§2.16 guardian or other person authorized under State law to act in the patient's behalf. (2) No adjudication of incompetency. For any period for which the program director determines that a patient, other than a minor or one who has been adjudicated incompetent, suffers from a medical condition that prevents knowing or effective action on his or her own behalf, the program director may exercise the right of the patient to consent to a disclosure under subpart C of these regulations for the sole purpose of obtaining payment for services from a third party payer. (b) Deceased patients—(1) Vital statistics. These regulations do not restrict the disclosure of patient identifying information relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death. (2) Consent by personal representative. Any other disclosure of information identifying a deceased patient as an alcohol or drug abuser is subject to these regulations. If a written consent to the disclosure is required, that consent may be given by an executor, administrator, or other personal representative appointed under applicable State law. If there is no such appointment the consent may be given by the patient's spouse or, if none, by any responsible member of the patient's family. $2.16 Security for written records. (a) Written records which are subject to these regulations must be maintained in a secure room, locked file cabinet, safe or other similar container when not in use; and (b) Each program shall adopt in writing procedures which regulate and control access to and use of written records which are subject to these regulations. §2.17 Undercover agents and informants. (a) Restrictions on placement. Except as specifically authorized by a court order granted under §2.67 of these regulations, no program may knowingly employ, or enroll as a patient, any undercover agent or informant. 16 42 CFR Ch. I (10-1-00 Edition) (b) Restriction on use of information. No information obtained by an undercover agent or informant, whether or not that undercover agent or informant is placed in a program pursuant to an authorizing court order, may be used to criminally investigate or prosecute any patient. [52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2, 1987] §2.18 Restrictions on the use of identification cards. No person may require any patient to carry on his or her person while away from the program premises any card or other object which would identify the patient as an alcohol or drug abuser. This section does not prohibit a person from requiring patients to use or carry cards or other identification objects on the premises of a program. $2.19 Disposition of records by discontinued programs. consent (a) General. If a program discontinues operations or is taken over or acquired by another program, it must purge patient identifying information from its records or destroy the records unless(1) The patient who is the subject of the records gives written (meeting the requirements of §2.31) to a transfer of the records to the acquiring program or to any other program designated in the consent (the manner of obtaining this consent must minimize the likelihood of a disclosure of patient identifying information to a third party); or (2) There is a legal requirement that the records be kept for a period specified by law which does not expire until after the discontinuation or acquisition of the program. (b) Procedure where retention period required by law. If paragraph (a)(2) of this section applies, the records must be: (1) Sealed in envelopes or other containers labeled as follows: "Records of [insert name of program] required to be maintained under [insert citation to statute, regulation, court order or other legal authority requiring that records be kept] until a date not later than [insert appropriate date]"; and (2) Held under the restrictions of these regulations by a responsible person who must, as soon as practicable after the end of the retention period specified on the label, destroy the records. §2.20 Relationship to State laws. The statutes authorizing these regulations (42 U.S.C. 290ee-3 and 42 U.S.C. 290dd-3) do not preempt the field of law which they cover to the exclusion of all State laws in that field. If a disclosure permitted under these regulations is prohibited under State law, neither these regulations nor the authorizing statutes may be construed to authorize any violation of that State law. However, no State law may either authorize or compel any disclosure prohibited by these regulations. §2.21 Relationship to Federal statutes protecting research subjects against compulsory disclosure of their identity. (a) Research privilege description. There may be concurrent coverage of patient identifying information by these regulations and by administrative action taken under: Section 303(a) of the Public Health Service Act (42 U.S.C. 242a(a) and the implementing regulations at 42 CFR part 2a); or section 502(c) of the Controlled Substances Act (21 U.S.C. 872(c) and the implementing regulations at 21 CFR 1316.21). These "research privilege" statutes confer on the Secretary of Health and Human Services and on the Attorney General, respectively, the power to authorize researchers conducting certain types of research to withhold from all persons not connected with the research the names and other identifying information concerning individuals who are the subjects of the research. (b) Effect of concurrent coverage. These regulations restrict the disclosure and use of information about patients, while administrative action taken under the research privilege statutes and implementing regulations protects a person engaged in applicable research from being compelled to disclose any identifying characteristics of the individuals who are the subjects of that research. The issuance under subpart E of these regulations of a court order authorizing a disclosure of information about a patient does not affect an exercise of authority under these research privilege statutes. However, the research privilage granted under 21 CFR 291.505(g) to treatment programs using methadone for maintenance treatment does not protect from compulsory disclosure any imformation which is permitted to be disclosed under those regulations. Thus, if a court order entered in