carried out for the purpose of or as aid to ascertaining the accuracy or adequacy of its financial or other records, or the efficiency or effectiveness of its financial, administrative, or medical management, or its adherence to financial, legal, medical, administrative, or other standards, regardless of whether such examination is called an audit, an evaluation, an inspection, or by any other name.

(c) Statement required for disclosure of patient identifying information in connection with examination. No program may make, and no examiner may require, any disclosure of patient identifying information in connection with an examination unless the examiner furnishes to the program a written statement

(1) That no record of patient identifying information will be made or retained by or on behalf of the examiner in connection with the examination without notice to the program in accordance with paragraph (c)(2) of this section, or

(2) Setting forth the specific purpose for which a record of patient identifying information is being retained by or on behalf of the examiner, the location at which such information will be kept, and the name, official title, address, and telephone number of a responsible individual to whom any inquiries by the program about the disposition of such record should be directed.

(d) Disposition of record of patient identifying information in connection with examination. After any record of patient identifying information retained in connection with an examination has served its purpose, or within the time prescribed in paragraph (e) of this section, whichever is earlier, the examiner shall destroy or return to the program all records (including any copies thereof) containing patient identifying information which have been in its possession in connection with such examination.

(e) Maximum time allowed for disposition. The action required by paragraph (d) of this section shall be completed

(1) Except as provided in paragraph (e)(2) of this section not more than two years after the record was ac

quired by or on behalf of the examiner, or

(2) Where the record is needed in connection with a formal legal proceeding against the program commenced or to be commenced not more than two years after the record was acquired, and written notice to this effect is furnished to the program within two years after the record was acquired, not later than the termination of such proceeding.

(f) Notice of final disposition. When an examiner disposes of records as required by paragraph (d) of this section, or not later than the time prescribed by paragraph (e) of this section, whichever is earlier, the examiner shall furnish to the program concerned a written statement

(1) That there has been compliance with this section and with the provisions of this part prohibiting any disclosure of patient identifying information from records held by auditors or evaluators, or

(2) Specifying the particulars in which there has been a failure of compliance.

§ 2.54-1 Patient identifying information in connection with examinations-Basis and purpose.

Confidence on the part of treatment program personnel in the integrity of auditing and regulatory processes is important to the effective functioning of the treatment system. It is the purpose of § 2.54 to foster practices which will both justify and engender such confidence.

§ 2.55 Supervision and regulation of narcotic maintenance and detoxification programs-Rules.

(a) Definition of “registrant”. For the purposes of this section, the term "registrant" means a person who (1) has pending an application for registration under section 303(g) of the Controlled Substances Act (21 U.S.C. 823(g)), or (2) has been registered under such section and whose registration has not expired or been surrendered or revoked.

(b) Drug Enforcement Administration. Duly authorized agents of the Drug Enforcement Administration

shall have access to the premises of registrants for the purpose of ascertaining compliance (or ability to comply) with standards established by the Attorney General under section 303(g)(2) of the Controlled Substances Act (21 U.S.C. 823(g)(2)) respecting the security of stocks of narcotic drugs and the maintenance of records (in accordance with section 307 of the Controlled Substances Act, 21 U.S.C. 827) on such drugs. Registrants shall maintain such records separate from and in addition to patients' clinical records required to be maintained under 21 CFR 310.505(d)(7)(iii), which shall not be available to such agents except as authorized under a court order in accordance with Subpart E of this part. Records maintained by registrants for the purposes of section 307 of the Controlled Substances Act (21 U.S.C. 827) need not identify patients by name, address, social security number, or otherwise except by an identifying number assigned by the registrant, but where such a system is used, the registrant shall maintain on a current basis a cross-index referencing each identifying number to the name and address of the patient to whom it refers. Upon request at any time and without advance notice, but subject to the provisions of § 2.54, such agents shall be granted immediate access to any such index. Such agents may use names and addresses so obtained strictly for the purposes of auditing or verifying program records, and shall exercise all reasonable precautions to avoid inadvertent disclosure of patient identities to third parties. Names and other identifying information so obtained may not be compiled or used in any registry or personal data bank of any description.

