Page images
PDF
EPUB

and (3) The disclosure is made with the ice atient's written consent meeting the ents thequirements of §2.31, except that:

(i) The consent must list the name nd address of each central registry o prevend each known detoxification or

deto maintenance treatment program to "vhich a disclosure will be made; and pp (ii) The consent may authorize a dis

losure to any detoxification or mainantenance treatment program established rom within 200 miles of the program after tie: the consent is given without naming any such program.

tment (c) Use of information limited to prevenr the tion of multiple enrollments. A central 's concegistry and any detoxification or one maintenance treatment program to ent which information is disclosed to pretic vent multiple enrollments may not vitaredisclose or use patient identifying inadveformation for any purpose other than al the prevention of multiple enrollments n the sunless authorized by a court order under subpart E of these regulations.

[ocr errors][merged small][merged small][merged small][merged small][merged small][merged small]

§2.35 Disclosures to elements of the criminal justice system which have referred patients.

(a) A program may disclose information about a patient to those persons within the criminal justice system which have made participation in the program a condition of the disposition of any criminal proceedings against the patient or of the patient's parole or other release from custody if:

(1) The disclosure is made only to those individuals within the criminal justice system who have a need for the information in connection with their duty to monitor the patient's progress (e.g., a prosecuting attorney who is withholding charges against the patient, a court granting pretrial or posttrial release, probation or parole officers responsible for supervision of the patient); and

(2) The patient has signed a written consent meeting the requirements of §2.31 (except paragraph (a)(8) which is inconsistent with the revocation provisions of paragraph (c) of this section) and the requirements of paragraphs (b) and (c) of this section.

(b) Duration of consent. The written consent must state the period during which it remains in effect. This period must be reasonable, taking into account:

(1) The anticipated length of the treatment;

(2) The type of criminal proceeding involved, the need for the information in connection with the final disposition of that proceeding, and when the final disposition will occur; and

(3) Such other factors as the program, the patient, and the person(s) who will receive the disclosure consider pertinent.

(c) Revocation of consent. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which consent was given.

(d) Restrictions on redisclosure and use. A person who receives patient information under this section may redisclose and use it only to carry out that per

[graphic]

son's official duties with regard to the patient's conditional release or other action in connection with which the consent was given.

Subpart D-Disclosures Without Patient Consent

§2.51 Medical emergencies.

(a) General Rule. Under the procedures required by paragraph (c) of this section, patient identifying information may be disclosed to medical personnel who have a need for information about a patient for the purpose of treating a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention.

(b) Special Rule. Patient identifying information may be disclosed to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that the health of any individual may be threatened by an error in the manufacture, labeling, or sale of a product under FDA jurisdiction, and that the information will be used for the exclusive purpose of notifying patients or their physicians of potential dangers.

(c) Procedures. Immediately following disclosure, the program shall document the disclosure in the patient's records, setting forth in writing:

(1) The name of the medical personnel to whom disclosure was made and their affiliation with any health care facility;

(2) The name of the individual making the disclosure;

(3) The date and time of the disclosure; and

(4) The nature of the emergency (or error, if the report was to FDA).

(Approved by the Office of Management and Budget under control number 0930-0099) §2.52 Research activities.

(a) Patient identifying information may be disclosed for the purpose of conducting scientific research if the program director makes a determination that the recipient of the patient identifying information:

(1) Is qualified to conduct the research;

(2) Has a research protocol under which the patient identifying informa tion:

(1) Will be maintained in accordanc with the security requirements of §2.1 of these regulations (or more stringen: requirements); and

(ii) Will not be redisclosed except # permitted under paragraph (b) of this section; and

(3) Has provided a satisfactory writ ten statement that a group of three or more individuals who are independent of the research project has reviewed the protocol and determined that:

(i) The rights and welfare of patients will be adequately protected; and

(ii) The risks in disclosing patient identifying information are outweighed by the potential benefits of the re search.

(b) A person conducting research may disclose patient identifying informa tion obtained under paragraph (a) of this section only back to the program from which that information was ob tained and may not identify any individual patient in any report of that research or otherwise disclose patient identities.

[52 FR 21809, June 9, 1987, as amended at FR 41997, Nov. 2, 1987]

§2.53 Audit and evaluation activities.

(a) Records not copied or removed. If patient records are not copied or removed, patient identifying information may be disclosed in the course of a review of records on program premises to any person who agrees in writing to comply with the limitations on redisclosure and use in paragraph (d) of this section and who:

(1) Performs the audit or evaluation activity on behalf of:

(i) Any Federal, State, or local governmental agency which provides financial assistance to the program or is authorized by law to regulate its activities; or

(ii) Any private person which provides financial assistance to the program, which is a third party payer covering patients in the program, or which is a peer review organization performing a utilization or quality control review; or

[ocr errors]
[ocr errors]

(2) Is determined by the program dictor to be qualified to conduct the udit or evaluation activities.

