(2) Is determined by the program director to be qualified to conduct the audit or evaluation activities.

(b) Copying or removal of records. Records containing patient identifying information may be copied or removed from program premises by any person who:

(1) Agrees in writing to:

(i) Maintain the patient identifying information in accordance with the security requirements provided in §2.16 of these regulations (or more stringent requirements);

(ii) Destroy all the patient identifying information upon completion of the audit or evaluation; and

(iii) Comply with the limitations on disclosure and use in paragraph (d) of this section; and

(2) Performs the audit or evaluation activity on behalf of:

(1) Any Federal, State, or local governmental agency which provides financial assistance to the program or is authorized by law to regulate its activities; or

(ii) Any private person which provides financial assistance to the program, which is a third part payer covering patients in the program, or which is a peer review organization performing a utilization or quality control review.

(c) Medicare or Medicaid audit or evaluation. (1) For purposes of Medicare or Medicaid audit or evaluation under this section, audit or evaluation includes a civil or administrative investigation of the program by any Federal, State, or local agency responsible for oversight of the Medicare or Medicaid program and includes administrative enforcement, against the program by the agency, of any remedy authorized by law to be imposed as a result of the findings of the investigation.

(2) Consistent with the definition of program in §2.11, program includes an employee of, or provider of medical services under, the program when the employee or provider is the subject of a civil investigation or administrative remedy, as those terms are used in paragraph (c)(1) of this section.

(3) If a disclosure to a person is authorized under this section for a Medicare or Medicaid audit or evaluation, including a civil investigation or ad

ministrative remedy, as those terms are used in paragraph (c)(1) of this section, then a peer review organization which obtains the information under paragraph (a) or (b) may disclose the information to that person but only for purposes of Medicare or Medicaid audit or evaluation.

(4) The provisions of this paragraph do not authorize the agency, the program, or any other person to disclose or use patient identifying information obtained during the audit or evaluation for any purposes other than those necessary to complete the Medicare or Medicaid audit or evaluation activity as specified in this paragraph.

(d) Limitations on disclosure and use. Except as provided in paragraph (c) of this section, patient identifying information disclosed under this section may be disclosed only back to the program from which it was obtained and used only to carry out an audit or evaluation purpose or to investigate or prosecute criminal or other activities, as authorized by a court order entered under §2.66 of these regulations.

Subpart E-Court Orders Authorizing Disclosure And Use

$2.61 Legal effect of order.

(a) Effect. An order of a court of competent jurisdiction entered under this subpart is a unique kind of court order. Its only purpose is to authorize a disclosure or use of patient information which would otherwise be prohibited by 42 U.S.C. 290ee-3, 42 U.S.C. 290dd-3 and these regulations. Such an order does not compel disclosure. A subpoena or a similar legal mandate must be issued in order to compel disclosure. This mandate may be entered at the same time as and accompany an authorizing court order entered under these regulations.

(b) Examples. (1) A person holding records subject to these regulations receives a subpoena for those records: a response to the subpoena is not permitted under the regulations unless an authorizing court order is entered. The person may not disclose the records in response to the subpoena unless a court of competent jurisdiction enters an authorizing order under these regulations.

(2) An authorizing court order is entered under these regulations, but the person authorized does not want to make the disclosure. If there is no subpoena or other compulsory process or a subpoena for the records has expired or been quashed, that person may refuse to make the disclosure. Upon the entry of a valid subpoena or other compulsory process the person authorized to disclose must disclose, unless there is a valid legal defense to the process other than the confidentiality restrictions of these regulations.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987] §2.62 Order not applicable to records

disclosed without consent to researchers, auditors and evaluators. A court order under these regulations may not authorize qualified personnel, who have received patient identifying information without consent for the purpose of conducting research, audit or evaluation, to disclose that information or use it to conduct any criminal investigation or prosecution of a patient. However, a court order under §2.66 may authorize disclosure and use of records to investigate or prosecute qualified personnel holding the records. §2.63 Confidential communications.

(a) A court order under these regulations may authorize disclosure of confidential communications made by a patient to a program in the course of diagnosis, treatment, or referral for treatment only if:

(1) The disclosure is necessary to protect against an existing threat to life or of serious bodily injury, including circumstances which constitute suspected child abuse and neglect and verbal threats against third parties;

(2) The disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, such as one which directly threatens loss of life or serious bodily injury, including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, or child abuse and neglect; or

(3) The disclosure is in connection with litigation or an administrative proceeding in which the patient offers testimony or other evidence pertaining

to the content of the confidential communications.

(b) [Reserved]

§2.64 Procedures and criteria for orders authorizing disclosures for noncriminal purposes.

(a) Application. An order authorizing the disclosure of patient records for purposes other than criminal investigation or prosecution may be applied for by any person having a legally recognized interest in the disclosure which is sought. The application may be filed separately or as part of a pending civil action in which it appears that the patient records are needed to provide evidence. An application mst use a fictitious name, such as John Doe, to refer to any patient and may not contain or otherwise disclose any patient identifying information unless the patient is the applicant or has given a written consent (meeting the requirements of these regulations) to disclosure or the court has ordered the record of the proceeding sealed from public scrunity.

