(g) Section 2.12(d) has been included to make explicit one of the legal implications of the authorizing legislation, which is cast in terms descriptive of the records which are to be confidential rather than of the recordkeepers on whom a duty is thus imposed. The result is that, for example, where a State agency maintains an individual client record which contains identifying information about a client (i.e., patient) receiving treatment or rehabilitation services for drug abuse, such a record is clearly a record maintained in connection with a drug abuse prevention function, and is subject to the provisions of this part. The fact that the record may also be required by statute or regulations pertaining to eligibility for Federal Financial Participation would in no way exempt the record from the prohibitions and requirements of this part. Thus, it would be unlawful and a violation of these regulations for such a record to be made available to a law enforcement agency, or to determine (without the prior written consent of the client) eligibility for other welfare benefits, or for any other administrative or investigative uses or purposes which would involve or result in an identification of the client to a third party.

§ 2.13 General rules regarding confidentiality.-Rules.

(a) In general. Records to which this part applies shall be confidential and may be disclosed only as authorized by this part, and may not otherwise be divulged in any civil, criminal, administrative, or legislative proceeding conducted by any Federal, State, or local authority, whether such proceeding is commenced before or after the effective date of this part.

(b) Unconditional compliance required. The prohibition upon unauthorized disclosure applies irrespective of whether the person seeking disclosure already has the information sought, has other means of obtaining it, enjo, 3 official status, has obtained a subpoena, or asserts any other justification or basis for disclosure not expressly authorized under this part.

(c) Information covered by prohibition. The prohibition on unauthorized disclosure covers all information about

patients, including their attendance or absence, physical whereabouts, or status as patients, whether or not recorded, in the possession of program personnel, except as provided in paragraph (d) of this section.

(d) Crimes on program premises or against program personnel. Where a patient commits or threatens to commit a crime on the premises of the program or against personnel of the program, nothing in this part shall be construed as prohibiting personnel of the program from seeking the assistance of, or reporting such crime to, a law enforcement agency, but such report shall not identify the suspect as a patient. In any such situation, immediate consideration should be given to seeking an order under Subpart E of this part to permit the disclosure of such limited information about the patient as may be necessary under the circumstances.

(e) Implicit and negative disclosures prohibited. The disclosure that а person (whether actual or fictitious) answering to a particular description, name, or other idenfication is not or has not been attending a program, whether over a period of time or on a particular occasion, is fully as much subject to the prohibitions and conditions of this part as a disclosure that such a person is or has been attending such a program. Any improper or unauthorized request for any disclosure of records or information subject to this part must be met by a non-committal response.

(f) In-patients and residents. The presence of any in-patient in a medical facility or resident in a residential facility for the treatment of drug or alcohol abuse may be acknowledged to callers and visitors with his written consent. Without such consent, the presence of any in-patient or resident in a facility for the treatment of a variety of conditions may be acknowledged if done in such a way as not to indicate that the patient is being treated for drug or alcohol abuse.

§ 2.13-1 General rules regarding confidentiality.-Basis and purpose.

(a) Section 2.13(a) enunciates the general principle of the statutory pro

from

visions, and is unchanged § 1401.03 of the previous regulations. (b) Sections 2.13(b) and 2.13(c) have been added on the basis of written comments on the draft regulations published August 22, 1974, in which there was a documented report that counsel for a program had advised the program that it could furnish information to the FBI about patients without their written consent and without completing a full judicial proceeding in accordance with Subpart E of this part. Sections 2.13(b) and 2.13(c) should clarify the original intent of the statutes and regulations to the extent of precluding such errors in the future.

(c) In the situation described in § 2.13(d), the desirability of the general prophylactic rule prohibiting disclosures by program personnel about patients regardless of whether such disclosures are from a written record must yield to the practical necessity to permit protection from, and prompt reporting of, criminal acts. In the preface to the first set of regulations issued under 21 U.S.C. 1175, it was emphasized that the operation of that section "in no way creates a sanctuary for criminals." (37 FR 24636, November 17, 1972). Section 2.13(d) is consistent with that contemporaneous administrative construction.

(d) Section 2.13(e) is adapted from § 1401.11 of the August 22, 1974 draft. The suggestion that this part be cited when declining to give information has been deleted on the basis of comments that correctly pointed out that such a citation, if given by an institution or program maintaining some records covered by this part and some not, would serve to identify the records inquired about as pertaining to treatment covered by this part.

(e) Section 2.13(f) merely clarifies the effect of the preceding paragraphs in the special situations to which paragraph (f) relates.

§2.14 Penalty for violations.-Rules.

(a) Penalty provided by law. Any person who violates any provision of the authorizing legislation or any prcvision of this part shall be fined not more than $500 in the case of a first

offense, and not more than $5,000 in the case of each subsequent offense.

(b) Application to subsequent offenses. Where a defendant has committed one offense under either section authorizing this part or any provision of this part authorized by that section, any offense thereafter committed under the same section or any provision of this part authorized under that section shall be treated as a subsequent offense.