(c) Food and Drug Administration. Duly authorized agents of the Food and Drug Administration shall have access to the premises of registrants and to all records maintained by registrants, for the purpose of ascertaining compliance (or ability to comply) with standards established by the Secretary of Health and Human Services under section 4 of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (42 U.S.C. 257a), sections 303(g)(1) and 303(g)(3) of the Con

trolled Substances Act (21 U.S.C. 823(g)(1) and 823(g)(3)), and sections 505 and 701(a) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 355 and 371(a)). When necessary in the conduct of their duties, and subject to the provisions of § 2.54, agents may use names and addresses of patients strictly for the purposes of auditing or verifying program records, and shall exercise all reasonable precautions to avoid inadvertent disclosure of patient identities to third parties. Names and other identifying information on patients obtained pursuant to this section or by any other compulsory process may not be compiled or used in any registry or personal data bank of any description. Except as authorized under this paragraph or by a court order granted under Subpart E of this part, (1) such agents may not, either orally or in writing, except in conversation with personnel of the registrant while on the premises of the registrant, identify any patient otherwise than by reference to an identifying number assigned by the registrant, and (2) such agents may not remove from the premises of the registrant any notes, documents, or copies thereof which contain patient identifying information.

(d) State drug law enforcement agencies. Duly authorized agents of any State drug law enforcement agency having jurisdiction and specific responsibility by statute or otherwise for the enforcement of criminal laws relating to controlled substances (as defined in the Controlled Substances Act) shall have access to the premises of any registrant for the purposes (with respect to corresponding provisions, if any, of State law) and subject to the restrictions and limitations set forth in paragraph (b) of this section, and subject to § 2.54.

(e) State health authorities—(1) Definition of "qualified State health agency". As used in this paragraph, the term "qualified State health agency" means an agency of State government (i) which has express legal responsibility to ascertain that registrants under its jurisdiction comply with appropriate treatment standards; (ii) which is legally and administratively separate from any agency of

80-143 0-82--4

State government responsible for investigation of violations of, or enforcement of, criminal law generally or criminal laws relating to controlled substances; (iii) whose personnel are qualified by training or experience to conduct inspections of health care facilities to ascertain compliance with treatment standards; and (iv) whose personnel are by State law, or by published administrative directive enforced by effective sanctions, required to maintain the confidentiality of any information concerning the identity of patients which they may acquire in the course of their official duties.

(2) Access. Duly authorized agents of a qualified State health agency shall have access to the premises of registrants and to all records maintained by registrants, for the purpose of ascertaining compliance (or ability to comply) with treatment standards (including those relating to quantities of narcotic drugs which may be provided for unsupervised use by individuals in treatment) established under State law. Such access, and the use of any information thereby obtained, shall be subject to the restrictions and limitations set forth in paragraph (c) of this section, and subject to § 2.54.

§ 2.55-1 Supervision and regulation of narcotic maintenance and detoxification programs-Basis and purpose. (a) Section 2.55 is addressed to the general problem described in the following passage from the legislative history of Pub. L. 93-282:

A major element of the task of fashioning new regulations pursuant to the express rulemaking authority conferred by this legislation will be to reconcile the sometimes conflicting interests of research, audit, and evaluation with rights of privacy and the confidentiality of the relationship between patient and clinician. Such a reconciliation becomes particularly crucial where the functions of research, audit, or evaluation are conducted by a governmental agency with regulatory powers and responsibility, and the treatment involves the use of a drug such as methadone which is in a research status or which is readily susceptible of misuse or illicit diversion.

Because of the difficulty and complexity of the task, the rulemaking authority is intentionally cast in terms broad enough to permit the limitation of the scope, content, or circumstances of any disclosure under

subsection (b), whether (b)(1) or (b)(2), in the light of the necessary purposes for which it is made or required. (Congressional Record, daily edition, May 6, 1974, page H3563).

