Page images
PDF
EPUB

prohibited under State law, neither these regulations nor the authorizing statutes may be construed to authorize any violation of that State law. However, no State law may either authorize or compel any disclosure prohibited by these regulations.

§2.21 Relationship to Federal statutes protecting research subjects against compulsory disclosure of their identity.

(a) Research privilege description. There may be concurrent coverage of patient identifying information by these regulations and by administrative action taken under: Section 303(a) of the Public Health Service Act (42 U.S.C. 242a(a) and the implementing regulations at 42 CFR part 2a); or section 502(c) of the Controlled Substances Act (21 U.S.C. 872(c) and the implementing regulations at 21 CFR 1316.21). These "research privilege" statutes confer on the Secretary of Health and Human Services and on the Attorney General, respectively, the power to authorize researchers conducting certain types of research to withhold from all persons not connected with the research the names and other identifying information concerning individuals who are the subjects of the research.

(b) Effect of concurrent coverage. These regulations restrict the disclosure and use of information about patients, while administrative action taken under the research privilege statutes and implementing regulations protects a person engaged in applicable research from being compelled to disclose any identifying characteristics of the individuals who are the subjects of that research. The issuance under subpart E of these regulations of a court order authorizing a disclosure of information about a patient does not affect an exercise of authority under these research privilege statutes. However, the research privilage granted under 21 CFR 291.505(g) to treatment programs using methadone for maintenance treatment does not protect from compulsory disclosure any imformation which is permitted to be disclosed under those regulations. Thus, if a court order entered in accordance with subpart E of these regulations authorizes a methadone maintenance treatment program to

disclose certain information about its patients, that program may not invoke the research privilege under 21 CFR 291.505(g) as a defense to a subpoena for that information.

§2.22 Notice to patients of Federal confidentiality requirements.

(a) Notice required. At the time of admission or as soon threreafter as the patient is capable of rational communication. each program shall:

(1) Communicate to the patient that: Federal law and regulations protect the confidentiality of alcohol and drug abuse patient records; and

(2) Give to the patient a summary in writing of the Federal law and regulations.

(b) Required elements of written summary. The written summary of the Federal law and regulations must include:

(1) A general description of the limited circumstances under which a program may acknowledge that an individual is present at a facility or disclose outside the program information identifying a patient as an alcohol or drug abuser.

(2) A statement that violation of the Federal law and regulations by a program is a crime and that suspected violations may be reported to appropriate authorities in accordance with these regulations.

[ocr errors][ocr errors]

(3) A statement that information related to a patient's commission of a | crime on the premises of the program | or against personnel of the program is not protected.

(4) A statement that reports of suspected child abuse and neglect made under State law to appropriate State or local authorities are not protected.

(5) A citation to the Federal law and regulations.

(c) Program options. The program may devise its own notice or may use the sample notice in paragraph (d) to comply with the requirement to provide the patient with a summary in writing of the Federal law and regulations. In addition, the program may include in the written summary information concerning State law and any program policy not inconsistent with State and Federal law on the subject of confidentiality of alcohol and drug abuse patient records.

[merged small][ocr errors]

(d) Sample notice.

CONFIDENTIALITY OF ALCOHOL AND DRUG
ABUSE PATIENT RECORDS

The confidentiality of alcohol and drug abuse patient records maintained by this program is protected by Federal law and regulations. Generally, the program may not say to a person outside the program that a patient attends the program, or disclose any information identifying a patient as an alcohol or drug abuser Unless:

(1) The patient consents in writing:

(2) The disclosure is allowed by a court order; or

(3) The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation.

Violation of the Federal law and regulations by a program is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations.

Federal law and regulations do not protect any information about a crime committed by a patient either at the program or against any person who works for the program or about any threat to commit such a crime.

Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under State law to appropriate State or local authorities.

(See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR part 2 for Federal regulations.)

(Approved by the Office of Management and Budget under control number 0930-0099)

§2.23 Patient access and restrictions

on use.

(a) Patient access not prohibited. These regulations do not prohibit a program from giving a patient access to his or her own records, including the opportunity to inspect and copy any records that the program maintains about the patient. The program is not required to obtain a patient's written consent or other authorization under these regulations in order to provide such access to the patient.

(b) Restriction on use of information. Information obtained by patient access to his or her patient record is subject to the restriction on use of his information to initiate or substantiate any criminal charges against the patient or to conduct any criminal investigation of the patient as provided for under §2.12(d)(1).

Subpart C-Disclosures With
Patient's Consent

§2.31 Form of written consent.

(a) Required elements. A written consent to a disclosure under these regulations must include:

(1) The specific name or general designation of the program or person permitted to make the disclosure.