(b) Notice. The patient and the person holding the records from whom disclosure is sought must be given:

(1) Adequate notice in a manner which will not disclose patient identifying information to other persons: and

(2) An opportunity to file a written response to the application, or to appear in person, for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order.

(c) Review of evidence: Conduct of hearing. Any oral argument, review of evidence, or hearing on the application must be held in the judge's chambers or in some manner which ensures that patient identifying information is not disclosed to anyone other than a party to the proceeding, the patient, or the person holding the record, unless the patient requests an open hearing in a manner which meets the written consent requirements of these regulations. The proceeding may include an examination by the judge of the patient records referred to in the application.

(d) Criteria for entry of order. An order under this section may be entered only if the court determines that good cause exists. To make this determination the court must find that:

(1) Other ways of obtaining the information are not available or would not be effective; and

(2) The public interest and need for the disclosure outweigh the potential injury to the patient, the physician-patient relationship and the treatment services.

(e) Content of order. An order authorizing a disclosure must:

(1) Limit disclosure to those parts of the patient's record which are essential to fulfill the objective of the order.

(2) Limit disclosure to those persons whose need for information is the basis for the order; and

(3) Include such other measures as are necessary to limit disclosure for the protection of the patient, the physician-patient relationship and the treatment services; for example, sealing from public scrutiny the record of any proceeding for which disclosure of a patient's record has been ordered.

§2.65 Procedures and criteria for orders authorizing disclosure and use of records to criminally investigate or prosecute patients.

(a) Application. An order authorizing the disclosure or use of patient records to criminally investigate or prosecute a patient may be applied for by the person holding the records or by any person conducting investigative or prosecutorial activities with respect to the enforcement of criminal laws. The application may be filed separately, as part of an application for a subpoena or other compulsory process, or in a pending criminal action. An application must use a fictitious name such as John Doe, to refer to any patient and may not contain or otherwise disclose patient identifying information unless the court has ordered the record of the proceeding sealed from public scrutiny.

(b) Notice and hearing. Unless an order under §2.66 is sought with an order under this section, the person holding the records must be given:

(1) Adequate notice (in a manner which will not disclose patient identifying information to third parties) of an application by a person performing a law enforcement function;

(2) An opportunity to appear and be heard for the limited purpose of providing evidence on the statutory and regu

latory criteria for the issuance of the court order; and

(3) An opportunity to be represented by counsel independent of counsel for an applicant who is a person performing a law enforcement function.

(c) Review of evidence: Conduct of hearings. Any oral argument, review of evidence, or hearing on the application shall be held in the judge's chambers or in some other manner which ensures that patient identifying information is not disclosed to anyone other than a party to the proceedings, the patient, or the person holding the records. The proceeding may include an examination by the judge of the patient records referred to in the application.

(d) Criteria. A court may authorize the disclosure and use of patient records for the purpose of conducting a criminal investigation or prosecution of a patient only if the court finds that all of the following criteria are met:

(1) The crime involved is extremely serious, such as one which causes or directly threatens loss of life or serious bodily injury including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, and child abuse and neglect.

(2) There is a reasonable likelihood that the records will disclose information of substantial value in the investigation or prosecution.

(3) Other ways of obtaining the information are not available or would not be effective.

(4) The potential injury to the patient, to the physician-patient relationship and to the ability of the program to provide services to other patients is outweighed by the public interest and the need for the disclosure. (5) If the applicant is a person performing a law enforcement function that:

(i) The person holding the records has been afforded the opportunity to be represented by independent counsel;

and

(ii) Any person holding the records which is an entity within Federal, State, or local government has in fact been represented by counsel independent of the applicant.

(e) Content of order. Any order authorizing a disclosure or use of patient records under this section must:

150-164 0-94-2

(1) Limit disclosure and use to those parts of the patient's record which are essential to fulfill the objective of the order;

(2) Limit disclosure to those law enforcement and prosecutorial officials who are responsible for, or are conducting, the investigation or prosecution, and limit their use of the records to investigation and prosecution of extremely serious crime or suspected crime specified in the application; and

(3) Include such other measures as are necessary to limit disclosure and use to the fulfillment of only that public interest and need found by the court.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987]

§2.66 Procedures and criteria for or

ders authorizing disclosure and use of records to investigate or prosecute a program or the person holding the records.

(a) Application. (1) An order authorizing the disclosure or use of patient records to criminally or administratively investigate or prosecute a program or the person holding the records (or employees or agents of that program or person) may be applied for by any administrative, regulatory, supervisory, investigative, law enforcement, or prosecutorial agency having jurisdiction over the program's or person's activities.