(b) It has been the consistent interpretation of the Special Action Office for Drug Abuse Prevention that the only provision of the authorizing legislation which permits disclosures to compliance officers, whether of DEA, FDA, or state agencies, is subsection (b)(2)(B). That subsection strictly prohibits any further disclosure of names or other identifying information concerning patients, and the statutory prohibition has been buttressed by provisions of these regulations, notably § 2.54, providing safeguards and procedures to assure that the statutory prohibition is respected.

(c) In testimony and written comment on the August 22, 1974 draft of these regulations, it has been urged that access to patient identifying information by law enforcement personnel, even for the limited purposes allowed by statute and regulation, should be prohibited except pursuant to a court order obtained under 21 U.S.C. 1175(b)(2)(C). We believe that such a prohibition is beyond our power to impose.

*

(d) Section 307(b) of the Controlled Substances Act (21 U.S.C. 827) provides, in pertinent part, “Every record required under this section *** shall be kept and be available, for at least two years, for inspection and copying by officers or employees of the United States authorized by the Attorney General." It is a well known principle of statutory construction that amendments and repeals by implication are not favored. In People v. Newman, 32 N.Y.2d 379, 345 N.Y.S.2d 502, 298 N.E.2d 651 (1973), cert. denied 414 U.S. 1163, 94 S.Ct. 927, 39L. Ed. 2d 116 (1974), the United States filed amicus briefs with the Court of Appeals of New York and with the United States Supreme Court, arguing that section 408 of Pub. L. 92-255 (21 U.S.C. 1175) did not effect an implied amendment or repeal of the provisions of Pub. L. 91-513 (21 U.S.C. 872(c) and 42 U.S.C. 242a(a)) which confer on the Attorney General and the Secretary of Health and Human Services the power

to grant the so-called research privilege discussed in § 2.24. This position was expressly adopted by the New York court. We cannot now take the inconsistent position that section 408 of Pub. L. 92-255 did indeed amend by implication section 307 of Pub. L. 91513, particularly in the face of a contrary contemporaneous administrative interpretation by both the Special Action Office for Drug Abuse Prevention and the Department of Justice. In short, if the right of access and copying conferred on Federal agents by 21 U.S.C. 827 is to be amended to provide that it may only be exercised pursuant to a court order in the case of maintenance and detoxification programs, that is a change which must be wrought by the Congress.

(e) In the case of inspections carried out by health supervisory agencies, we think that denial of access to any documents showing patient identifying information may have a serious adverse effect on the validity of the inspection process. Even if a program keeps its own records in terms of patient-identifying numbers assigned by the program, the patient file may containmay, indeed, be required to containdocuments signed by the patient or originating outside the program. Where signatures, names, and addresses are all obliterated, it is impossible for the inspector to check the file even for apparent internal consistency. We believe that outright forgery is and will remain a rarity, but the temptation to cover improper or inadequate documentation by "accidental misfilings," may be something else again.

(f) From a legal standpoint, the term "audit" has long comprehended the notion of external verification. In a commercial setting, this means that at least some inventory will actually be counted, at least some receivables will be verified by contacting the customers, and so on. To rule that this crucial aspect of the audit process cannot be carried out with respect to a treatment program until after the auditor goes through the procedure of obtaining a specific court order under subsection (b)(2)(C) would seem to contravene the intent of subsection (b)(2)(B).

(g) In all of this, our decisions must be illuminated by a balanced consider

ation of the best interests of the patient no less than a desire to foster the implementation of cherished values in society at large. If protection of the patient's right to privacy is achieved by means which seriously impair our ability to protect him from exploitation and malpractice, not to mention the diversion of funds intended for his benefit, it would be a hollow victory indeed. We believe that the procedures and safeguards which these regulations impose on the conduct of audits and evaluations will avoid that result, while affording substantial and meaningful new protection to the confidentiality of patient records.

§ 2.56 Prohibition on disclosure of patient identities from research, audit, or evaluation records-Rules.

Where the content of patients records has been disclosed pursuant to this subpart for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, information contained therein which would directly or indirectly identify any patient may not be disclosed by the recipient thereof either voluntarily or in response to any legal process whether Federal or State. This prohibition does not affect the accessibility of the original records under authority of a court order referred to in Subpart E.