(2) The name or title of the individual or the name of the organization to which disclosure is to be made.

(3) The name of the patient.

(4) The purpose of the disclosure. (5) How much and what kind of information is to be disclosed.

(6) The signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent under §2.14; or, when required for a patient who is incompetent or deceased, the signature of a person authorized to sign under §2.15 in lieu of the patient.

(7) The date on which the consent is signed.

(8) A statement that the consent is subject to revocation at any time except to the extent that the program or person which is to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third party payer.

(9) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must insure that the consent will last no longer than reasonably necessary to serve the purpose for which it is given.

(b) Sample consent form. The following form complies with paragraph (a) of this section, but other elements may be added.

1. I (name of patient) Request Authorize: 2. (name or general designation of program which is to make the disclosure)

[graphic]

(2) An authorizing court order is entered under these regulations, but the person authorized does not want to make the disclosure. If there is no subpoena or other compulsory process or a subpoena for the records has expired or been quashed, that person may refuse to make the disclosure. Upon the entry of a valid subpoena or other compulsory process the person authorized to disclose must disclose, unless there is a valid legal defense to the process other than the confidentiality restrictions of these regulations.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987] §2.62 Order not applicable to records

disclosed without consent to researchers, auditors and evaluators. A court order under these regulations may not authorize qualified personnel, who have received patient identifying information without consent for the purpose of conducting research, audit or evaluation, to disclose that information or use it to conduct any criminal investigation or prosecution of a patient. However, a court order under §2.66 may authorize disclosure and use of records to investigate or prosecute qualified personnel holding the records.

§2.63 Confidential communications.

(a) A court order under these regulations may authorize disclosure of confidential communications made by a patient to a program in the course of diagnosis, treatment, or referral for treatment only if:

(1) The disclosure is necessary to protect against an existing threat to life or of serious bodily injury, including circumstances which constitute suspected child abuse and neglect and verbal threats against third parties;

(2) The disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, such as one which directly threatens loss of life or serious bodily injury, including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, or child abuse and neglect; or

(3) The disclosure is in connection with litigation or an administrative proceeding in which the patient offers testimony or other evidence pertaining

to the content of the confidential communications.

(b) [Reserved]

$2.64 Procedures and criteria for or ders authorizing disclosures for noncriminal purposes.

(a) Application. An order authorizing the disclosure of patient records for purposes other than criminal investigation or prosecution may be applied for by any person having a legally recog nized interest in the disclosure which is sought. The application may be filed separately or as part of a pending civil action in which it appears that the patient records are needed to provide evidence. An application mst use a fictitious name, such as John Doe, to refer to any patient and may not contain or otherwise disclose any patient identifying information unless the patient is the applicant or has given a written consent (meeting the requirements of these regulations) to disclosure or the court has ordered the record of the proceeding sealed from public scrunity.

(b) Notice. The patient and the person. holding the records from whom disclosure is sought must be given:

(1) Adequate notice in a manner which will not disclose patient identifying information to other persons: and

(2) An opportunity to file a written response to the application, or to appear in person, for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order.

(c) Review of evidence: Conduct of hearing. Any oral argument, review of evidence, or hearing on the application must be held in the judge's chambers or in some manner which ensures that patient identifying information is not disclosed to anyone other than a party to the proceeding, the patient, or the person holding the record, unless the patient requests an open hearing in a manner which meets the written consent requirements of these regulations. The proceeding may include an examination by the judge of the patient records referred to in the application.

(d) Criteria for entry of order. An order under this section may be entered only if the court determines that good cause exists. To make this determination the court must find that:

(1) Other ways of obtaining the information are not available or would not be effective; and

(2) The public interest and need for te the disclosure outweigh the potential injury to the patient, the physician-patient relationship and the treatment services.

app

(e) Content of order. An order authorizing a disclosure must:

(1) Limit disclosure to those parts of the patient's record which are essential to fulfill the objective of the order.

(2) Limit disclosure to those persons whose need for information is the basis for the order; and

(3) Include such other measures as are necessary to limit disclosure for the protection of the patient, the physician-patient relationship and the treatment services; for example, sealing from public scrutiny the record of any proceeding for which disclosure of a patient's record has been ordered.

§2.65 Procedures and criteria for orders authorizing disclosure and use of records to criminally investigate or prosecute patients.

(a) Application. An order authorizing the disclosure or use of patient records to criminally investigate or prosecute a patient may be applied for by the person holding the records or by any person conducting investigative or prosecutorial activities with respect to the enforcement of criminal laws. The application may be filed separately, as part of an application for a subpoena or other compulsory process, or in a pending criminal action. An application must use a fictitious name such as John Doe, to refer to any patient and may not contain or otherwise disclose patient identifying information unless the court has ordered the record of the proceeding sealed from public scrutiny.

