obtained strictly for the purposes of auditing or verifying program records, and shall exercise all reasonable precautions to avoid inadvertent disclosure of patient identities to third parties. Names and other identifying information so obtained may not be compiled or used in any registry or personal data bank of any description.

(c) Food and Drug Administration. Duly authorized agents of the Food and Drug Administration shall have access to the premises of registrants and to all records maintained by registrants, for the purpose of ascertaining compliance (or ability to comply) with standards established by the Secretary of Health, Education and Welfare under section 4 of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (42 U.S.C. 257a), sections 303(g)(1) and 303(g)(3) of the Controlled Substances Act (21 U.S.C. 823(g)(1) and 823(g)(3)), and sections 505 and 701(a) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 355 and 371(a)). When necessary in the conduct of their duties, and subject to the provisions of § 2.54, agents may use names and addresses of patients strictly for the purposes of auditing or

30-113 0-79--4

verifying program records, and shall exercise all reasonable precautions to avoid inadvertent disclosure of patient identities to third parties. Names and other identifying information on patients obtained pursuant to this section or by any other compulsory process may not be compiled or used in any registry or personal data bank of any description. Except as authorized under this paragraph or by a court order granted under Subpart E of this part, (1) such agents may not, either orally or in writing, except in conversation with personnel of the registrant while on the premises of the registrant, identify any patient otherwise than by reference to an identifying number assigned by the registrant, and (2) such agents may not remove from the premises of the registrant any notes, documents, or copies thereof which contain patient identifying information.

(d) State drug law enforcement agencies. Duly authorized agents of any State drug law enforcement agency having jurisdiction and specific responsibility by statute or otherwise for the enforcement of criminal laws relating to controlled substances (as defined in the Controlled Substances Act) shall have access to the premises of any registrant for the purposes (with respect tɔ corresponding provisions, if any, of State law) and subject to the restrictions and limitations set forth in paragraph (b) of this section, and subject to § 2.54.

(e) State health authorities. (1) Definition of "qualified State health agency". As used in this paragraph, the term "qualified State health agency" means an agency of State government (i) which has express legal responsibility to ascertain that registrants under its jurisdiction comply with appropriate treatment standards; (ii) which is legally and administratively separate from any agency of State government responsible for investigation of violations of, or enforcement of, criminal law generally or criminal laws relating to controlled substances; (iii) whose personnel are qualified by training or experience to conduct inspections of health care facilities to ascertain compliance with

treatment standards; and (iv) whose personnel are by State law, or by published administrative directive enforced by effective sanctions, required to maintain the confidentiality of any information concerning the identity of patients which they may acquire in the course of their official duties.

(2) Access. Duly authorized agents of a qualified State health agency shall have access to the premises of registrants and to all records maintained by registrants, for the purpose of ascertaining compliance (or ability to comply) with treatment standards (including those relating to quantities of narcotic drugs which may be provided for unsupervised use by individuals in treatment) established under State law. Such access, and the use of any information thereby obtained, shall be subject to the restrictions and limitations set forth in paragraph (c) of this section, and subject to § 2.54.

§ 2.55-1 Supervision and regulation of narcotic maintenance and detoxification programs.-Basis and purpose. (a) Section 2.55 is addressed to the general problem described in the following passage from the legislative history of Pub. L. 93-282:

A major element of the task of fashioning new regulations pursuant to the express rulemaking authority conferred by this legislation will be to reconcile the sometimes conflicting interests of research, audit, and evaluation with rights of privacy and the confidentiality of the relationship between patient and clinician. Such a reconciliation becomes particularly crucial where the functions of research, audit, or evaluation are conducted by a governmental agency with regulatory powers and responsibility, and the treatment involves the use of a drug such as methadone which is in a research status or which is readily susceptible of misuse or illicit diversion.

Because of the difficulty and complexity of the task, the rulemaking authority is intentionally cast in terms broad enough to permit the limitation of the scope, content, or circumstances of any disclosure under subsection (b), whether (b)(1) or (b)(2), in the light of the necessary purposes for which it is made or required. (Congressional Record, daily edition, May 6, 1974, page H3563).

(b) It has been the consistent interpretation of the Special Action Office