§ 2.56-1 Prohibition on disclosure of patient identities from research, audit, or evaluation records-Basis and purpose. Section 2.56 restates the prohibition on further disclosure which is contained in subsection (b)(2)(B) of the authorizing legislation. The relationship of the provisions authorizing court orders to the provisions authorizing disclosure for research, audit, and evaluation, is dealt with in § 2.62.

Subpart E-Court Orders

§ 2.61 Legal effect of order-Rules.

Subsection (b)(2)(C) of the sections which authorize this part (21 U.S.C. 1175 and 42 U.S.C. 4582) empowers the courts, in appropriate circumstances, to authorize disclosures which would otherwise be prohibited by subsection

(a) of those sections. Subsection (b)(2)(C) operates only as a mechanism for the relief of the duty imposed by subsection (a) and not as an affirmative grant of jurisdiction to authorize or compel disclosures prohibited or privileged by other provisions of law, whether Federal or State. An order or provision of an order based on some other authority, or a subpoena, or other appropriate legal process, is required to compel disclosure. To illustrate, if a person who maintains records subject to this part is merely requested, or is even served with a subpoena, to disclose information contained therein in a manner prohibited in the absence of a court order, he must refuse such a request unless, and until, an order is issued under subsection (b)(2)(C). Such an order would remove the prohibition, but could not, of its own force, require disclosure. If there were no subpoena or other compulsory process, or a subpoena had been issued but had expired or been quashed, the custodian of the records would have discretion as to whether to disclose the information sought unless and until disclosure were ordered by means of appropriate legal or administrative process, the authority for which would have to be found in some source other than subsection (b)(2)(C) of the sections authorizing this part.

§ 2.61-1 Legal effect of order-Basis and

purpose.

(a) Section 2.61 is a restatement of the interpretative rules embodied in §§ 1401.61 and 1401.62 of the previous regulations. Both the positioning of the authority to issue court orders in S. 2097 as initially passed by the Senate (92nd Congress, 1st Session, December 2, 1971) and the explicit cross-reference in section 408(a) of Pub. L. 92-255 make clear the congressional intent that section 408(b)(2)(C) operate as a mechanism for the relief of the 408(a), strictures and not as an affirmative grant of jurisdiction to authorize disclosures prohibited by other provisions of law, whether Federal or State.

(b) The amendment made by Pub. L. 93-282 to section 333 of the Alcoholism Act (42 U.S.C. 4582) was enacted with the same language and structure

as section 408 in this regard in order to make the interpretative rules set forth in § 2.61 applicable to it.

§ 2.62 Inapplicability to secondary records-Rules.

The authority which subsection (b)(2)(C) of the sections which authorize this part (21 U.S.C. 1175 and 42 U.S.C. 4582) confers on courts to issue orders authorizing the disclosure of records applies only to records referred to in subsection (a) of such sections, that is, the records maintained by treatment or research programs which have patients, and not to secondary records generated by the disclosure of the subsection (a) records to researchers, auditors, or evaluators pursuant to subsection (b)(2)(B).

§ 2.62-1 Inapplicability to secondary records-Basis and purpose.

(a) The interpretative rule set forth in § 2.62 is an essential and basic limitation on the scope of (b)(2)(C) orders. It was part of the original regulations under section 408 of Pub. L. 92-255 published November 17, 1972 (37 FR 24638), and was carried forward unchanged in the amended regulations published December 6, 1973 (38 FR 33748), the special status of which has already been noted in § 2.3. See, also, § 2.61-1.

(b) Although this rule is well supported by the history and technical structure of the legislation, the policy considerations in its favor are even more compelling. In § 2.52-1, we have discussed the urgent necessity for access, even without patient consent, to patient records on the part of qualified personnel engaged in scientific research and evaluation. Where this access includes patient identifying information, as it sometimes must if vital work is to be done, there must not be any question whatsoever about the legal inviolability of its confidential status in the hands of the researcher. Granted, there may occur rare occasions when the original records are for some reason not available, where a (b)(2)(C) order would lie as to the original records, and where there would seem to be some advantage in the administration of justice