§ 2.14-1 Penalty for violations.—Basis and purpose.

(a) Section 2.14 states the criminal penalty provided for in subsection (f) of the sections authorizing this part. It is included in this part for convenience and completeness. Some of the comments received on this section when originally proposed suggested that criminal penalties for violation should include imprisonment, but such a change would have to be made by legislation rather than rulemaking.

(b) Section 2.14(b) clarifies the intention that the "subsequent offense" need not be identical to the first offense, as long as it is committed with respect to the same statutory section. For example, a person whose first offense had consisted of improperly releasing the name of a patient in an alcoholism treatment program would be punishable for a "subsequent offense" if he later gives out information from the diagnostic work-up of an alcoholism patient.

§ 2.15 Minor patients.-Rules.

(a) Definition of minor. The term "minor" means a person who has not attained the age of 18 years or, in a State where a different age is expressly provided by State law as the age at which a person ceases to be a minor, the age prescribed by the law of such State.

(b) Consent to disclosure in general. Except as provided in paragraph (c), of this section, where consent is required for any disclosure under this part, such consent in the case of a minor must be given by both the minor and his parent, guardian, or other person authorized under State law to act in his behalf, but any disclosure made after the patient has ceased

to be a minor may be consented to only by the patient.

(c) Rule when State law authorizes treatment without parental consent. Whenever a patient, acting alone, has the legal capacity under the applicable State law to apply for and obtain such diagnosis, counselling, administration of medication, or other services as actually are or were provided to him by the program with respect to which he is or was a patient, any consent required for disclosure under this part may be given only by the patient, notwithstanding the fact that the patient may be a minor.

(d) Initial contacts. When a minor applies for services under circumstances other than those described in paragraph (c) of this section, the fact of such application may not be disclosed, except as an incident to a communication authorized under paragraph (f) of this section, without consent of the applicant, to the applicant's parent, guardian, or other person authorized under State law to act on behalf of the applicant. When such an applicant refuses consent, it must be explained to the applicant that while he or she has the right (subject to the provisions of paragraph (f) of this section) to withhold such consent, the services applied for cannot be provided without it.

(e) Collection or attempted collection of payment for services. Where State law authorizes the furnishing of services to a minor without the consent of the minor's parent or guardian, no inquiry may be made of the parent's or guardian's financial responsibility, and no bill, statement, request for payment, or any other communication in respect of such services may be transmitted directly or indirectly to such parent or guardian, without the express written consent of the patient. Such consent may not be made a condition of the furnishing of services except in the case of a program which is not required by law, and does not in fact hoid itself out as willing, to furnish services irrespective of ability to pay.

(f) Applicant lacking capacity for rational choice. When, in the judgment of a program director a minor applicant for services, because of extreme

youth or mental or physical condition, lacks the capacity to make a rational decision on whether to consent to the notification of a parent or guardian, and the situation of the applicant poses a substantial threat to the life or physical well being of the applicant or any other individual, and such threat might be reduced by communicating the relevant facts to a parent or guardian of the applicant, such facts may be so communicated by the program director or by program personnel authorized by the director to do so.

§ 2.15-1 Minor patients.-Basis and purpose.

(a) The statutes authorizing this part are totally silent on the issue of the capacity of a minor to give consent for disclosures, and there is nothing in the legislative history to suggest that the question was ever considered by Congress. The question is, however, one which arises repeatedly, and it is therefore appropriately addressed under the general rulemaking authority conferred by subsection (g) of the authorizing legislation.

(b) Perhaps no legal issues are more highly charged than those affecting the relationship of parent and child. Since Congress has not evidenced an intention to affect this relationship, it is clear that local law should govern, and the task of rulemaking is limited to that of insuring, as far as possible, that the results under Federal law are consistent with local policy.

(c) Where a State has authorized the furnishing of treatment or other services of a given type to a minor without notice to or consent by the parent or guardian, it seems clear that a consistent Federal policy with respect to disclosure requires that consent for any disclosure of the treatment record be given by the minor. This policy, moreover, should not be frustrated by attempts to enforce parental financial responsibility in a situation where the State itself has determined that the minor should have a right to obtain services without involving the parent.

(d) A much more difficult problem is presented in the case of a minor who applies for services in a jurisdiction which has not determined that a minor should have the right to obtain

them without parental knowledge or consent. 'The question may arise as to whether the clinician has an ethical or legal duty to notify the parent which conflicts with a duty of nondisclosure. The rules in § 2.15 are based upon the theory that Federal law should not invalidate a State policy which prohibits treatment without parental consent, but that keeping confidential a mere application for treatment is not ordinarily a sufficient transgression of such a State policy as to require an exception to the general Federal policy prohibiting disclosure of an application for services without the consent of the applicant.