accordance with subpart E of these regulations authorizes a methadone maintenance treatment program to disclose certain information about its patients, that program may not invoke the research privilege under 21 CFR 291.505(g) as a defense to a subpoena for that information. §2.22 Notice to patients of Federal confidentiality requirements. (a) Notice required. At the time of admission or as soon threreafter as the patient is capable of rational communication, each program shall: (1) Communicate to the patient that Federal law and regulations protect the confidentiality of alcohol and drug abuse patient records; and (2) Give to the patient a summary in writing of the Federal law and regulations. (b) Required elements of written summary. The written summary of the Federal law and regulations must include: (1) A general description of the limited circumstances under which a program may acknowledge that an individual is present at a facility or disclose outside the program information identifying a patient as an alcohol or drug abuser. (2) A statement that violation of the Federal law and regulations by a program is a crime and that suspected violations may be reported to appropriate authorities in accordance with these regulations. (3) A statement that information related to a patient's commission of a crime on the premises of the program or against personnel of the program is not protected. (4) A statement that reports of suspected child abuse and neglect made under State law to appropriate State or local authorities are not protected. (5) A citation to the Federal law and regulations. (c) Program options. The program may devise its own notice or may use the §2.23 sample notice in paragraph (d) to comply with the requirement to provide the patient with a summary in writing of the Federal law and regulations. In addition, the program may include in the written summary information concerning State law and any program policy not inconsistent with State and Federal law on the subject of confidentiality of alcohol and drug abuse patient records. (d) Sample notice. CONFIDENTIALITY OF ALCOHOL AND DRUG The confidentiality of alcohol and drug abuse patient records maintained by this program is protected by Federal law and regulations. Generally, the program may not say to a person outside the program that a patient attends the program, or disclose any information identifying a patient as an alcohol or drug abuser Unless: (1) The patient consents in writing: (2) The disclosure is allowed by a court order; or (3) The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation. Violation of the Federal law and regulations by a program is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations. Federal law and regulations do not protect any information about a crime committed by a patient either at the program or against any person who works for the program or about any threat to commit such a crime. Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under State law to appropriate State or local authorities. (See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR part 2 for Federal regulations.) (Approved by the Office of Management and Budget under control number 0930-0099) §2.23 Patient access and restrictions on use. (a) Patient access not prohibited. These regulations do not prohibit a program from giving a patient access to his or her own records, including the opportunity to inspect and copy any records that the program maintains about the patient. The program is not required to obtain a patient's written consent or other authorization under these regula 18 42 CFR Ch. I (10-1-00 Edition) tions in order to provide such access to the patient. (b) Restriction on use of information. Information obtained by patient access to his or her patient record is subject to the restriction on use of his information to initiate or substantiate any criminal charges against the patient or to conduct any criminal investigation of the patient as provided for under §2.12(d)(1). Subpart C-Disclosures With §2.31 Form of written consent. (a) Required elements. A written consent to a disclosure under these regulations must include: (1) The specific name or general designation of the program or person permitted to make the disclosure. (2) The name or title of the individual or the name of the organization to which disclosure is to be made. (3) The name of the patient. (4) The purpose of the disclosure. (5) How much and what kind of information is to be disclosed. (6) The signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent under §2.14; or, when required for a patient who is incompetent or deceased, the signature of a person authorized to sign under §2.15 in lieu of the patient. (7) The date on which the consent is signed. (8) A statement that the consent is subject to revocation at any time except to the extent that the program or person which is to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third party payer. (9) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must insure that the consent will last no longer than reasonably necessary to serve the purpose for which it is given. (b) Sample consent form. The following form complies with paragraph (a) of this section, but other elements may be added. 1. I (name of patient) □ Request □ Authorize: 2. (name or general designation of program which is to make the disclosure) 3. To disclose: (kind and amount of information to be disclosed) 4. To: (name or title of the person or organization to which disclosure is to be made) 5. For (purpose of the disclosure) 6. Date (on which this consent is signed) 7. Signature of patient 8. Signature of parent or guardian (where required) 9. Signature of person authorized to sign in lieu of the patient (where required) 10. This consent is subject to revocation at any time except to the extent that the program which is to make the disclosure has already taken action in reliance on it. If not previously revoked, this consent will terminate upon: (specific date, event, or condition) (c) Expired, deficient, or false consent. A disclosure may not be made on the basis of a consent which: (1) Has expired; (2) On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section; (3) Is known to have been revoked; or (4) Is known, or through