sis, treatment or referral facility, and if the acknowledgement does not reveal that the patient is an alcohol or drug abuser.

(2) Any answer to a request for a disclosure of patient records which is not permissible under these regulations must be made in a way that will not affirmatively reveal that an identified individual has been, or is being diagnosed or treated for alcohol or drug abuse. An inquiring party may be given a copy of these regulations and advised that they restrict the disclosure of alcohol or drug abuse patient records, but may not be told affirmatively that the regulations restrict the disclosure of the records of an identified patient. The regulations do not restrict a disclosure that an identified individual is not and never has been a patient.

§ 2.14 Minor patients.

(a) Definition of minor. As used in these regulations the term "minor" means a person who has not attained the age of majority specified in the applicable State law, or if no age of majority is specified in the applicable State law, the age of eighteen years.

(b) State law not requiring parental consent to treatment. If a minor patient acting alone has the legal capacity under the applicable State law to apply for and obtain alcohol or drug abuse treatment, any written consent for disclosure authorized under Subpart C of these regulations may be given only by the minor patient. This restriction includes, but is not limited to, any disclosure of patient identifying information to the parent or guardian of a minor patient for the purpose of obtaining financial reimbursement. These regulations do not prohibit a program from refusing to provide treatment until the minor patient consents to the disclosure necessary to obtain reimbursement, but refusal to provide treatment may be prohibited under a State or local law requiring the program to furnish the service irrespective of ability to pay.

(c) State law requiring parental consent to treatment. (1) Where State law requires consent of a parent, guardian, or other person for a minor to obtain alcohol or drug abuse treatment, any

written consent for disclosure authorized under Subpart C of these regulations must be given by both the minor and his or her parent, guardian, or other person authorized under State law to act in the minor's behalf.

(2) Where State law requires parental consent to treatment the fact of a minor's application for treatment may be communicated to the minor's parent, guardian, or other person authorized under State law to act in the minor's behalf only if:

(i) The minor has given written consent to the disclosure in accordance with Subpart C of these regulations or

(ii) The minor lacks the capacity to make a rational choice regarding such consent as judged by the program director under paragraph (d) of this section.

(d) Minor applicant for services lacks capacity for rational choice. Facts relevant to reducing a threat to the life or physical well being of the applicant or any other individual may be disclosed to the parent, guardian, or other person authorized under State law to act in the minor's behalf if the program director judges that:

(1) A minor applicant for services lacks capacity because of extreme youth or mental or physical condition to make a rational decision on whether to consent to a disclosure under Subpart C of these regulations to his or her parent, guardian, or other person authorized under State law to act in the minor's behalf, and

(2) The applicant's situation poses a substantial threat to the life or physical well being of the applicant or any other individual which may be reduced by communicating relevant facts to the minor's parent, guardian,

or

other person authorized under State law to act in the minor's behalf.

§ 2.15 Incompetent and deceased patients.

(a) Incompetent patients other than minors-(1) Adjudication of incompetence. In the case of a patient who has been adjudicated as lacking the capacity, for any reason other than insufficient age, to manage his or her own affairs, any consent which is required under these regulations may be given by the guardian or other person au

thorized under State law to act in the patient's behalf.

(2) No adjudication of incompetency. For any period for which the program director determines that a patient, other than a minor or one who has been adjudicated incompetent, suffers from a medical condition that prevents knowing or effective action on his or her own behalf, the program director may exercise the right of the patient to consent to a disclosure under Subpart C of these regulations for the sole purpose of obtaining payment for services from a third party payer.

(b) Deceased patients—(1) Vital statistics. These regulations do not restrict the disclosure of patient identifying information relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.

(2) Consent by personal representative. Any other disclosure of information identifying a deceased patient as an alcohol or drug abuser is subject to these regulations. If a written consent to the disclosure is required, that consent may be given by an executor, administrator, or other personal representative appointed under applicable State law. If there is no such appointment the consent may be given by the patient's spouse or, if none, by any responsible member of the patient's family.

§ 2.16 Security for written records.

(a) Written records which are subject to these regulations must be maintained in a secure room, locked file cabinet, safe or other similar container when not in use; and

(b) Each program shall adopt in writing procedures which regulate and control access to and use of written records which are subject to these regulations.