(e) Section 2.15(f) deals with the case of the minor applicant who lacks the capacity to make a rational choice about consenting to disclosure. It is based upon the theory that where a person is actually as well as legally incapable of acting in his own interest, disclosures to a person who is legally responsible for him may be made to the extent that the best interests of the patient clearly so require. Any other rule could subject clinicians to an intolerable choice between violating the provisions of this part on the one hand, or failing to take action to avoid a preventable tragedy involving a minor, on the other. The statutes authorizing this part should not be read as requiring such a choice.

(a) Incompetent patients other than minors. Where consent is required for any disclosure under this part, such consent in the case of a patient who has been adjudicated as lacking the capacity, for any reason other than insufficient age, to manage his or her own affairs may be given by the guardian or other person authorized under State law to act in the patient's behalf.

(b) Deceased patients. (1) In general. Except as provided in paragraph (b)(2) of this section, where consent is required for any disclosure of this part, such consent in the case of records of a deceased patient may be given by an executor, administrator, or other personal representative. If there is no appointment of a personal representa

tive, such consent may be given by the patient's spouse, or if none, by any responsible member of the patient's family.

(2) Vital statistics. In the case of a deceased patient, disclosures required under Federal or State laws involving the collection of death and other vital statistics may be made without consent.

§ 2.16-1 Incompetent and deceased patients.-Basis and purpose.

Section 2.16 essentially repeats the substance of § 1401.04 of the previous regulations, broadened to reflect the fact that the statutes now allow any consensual disclosures permitted by the regulations, and to cover the situation of deceased patients for whom no formal appointment of an executor, administrator, or other personal representative has been made. Written comments were received to the effect that the power to consent to disclosure in the case of a deceased patient should be limited to a personal representative. The expense of probate or administration in some jurisdictions could cause financial hardship to survivors, and on balance it is believed that where the assets of an estate are insufficient to justify the appointment of a personal representative, the public interest is served by permitting others to consent to disclosure.

§2.17 Security precautions.-Rules.

(a) Precautions required. Appropriate precautions must be taken for the security of records to which this part applies. Records containing any information pertaining to patients shall be kept in a secure room, or in a locked file cabinet, safe, or other similar container, when not in use.

(b) Policies and procedures. Depending upon the type and size of the program, appropriate policies and procedures should be instituted for the further security of records. For example, except where this function is personally performed by the program director, a single member of the program staff should be designated to process inquiries and requests for patient information, and a written procedure should be in effect regulating and controlling access by those members of the staff

whose responsibilities require such access, and providing for accountability.

§ 2.17-1 Security precautions.-Basis and purpose.

The enormous variations in both the size and the type of programs to which this part is applicable preclude the formulation of specific requirements with respect to the physical security of records. Almost any requirement which could be laid down would, under some circumstances, either be impracticable or perverse in its effects. For example, in a facility handling a variety of medical records, all of which are confidential and so marked, a requirement that those pertaining to drug or alcohol treatment be marked in any distinctive way would merely serve to identify such records as pertaining to drug or alcohol treatment-precisely the opposite of the intended result. The purpose of § 2.17, which is based upon § 1401.25 of the previous regulations, is to alert programs to the necessity of exercising due care with respect to the security of patient records.

§2.18 Extent of disclosure.-Rule.

Any disclosure made under this part, whether with or without the patient's consent, shall be limited to information necessary in the light of the need or purpose for the disclosure.

§ 2.18-1 Extent of a disclosure.-Basis and purpose.

(a) Section 2.18 expresses the general principle, which has application in many different contexts, that any disclosure from records covered by this part should be limited to information necessary in the light of the need or purpose for the disclosure. It is identical to § 1401.06 of the previous regulations.

(b) This section should not be misunderstood as imposing a limitation on the scope of records which may or should be made available to health agencies conducting inspections as described in §2.55. All of the records maintained by a program may be relevant to such inspection. The Congress has determined that disclosure under such circumstances is not a violation of the statutes authorizing this

(a) Definitions. As used in this section, § 2.19-1, and §§ 2.67 and 2.67-1,— (1) The term "undercover agent" means a member of any Federal, State, or local law enforcement or investigative agency whose identity as such is concealed from either the patients or personnel of a program in which he enrolls or attempts to enroll. (2) The term "informant" means a person who, at the request of a Federal, State, or local law enforcement or investigative agency or officer, carries on observation of one or more persons enrolled in or employed by a program in which he is enrolled or employed, for the purpose of reporting to such agency or officer information concerning such persons which he obtains as a result of such observation subsequent to such request.

(b) General prohibition. Except as otherwise provided in paragraph (c) of this section, or as specifically authorized by a court order granted under § 2.67,

(1) No undercover agent or informant may be employed by or enrolled in any alcohol or drug abuse treatment program;

(2) No supervisor or other person having authority over an undercover agent may knowingly permit such agent to be or remain employed by or enrolled in any such program; and

(3) No law enforcement or investigative officer may recruit or retain an informant with respect to such a program.

(c) Exceptions. The enrollment of a law enforcement officer in a treatment program shall not be deemed a violation of this section if (1) such enrollment is solely for the purpose of enabling the officer to obtain treatment for his own abuse of alcohol or drugs, and (2) his status as a law enforcement