a reasonable effort could be known, by the person holding the records to be materially false. (Approved by the Office of Management and Budget under control number 0930-0099) §2.32 Prohibition on redisclosure. Notice to accompany disclosure. Each disclosure made with the patient's written consent must be accompanied by the following written statement: This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to crimi nally investigate or prosecute any alcohol or drug abuse patient. [52 FR 21809, June 9, 1987; 52 FR 41997, Nov. 2, 1987] §2.33 Disclosures permitted with written consent. If a patient consents to a disclosure of his or her records under §2.31, a program may disclose those records in accordance with that consent to any individual or organization named in the consent, except that disclosures to central registries and in connection with criminal justice referrals must meet the requirements of §§2.34 and 2.35, respectively. §2.34 Disclosures to prevent multiple enrollments in detoxification and maintenance treatment programs. (a) Definitions. For purposes of this section: Central registry means an organization which obtains from two or more member progams patient identifying information about individuals applying for maintenance treatment or detoxification treatment for the purpose of avoiding an individual's concurrent enrollment in more than one program. Detoxification treatment means the dispensing of a narcotic drug in decreasing doses to an individual in order to reduce or eliminate adverse physiological or psychological effects incident to withdrawal from the sustained use of a narcotic drug. Maintenance treatment means the dispensing of a narcotic drug in the treatment of an individual for dependence upon heroin or other morphine-like drugs. Member program means a detoxification treatment or maintenance treatment program which reports patient identifying information to a central registry and which is in the same State as that central registry or is not more than 125 miles from any border of the State in which the central registry is located. (b) Restrictions on disclosure. A program may disclose patient records to a central registry or to any detoxification or maintenance treatment program not more than 200 miles away for the purpose of preventing the multiple enrollment of a patient only if: (1) The disclosure is made when: (i) The patient is accepted for treatment; (ii) The type or dosage of the drug is changed; or (iii) The treatment is interrupted, resumed or terminated. (2) The disclosure is limited to: (i) Patient identifying information; (ii) Type and dosage of the drug; and (iii) Relevant dates. (3) The disclosure is made with the patient's written consent meeting the requirements of §2.31, except that: (i) The consent must list the name and address of each central registry and each known detoxification maintenance treatment program to which a disclosure will be made; and or (ii) The consent may authorize a disclosure to any detoxification or maintenance treatment program established within 200 miles of the program after the consent is given without naming any such program. or (c) Use of information limited to prevention of multiple enrollments. A central registry and any detoxification maintenance treatment program to which information is disclosed to prevent multiple enrollments may not redisclose or use patient identifying information for any purpose other than the prevention of multiple enrollments unless authorized by a court order under subpart E of these regulations. (d) Permitted disclosure by a central registry to prevent a multiple enrollment. When a member program asks a central registry if an identified patient is enrolled in another member program and the registry determines that the patient is so enrolled, the registry may disclose (1) The name, address, and telephone number of the member program(s) in which the patient is already enrolled to the inquiring member program; and (2) The name, address, and telephone number of the inquiring member program to the member program(s) in which the patient is already enrolled. The member programs may communicate as necessary to verify that no error has been made and to prevent or eliminate any multiple enrollment. (e) Permitted disclosure by a detoxification or maintenance treatment program to prevent a multiple enrollment. A detoxi fication or maintenance treatment program which has received a disclosure under this section and has determined that the patient is already enrolled may communicate as necessary with the program making the disclosure to verify that no error has been made and to prevent or eliminate any multiple enrollment. §2.35 Disclosures to elements of the criminal justice system which have referred patients. (a) A program may disclose information about a patient to those persons within the criminal justice system which have made participation in the program a condition of the disposition of any criminal proceedings against the patient or of the patient's parole or other release from custody if: (1) The disclosure is made only to those individuals within the criminal justice system who have a need for the information in connection with their duty to monitor the patient's progress (e.g., a prosecuting attorney who is withholding charges against the patient, a court granting pretrial or posttrial release, probation or parole officers responsible for supervision of the patient); and (2) The patient has signed a written consent meeting the requirements of §2.31 (except paragraph (a)(8) which is inconsistent with the revocation provisions of paragraph (c) of this section) and the requirements of paragraphs (b) and (c) of this section. (b) Duration of consent. The written consent must state the period during which it remains in effect. This period must be reasonable, taking into account: (1) The anticipated length of the treatment; (2) The type of criminal proceeding involved, the need for the information in connection with the final disposition of that proceeding, and when the final disposition will occur; and (3) Such other factors as the program, the patient, and the person(s) who will receive the disclosure consider pertinent. (c) Revocation of consent. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, |