§ 2.17 Undercover agents and informants. (a) Restrictions on placement. Except as specifically authorized by a court order granted under § 2.6 of these regulations, no program may knowingly employ, or enroll as a patient, any undercover agent or informant.

(b) Restriction on use of information. No information obtained by an undercover agent or informant, whether or not that undercover agent or informant is place in a program pursuant to an authorizing court order, may be used to criminally investigate or prosecute any patient.

§ 2.18 Restrictions on the use of identification cards.

No person may require any patient to carry on his or her person while away from the program premises any card or other object which would identify the patient as an alcohol or drug abuser. This section does not prohibit a person from requiring patients to use or carry cards or other identification objects on the premises of a program.

§ 2.19 Disposition of records by discontinued programs.

(a) General. If a program discontinues operations or is taken over or acquired by another program, it must purge patient identifying information from its records or destroy the records unless

(1) The patient who is the subject of the records gives written consent (meeting the requirements of § 2.31) to a transfer of the records to the acquiring program or to any other program designated in the consent (the manner of obtaining this consent must minimize the likelihood of a disclosure of patient identifying information to a third party); or

(2) There is a legal requirement that the records be kept for a period specified by law which does not expire until after the discontinuation or acquisition of the program.

(b) Procedure where retention period required by law. If paragraph (a)(2) of this section applies, the records must be:

(1) Sealed in envelopes or other containers labeled as follows: "Records of [insert name of program] required to be maintained under [insert citation to statute, regulation, court order or other legal authority requiring that records be kept] until a date not later than [insert appropriate date]"; and

(2) Held under the restrictions of these regulations by a responsible person who must, as soon as practicable after the end of the retention period specified on the label, destroy the records.

§ 2.20 Relationship to State laws.

The statutes authorizing these regulations (42 U.S.C. 290ee-3 and 42 U.S.C. 290dd-3) do not preempt the field of law which they cover to the exclusion of all State laws in that field. If a disclosure permitted under these regulations is prohibited under State law, neither these regulations nor the authorizing statutes may be construed to authorize any violation of that State law. However, no State law may either authorize or compel any disclosure prohibited by these regulations.

§ 2.21 Relationship to Federal statutes protecting research subjects against compulsory disclosure of their identity. (a) Research privilege description. There may be concurrent coverage of patient identifying information by · these regulations and by administrative action taken under: Section 303(a) of the Public Health Service Act (42 U.S.C. 242a(a) and the implementing regulations at 42 CFR Part 2a); or section 502(c) of the Controlled Substances Act (21 U.S.C. 872(c) and the implementing regulations at 21 CFR 1316.21). These "research privilege" statutes confer on the Secretary of Health and Human Services and on the Attorney General, respectively, the power to authorize researchers conducting certain types of research to withhold from all persons not connected with the research the names and other identifying information concerning individuals who are the subjects of the research.

(b) Effect of concurrent coverage. These regulations restrict the disclosure and use of information about patients, while administrative action taken under the research privilege statutes and implementing regulations protects a person engaged in applicable research from being compelled to disclose any identifying characteristics of the individuals who are the subjects of that research. The issuance under

Subpart E of these regulations of a court order authorizing a disclosure of information about a patient does not affect an exercise of authority under these research privilege statutes. However, the research privilage granted under 21 CFR 291.505(g) to treatment programs using methadone for maintenance treatment does not protect from compulsory disclosure any imformation which is permitted to be disclosed under those regulations. Thus, if a court order entered in accordance with Subpart E of these regulations authorizes a methadone maintenance treatment program to disclose certain information about its patients, that program may not invoke the research privilege under 21 CFR 291.505(g) as a defense to a subpoena for that information.

§ 2.22 Notice to patients of Federal confidentiality requirements.

(a) Notice required. At the time of admission or as soon threreafter as the patient is capable of rational communication. each program shall:

(1) Communicate to the patient that Federal law and regulations protect the confidentiality of alcohol and drug abuse patient records; and

(2) Give to the patient a summary in writing of the Federal law and regulations.

(b) Required elements of written summary. The written summary of the Federal law and regulations must include:

(1) A general description of the limited circumstances under which a program may acknowledge that an individual is present at a facility or disclose outside the program information identifying a patient as an alcohol or drug abuser.