(2) The application may be filed separately or as part of a pending civil or criminal action against a program or the person holding the records (or agents or employees of the program or person) in which it appears that the patient records are needed to provide material evidence. The application must use a fictitious name, such as John Doe, to refer to any patient and may not contain or otherwise disclose any patient identifying information unless the court has ordered the record of the proceeding sealed from public scrutiny or the patient has given a written consent (meeting the requirements of §2.31 of these regulations) to that disclosure.

(b) Notice not required. An application under this section may, in the discretion of the court, be granted without notice. Although no express notice is required to the program, to the person

holding the records, or to any patient whose records are to be disclosed, upon implementation of an order so granted any of the above persons must be afforded an opportunity to seek revocation or amendment of that order, limited to the presentation of evidence on the statutory and regulatory criteria for the issuance of the court order.

(c) Requirements for order. An order under this section must be entered in accordance with, and comply with the requirements of, paragraphs (d) and (e) of §2.64 of these regulations.

(d) Limitations on disclosure and use of patient identifying information: (1) An order entered under this section must require the deletion of patient identifying information from any documents made available to the public.

(2) No information obtained under this section may be used to conduct any investigation or prosecution of a patient, or be used as the basis for an application for an order under §2.65 of these regulations.

§2.67 Orders authorizing the use of undercover agents and informants to criminally investigate employees or agents of a program.

(a) Application. A court order authorizing the placement of an undercover agent or informant in a program as an employee or patient may be applied for by any law enforcement or prosecutorial agency which has reason to believe that employees or agents of the program are engaged in criminal misconduct.

(b) Notice. The program director must be given adequate notice of the application and an opportunity to appear and be heard (for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order), unless the application asserts a belief that:

(1) The program director is involved in the criminal activities to be investigated by the undercover agent or informant; or

(2) The program director will intentionally or unintentionally disclose the proposed placement of an undercover agent or informant to the employees or agents who are suspected of criminal activities.

(c) Criteria. An order under this section may be entered only if the court determines that good cause exists. To make this determination the court must find:

(1) There is reason to believe that an employee or agent of the program is engaged in criminal activity;

(2) Other ways of obtaining evidence of this criminal activity are not available or would not be effective; and

(3) The public interest and need for the placement of an undercover agent or informant in the program outweigh the potential injury to patients of the program, physician-patient relationships and the treatment services.

(d) Content of order. An order authorizing the placement of an undercover agent or informant in a program must:

(1) Specifically authorize the placement of an undercover agent or an informant;

(2) Limit the total period of the placement to six months;

(3) Prohibit the undercover agent or informant from disclosing any patient identifying information obtained from the placement except as necessary to criminally investigate or prosecute employees or agents of the program; and

(4) Include any other measures which are appropriate to limit any potential disruption of the program by the placement and any potential for a real or apparent breach of patient confidentiality; for example, sealing from public scrutiny the record of any proceeding for which disclosure of a patient's record has been ordered.

(e) Limitation on use of information. No information obtained by an undercover agent or informant placed under this section may be used to criminally investigate or prosecute any patient or as the basis for an application for an order under §2.65 of these regulations.

PART 29-PROTECTION OF IDENTITY-RESEARCH SUBJECTS

Sec.

28.1 Applicability.

2a.2 Definitions.

2a.3 Application; coordination.

2a.4 Contents of application; in general. 28.5 Contents of application; research projects in which drugs will be administered.

2a.6 Issuance of Confidentiality Certificates; single project limitation.

2a.7 Effect of Confidentiality Certificate. 2a.8 Termination.

AUTHORITY: Sec. 3(a), Pub. L. 91-513 as amended by sec. 122(b), Pub. L. 93-282; 84 Stat. 1241 (42 U.S.C. 242a(a)), as amended by 88 Stat. 132.

SOURCE: 44 FR 20384, Apr. 4, 1979, unless otherwise noted.

§ 2a.1 Applicability.

(a) Section 303(a) of the Public Health Service Act (42 U.S.C. 242a(a)) provides that "[t]he Secretary [of Health and Human Services] may authorize persons engaged in research on mental health, including research on the use and effect of alcohol and other psychoactive drugs, to protect the privacy of individuals who are the subject of such research by withholding from all persons not connected with the conduct of such research the names or other identifying characteristics of such individuals. Persons so authorized to protect the privacy of such individuals may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals." The regulations in this part establish procedures under which any person engaged in research on mental health including research on the use and effect of alcohol and other psychoactive drugs (whether or not the research is federally funded) may, subject to the exceptions set forth in paragraph (b) of this section, apply for such an authorization of confidentiality.

(b) These regulations do not apply to: (1) Authorizations of confidentiality for research requiring an Investigational New Drug exemption under section 505(1) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 355(i)) or to approved new drugs, such as methadone, requiring continuation of longterm studies, records, and reports. Attention is called to 21 CFR 291.505(g) relating to authorizations of confidentiality for patient records maintained by methadone treatment programs.

(2) Authorizations of confidentiality for research which are related to law enforcement activities or otherwise within the purview of the Attorney General's authority to issue authorizations of confidentiality pursuant to