(b) Copying or removal of records. edecords containing patient identifying

formation may be copied or removed om program premises by any person ho:

clo (1) Agrees in writing to:

raph (i) Maintain the patient identifying nformation in accordance with the setishurity requirements provided in §2.16 ou; f these regulations (or more stringent reequirements);

has (ii) Destroy all the patient identifynedang information upon completion of the are dudit or evaluation; and

ted (iii) Comply with the limitations on isclosure and use in paragraph (d) of his section; and

[ocr errors]

re ou

is d

ing

(2) Performs the audit or evaluation .ctivity on behalf of:

(i) Any Federal, State, or local governmental agency which provides fihancial assistance to the program or is Luthorized by law to regulate its acthe ivities; or

t d

[ocr errors]

on (ii) Any private person which provides financial assistance to the program, which is a third part payer covose bring patients in the program, or which is a peer review organization performing a utilization or quality control review.

ed!

(c) Medicare or Medicaid audit or evalctuation. (1) For purposes of Medicare or Medicaid audit or evaluation under this section, audit or evaluation includes a civil or administrative investigation of the program by any Federal, State, or local agency responsible for oversight of the Medicare or Medicaid program and includes administrative enforcement, against the program by the agency, of any remedy authorized by law to be imposed as a result of the findings of the investigation.

(2) Consistent with the definition of program in §2.11, program includes an employee of, or provider of medical / services under, the program when the employee or provider is the subject of a civil investigation or administrative remedy, as those terms are used in 1 paragraph (c)(1) of this section.

(3) If a disclosure to a person is authorized under this section for a Medicare or Medicaid audit or evaluation, including a civil investigation or ad

ministrative remedy, as those terms are used in paragraph (c)(1) of this section, then a peer review organization which obtains the information under paragraph (a) or (b) may disclose the information to that person but only for purposes of Medicare or Medicaid audit or evaluation.

(4) The provisions of this paragraph do not authorize the agency, the program, or any other person to disclose or use patient identifying information obtained during the audit or evaluation for any purposes other than those necessary to complete the Medicare or Medicaid audit or evaluation activity as specified in this paragraph.

(d) Limitations on disclosure and use. Except as provided in paragraph (c) of this section, patient identifying information disclosed under this section may be disclosed only back to the program from which it was obtained and used only to carry out an audit or evaluation purpose or to investigate or prosecute criminal or other activities, as authorized by a court order entered under §2.66 of these regulations.

Subpart E-Court Orders Authorizing Disclosure And Use

§2.61 Legal effect of order.

(a) Effect. An order of a court of competent jurisdiction entered under this subpart is a unique kind of court order. Its only purpose is to authorize a disclosure or use of patient information which would otherwise be prohibited by 42 U.S.C. 290ee-3, 42 U.S.C. 290dd-3 and these regulations. Such an order does not compel disclosure. A subpoena or a similar legal mandate must be issued in order to compel disclosure. This mandate may be entered at the same time as and accompany an authorizing court order entered under these regulations.

(b) Examples. (1) A person holding records subject to these regulations receives a subpoena for those records: a response to the subpoena is not permitted under the regulations unless an authorizing court order is entered. The person may not disclose the records in response to the subpoena unless a court of competent jurisdiction enters on authorizing order under the tions.

(2) An authorizing court order is entered under these regulations, but the person authorized does not want to make the disclosure. If there is no subpoena or other compulsory process or a subpoena for the records has expired or been quashed, that person may refuse to make the disclosure. Upon the entry of a valid subpoena or other compulsory process the person authorized to disclose must disclose, unless there is a valid legal defense to the process other than the confidentiality restrictions of these regulations.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987] §2.62 Order not applicable to records

disclosed without consent to researchers, auditors and evaluators. A court order under these regulations may not authorize qualified personnel, who have received patient identifying information without consent for the purpose of conducting research, audit or evaluation, to disclose that information or use it to conduct any criminal investigation or prosecution of a patient. However, a court order under §2.66 may authorize disclosure and use of records to investigate or prosecute qualified personnel holding the records. §2.63 Confidential communications.

(a) A court order under these regulations may authorize disclosure of confidential communications made by a patient to a program in the course of diagnosis, treatment, or referral for treatment only if:

(1) The disclosure is necessary to protect against an existing threat to life or of serious bodily injury, including circumstances which constitute suspected child abuse and neglect and verbal threats against third parties;

(2) The disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, such as one which directly threatens loss of life or serious bodily injury, including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, or child abuse and neglect; or

(3) The disclosure is in connection with litigation or an administrative proceeding in which the patient offers testimony or other evidence pertaining

to the content of the confidential com munications.

(b) [Reserved]

$2.64 Procedures and criteria for e ders authorizing disclosures f noncriminal purposes.