(b) Notice and hearing. Unless an order under §2.66 is sought with an order under this section, the person holding the records must be given:

(1) Adequate notice (in a manner which will not disclose patient identifying information to third parties) of an application by a person performing a law enforcement function;

(2) An opportunity to appear and be heard for the limited purpose of providing evidence on the statutory and regu

latory criteria for the issuance of the court order; and

(3) An opportunity to be represented by counsel independent of counsel for an applicant who is a person performing a law enforcement function.

(c) Review of evidence: Conduct of hearings. Any oral argument, review of evidence, or hearing on the application shall be held in the judge's chambers or in some other manner which ensures that patient identifying information is not disclosed to anyone other than a party to the proceedings, the patient, or the person holding the records. The proceeding may include an examination by the judge of the patient records referred to in the application.

(d) Criteria. A court may authorize the disclosure and use of patient records for the purpose of conducting a criminal investigation or prosecution of a patient only if the court finds that all of the following criteria are met:

(1) The crime involved is extremely serious, such as one which causes or directly threatens loss of life or serious bodily injury including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, and child abuse and neglect.

(2) There is a reasonable likelihood that the records will disclose information of substantial value in the investigation or prosecution.

(3) Other ways of obtaining the information are not available or would not be effective.

(4) The potential injury to the patient, to the physician-patient relationship and to the ability of the program to provide services to other patients is outweighed by the public interest and the need for the disclosure. (5) If the applicant is a person performing a law enforcement function that:

(1) The person holding the records has been afforded the opportunity to be represented by independent counsel;

and

(ii) Any person holding the records which is an entity within Federal, State, or local government has in fact been represented by counsel independent of the applicant.

(e) Content of order. Any order thorizing a disclosure or use records under this section

157-163 0-95-2

(1) Limit disclosure and use to those parts of the patient's record which are essential to fulfill the objective of the order;

(2) Limit disclosure to those law enforcement and prosecutorial officials who are responsible for, or are conducting, the investigation or prosecution, and limit their use of the records to investigation and prosecution of extremely serious crime or suspected crime specified in the application; and

(3) Include such other measures as are necessary to limit disclosure and use to the fulfillment of only that public interest and need found by the court.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987]

§2.66 Procedures and criteria for or

ders authorizing disclosure and use of records to investigate or prosecute a program or the person holding the records.

(a) Application. (1) An order authorizing the disclosure or use of patient records to criminally or administratively investigate or prosecute a program or the person holding the records (or employees or agents of that program or person) may be applied for by any administrative, regulatory, supervisory, investigative, law enforcement, or prosecutorial agency having jurisdiction over the program's or person's activities.

(2) The application may be filed separately or as part of a pending civil or criminal action against a program or the person holding the records (or agents or employees of the program or person) in which it appears that the patient records are needed to provide material evidence. The application must use a fictitious name, such as John Doe, to refer to any patient and may not contain or otherwise disclose any patient identifying information unless the court has ordered the record of the proceeding sealed from public scrutiny or the patient has given a written consent (meeting the requirements of §2.31 of these regulations) to that disclosure.

(b) Notice not required. An application under this section may, in the discretion of the court, be granted without notice. Although no express notice is required to the program, to the person

holding the records, or to any patient whose records are to be disclosed, upon implementation of an order so granted any of the above persons must be af forded an opportunity to seek revocation or amendment of that order, limited to the presentation of evidence on the statutory and regulatory criteria for the issuance of the court order.

(c) Requirements for order. An order under this section must be entered in accordance with, and comply with the requirements of, paragraphs (d) and (e) of §2.64 of these regulations.

(d) Limitations on disclosure and use of patient identifying information: (1) An order entered under this section must require the deletion of patient identifying information from any documents made available to the public.

(2) No information obtained under this section may be used to conduct any investigation or prosecution of a patient, or be used as the basis for an application for an order under §2.65 of these regulations.

§2.67 Orders authorizing the use of undercover agents and informants to criminally investigate employees or agents of a program.

(a) Application. A court order authorizing the placement of an undercover agent or informant in a program as an employee or patient may be applied for by any law enforcement or prosecutorial agency which has reason to believe that employees or agents of the program are engaged in criminal misconduct.

(b) Notice. The program director must be given adequate notice of the application and an opportunity to appear and be heard (for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order), unless the application asserts a belief that:

(1) The program director is involved in the criminal activities to be investigated by the undercover agent or informant; or

(2) The program director will intentionally or unintentionally disclose the proposed placement of an undercover agent or informant to the employees or agents who are suspected of criminal activities.

« PreviousContinue »