(2) A statement that violation of the Federal law and regulations by a program is a crime and that suspected violations may be reported to appropriate authorities in accordance with these regulations.

(3) A statement that information related to a patient's commission of a crime on the premises of the program or against personnel of the program is not protected.

(4) A statement that reports of suspected child abuse and neglect made under State law to appropriate State or local authorities are not protected. (5) A citation to the Federal law and regulations.

(c) Program options. The program may devise its own notice or may use the sample notice in paragraph (d) to comply with the requirement to provide the patient with a summary in writing of the Federal law and regulations. In addition, the program may include in the written summary information concerning State law and any program policy not inconsistent with State and Federal law on the subject of confidentiality of alcohol and drug abuse patient records. (d) Sample notice.

CONFIDENTIALITY OF ALCOHOL AND DRUG
ABUSE PATIENT RECORDS

The confidentiality of alcohol and drug abuse patient records maintained by this program is protected by Federal law and regulations. Generally, the program may not say to a person outside the program that a patient attends the program, or disclose any information identifying a patient as an alcohol or drug abuser Unless:

(1) The patient consents in writing:

(2) The disclosure is allowed by a court order; or

(3) The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation.

Violation of the Federal law and regulations by a program is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations.

Federal law and regulations do not protect any information about a crime committed by a patient either at the program or against any person who works for the program or about any threat to commit such a crime.

Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under State law to appropriate State or local authorities.

(See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee3 for Federal laws and 42 CFR Part 2 for Federal regulations.)

(Approved by the Office of Management and Budget under Control No. 0930-0099.)

§ 2.23 Patient access and restrictions on

use.

(a) Patient access not prohibited. These regulations do not prohibit a program from giving a patient access to his or her own records, including the opportunity to inspect and copy any records that the program maintains about the patient. The program is not required to obtain a patient's written consent or other authorization under these regulations in order to provide such access to the patient.

(b) Restriction on use of information. Information obtained by patient access to his or her patient record is subject to the restriction on use of his information to initiate or substantiate any criminal charges against the patient or to conduct any criminal investigation of the patient as provided for under § 2.12(d)(1).

Subpart C-Disclosures With Patient's Consent

§ 2.31 Form of written consent.

(a) Required elements. A written consent to a disclosure under these regulations must include:

(1) The specific name or general designation of the program or person permitted to make the disclosure.

(2) The name or title of the individual or the name of the organization to which disclosure is to be made.

(3) The name of the patient. (4) The purpose of the disclosure. (5) How much and what kind of information is to be disclosed.

(6) The signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent under § 2.14; or, when required for a patient who is incompetent or deceased, the signature of a person authorized to sign under § 2.15 in lieu of the patient.

(7) The date on which the consent is signed.

(8) A statement that the consent is subject to revocation at any time except to the extent that the program or person which is to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance

on a valid consent to disclose information to a third party payer.

(9) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must insure that the consent will last no longer than reasonably necessary to serve the purpose for which it is given.

(b) Sample consent form. The following form complies with paragraph (a) of this section, but other elements may be added.

1. I (name of patient) □ Request □ Authorize:

2. (name or general designation of program which is to make the disclosure)

person holding the records to be materially false.

(Approved by the Office of Management and Budget under Control No. 0930-0099.)

§ 2.32 Prohibition on redisclosure.

(a) Notice to accompany disclosure. Each disclosure made with the patient's written consent must be accompanied by the following written statement:

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

§ 2.33 Disclosures permitted with written

consent.

If a patient consents to a disclosure of his or her records under § 2.31, a program may disclose those records in accordance with that consent to any individual or organization named in the consent, except that disclosures to central registries and in connection with criminal justice referrals must meet the requirements of §§ 2.34 and 2.35, respectively.

§ 2.34 Disclosures to prevent multiple enrollments in detoxification and maintenance treatment programs.

(a) Definitions. For purposes of this section:

Central registry means an organization which obtains from two or more member progams patient identifying information about individuals applying for maintenance treatment or detoxification treatment for the purpose of avoiding an individual's concurrent enrollment in more than one program.

Detoxification treatment means the dispensing of a narcotic drug in decreasing doses to an individual in order to reduce or eliminate adverse physiological or psychological effects incident to withdrawal from the sustained use of a narcotic drug.