(a) Application. An order authorizin the disclosure of patient records fr purposes other than criminal investin tion or prosecution may be applied in by any person having a legally reco nized interest in the disclosure which is sought. The application may be filet separately or as part of a pending civi action in which it appears that the p tient records are needed to provide ev dence. An application mst use a fict tious name, such as John Doe, to refr to any patient and may not contain a otherwise disclose any patient identify ing information unless the patient the applicant or has given a writte consent (meeting the requirements d these regulations) to disclosure or th court has ordered the record of the pr ceeding sealed from public scrunity.

(b) Notice. The patient and the pers holding the records from whom discle sure is sought must be given:

(1) Adequate notice in a man which will not disclose patient identi fying information to other persons: and

(2) An opportunity to file a writte response to the application, or to ap pear in person, for the limited purpos of providing evidence on the statutory and regulatory criteria for the issuanc of the court order.

(c) Review of evidence: Conduct hearing. Any oral argument, review d evidence, or hearing on the application must be held in the judge's chamber or in some manner which ensures that patient identifying information is not disclosed to anyone other than a party to the proceeding, the patient, or the person holding the record, unless the patient requests an open hearing in s manner which meets the written com sent requirements of these regulations. The proceeding may include an examination by the judge of the patient records referred to in the application.

(d) Criteria for entry of order. An order under this section may be entered only if the court determines that good cause exists. To make this determination the court must find that:

[ocr errors]

he com (1) Other ways of obtaining the infornation are not available or would not >e effective; and

poses

(2) The public interest and need for and he disclosure outweigh the potential njury to the patient, the physician-paient relationship and the treatment or services.

atient (e) Content of order. An order authorcris zing a disclosure must:

maybe (1) Limit disclosure to those parts of the patient's record which are essential discito fulfill the objective of the order. ation

(2) Limit disclosure to those persons of whose need for information is the basis pean for the order; and

led to (3) Include such other measures as 1ms are necessary to limit disclosure for on the protection of the patient, the phyAysician-patient relationship and the patiatreatment services; for example, sealss the ing from public scrutiny the record of gany proceeding for which disclosure of requa patient's record has been ordered.

discion

econ

blic s

t and

עדם

river

pate

er pe

tion

imite

the

or the

[ocr errors]

$2.65 Procedures and criteria for or

ders authorizing disclosure and use of records to criminally investigate or prosecute patients.

(a) Application. An order authorizing the disclosure or use of patient records to criminally investigate or prosecute a patient may be applied for by the person holding the records or by any person conducting investigative or prosecutorial activities with respect to the enforcement of criminal laws. The application may be filed separately, as part of an application for a subpoena or other compulsory process, or in a pending criminal action. An application must use a fictitious name such as John Doe, to refer to any patient and may not contain or otherwise disclose patient identifying information unless the court has ordered the record of the proceeding sealed from public scrutiny. (b) Notice and hearing. Unless an order under §2.66 is sought with an order under this section, the person holding the records must be given:

ge's d

natio

the

tient

[merged small][merged small][merged small][merged small][ocr errors][merged small]

(1) Adequate notice (in a manner which will not disclose patient identifying information to third parties) of an application by a person performing a law enforcement function;

(2) An opportunity to appear and be heard for the limited purpose of providing evidence on the statutory and regu

157-163 0-95-2

latory criteria for the issuance of the court order; and

(3) An opportunity to be represented by counsel independent of counsel for an applicant who is a person performing a law enforcement function.

(c) Review of evidence: Conduct of hearings. Any oral argument, review of evidence, or hearing on the application shall be held in the judge's chambers or in some other manner which ensures that patient identifying information is not disclosed to anyone other than a party to the proceedings, the patient, or the person holding the records. The proceeding may include an examination by the judge of the patient records referred to in the application.

(d) Criteria. A court may authorize the disclosure and use of patient records for the purpose of conducting a criminal investigation or prosecution of a patient only if the court finds that all of the following criteria are met:

(1) The crime involved is extremely serious, such as one which causes or directly threatens loss of life or serious bodily injury including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, and child abuse and neglect.

(2) There is a reasonable likelihood that the records will disclose information of substantial value in the investigation or prosecution.

(3) Other ways of obtaining the information are not available or would not be effective.

(4) The potential injury to the patient, to the physician-patient relationship and to the ability of the program to provide services to other patients is outweighed by the public interest and the need for the disclosure. (5) If the applicant is a person performing a law enforcement function that:

(1) The person holding the records has been afforded the opportunity to be represented by independent counsel; and onion

(ii) Any person holding the records which is an entity within Federal, State, or local government has in fact been represented by counsel independent of the applicant.

(e) Content of order. Any order authorizing a disclosure or use of patient records under this section must:

[graphic]
« PreviousContinue »