point of the program, and second, as to whether the objective is to ascertain compliance with predetermined standards (examinations as defined in § 2.54, and program evaluation as defined in §2.11(g)(1)), or to ascertain the validity of a given standard or hypothesis (scientific research, and program evaluation as defined in § 2.11(g)(2)). The application of the foregoing classifications logically results in the creation of four categories of activities. Three of them are specifically dealt with in the succeeding sections of this subpart and need not detain us here; the fourth is discussed below.

(n) Scientific research and evaluation. Beyond the bare restatement of the authorizing legislation set forth in § 2.52, these regulations are deliberately silent with respect to purely voluntary scientific research and program evaluation in the sense defined in §2.11(g)(2). Testimony and written comments received on the August 22, 1974 draft regulations were noteworthy in two respects. First, no instances of abuse on the part of persons acquiring patient identifying information under these circumstances were cited. Second, while there was some wellfounded criticism of the attempt in that draft to provide guidelines for determining what is scientific research and who is qualified to do it, no usable alternatives—indeed, almost no alternatives at all-were forthcoming.

(0) In one of the written comments, the writer cautioned against any assumption "that our major remaining problems in drug and alcohol abuse treatment are prevention of illicit diversion and protection of confidnentiality," and suggested "that we still have a problem in discovering, testing and evaluating improved treatment techniques. To do this," he continued, "one should place minimal obstacles in the way of bona fide clinical and epidemiologic research!"

(p) The result of leaving the rule as it is in the statute, without attempting to sharpen its outlines or define its terms, will be to leave it for interpretation on a case-by-case basis by those who must apply it in practice: the researchers who seek the information, and the programs which supply it.

This does not foreclose the possibility of amending the regulations on the basis of experience if it appears either that clinicians are becoming so cautious that research and evaluation studies are being choked off, or that abuses are occurring in the use of information disclosed. But until a need for more detailed regulation in this area is demonstrated, we think its imposition would do more harm than good.

§ 2.53 Governmental agencies.-Rules.

(a) In general. Where research, audit, or evaluation functions are performed by or on behalf of a State or Federal governmental agency, the minimum qualifications of personnel performing such functions may be determined by such agency, subject to the provisions of this part, with particular reference to the organizational requirements and limitations on the categories of records subject to review by different categories of personnel.

(b) Financial and administrative records. Where program records are reviewed by personnel who lack either the responsibility for, or appropriate training and supervision for, conducting scientific research, determining adherence to treatment standards, or evaluating treatment as such, such review should be confined as far as practicable to administrative and financial records. Under no circumstances should such personnel be shown caseworker or counsellor notes, or similar clinical records. Programs should organize their records so that financial and administrative matters can be reviewed without disclosing clinical information and without disclosing patient identifying information except where necessary for audit verification.

(c) Scientific research and long-term evaluation studies. No State and no agency or political subdivision of a State may require, as a condition to funding, licensing, or otherwise, that any program furnish patient identifying information for the purpose of conducting scientific research or longterm evaluation studies unless the recipient of such information is legally required to hold such information in confidence, is prohibited from taking

any administrative, investigative, or other action with respect to any individual patient on the basis of such information, and is prohibited from identifying, directly or indirectly, any individual patient in any report of such research or evaluation, or otherwise disclosing patient identities in any manner.

(d) Opinion and description to be furnished program. Before any patient identifying information is required to be submitted by a program under the circumstances described in paragraph (c), the program shall be furnished

(1) An opinion by the attorney general or other chief legal officer of the State to the effect that the conditions specified in paragraph (c) of this section are fulfilled with respect to such program or with respect to all programs in such State similarly situated, and

(2) A description of the administrative procedures and physical limitations on access or other measures to provide for the security of the data, but such description shall not be in such detail as to furnish guidance for wrongful attempts to breach such security.

(e) Exclusiveness of procedures. No State or local governmental agency may require any treatment program to furnish patient identifying information to itself or any other recipient except in conformity with this section or § 2.54. No Federal agency may require any treatment program to furnish patient identifying information to itself or any other recipient except in conformity with this section (other than paragraph (d)(1) thereof) or § 2.54.

§2.53-1 Governmental

and purpose.

agencies.-Basis

Section 2.53 is an implementation of the authority contained in subsection (g) of the authorizing legislation to provide safeguards and procedures to effectuate the purposes of such legislation. It makes clear that whenever information is required of a program, whether by law or by the terms or conditions of a contract or grant, the procedures and safeguards required under this section are applicable.

§ 2.54 Patient identifying information in connection with examinations.-Rules. (a) Definitions. For the purposes of this section

(1) The term "examination" means any examination to which this section is made applicable by paragraph (b) of this section.

(2) The term "examiner" means any individual or any public or private organization, including any Federal, State, or local governmental agency, which conducts an examination to which this section applies.

(b) Applicability. This section applies to any examination of the records of a treatment program which is carried out for the purpose of or as aid to ascertaining the accuracy or adequacy of its financial or other records, or the efficiency or effectiveness of its financial, administrative, or medical management, or its adherence to financial, legal, medical, administrative, or other standards, regardless of

whether such examination is called an audit, an evaluation, an inspection, or by any other name.

(c) Statement required for disclosure of patient identifying information in connection with examination. No program may make, and no examiner may require, any disclosure of patient identifying information in connection with an examination unless the examiner furnishes to the program a written statement

(1) That no record of patient identifying information will be made or retained by or on behalf of the examiner in connection with the examination without notice to the program in accordance with paragraph (c)(2) of this section, or

(2) Setting forth the specific purpose for which a record of patient identifying information is being retained by or on behalf of the examiner, the location at which such information will be kept, and the name, official title, address, and telephone number of a responsible individual to whom any inquiries by the program about the disposition of such record should be directed.

(d) Disposition of record of patient identifying information in connection with examination. After any record of patient identifying information re

90-164 - 78 - 4

tained in connection with an examination has served its purpose, or within the time prescribed in paragraph (e) of this section, whichever is earlier, the examiner shall destroy or return to the program all records (including any copies thereof) containing patient identifying information which have been in its possession in connection with such examination.

(e) Maximum time allowed for disposition. The action required by paragraph (d) of this section shall be completed

(1) Except as provided in paragraph (e)(2) of this section not more than two years after the record was acquired by or on behalf of the examiner, or

(2) Where the record is needed in connection with a formal legal proceeding against the program commenced or to be commenced not more than two years after the record was acquired, and written notice to this effect is furnished to the program within two years after the record was acquired, not later than the termination of such proceeding.

(f) Notice of final disposition. When an examiner disposes of records as required by paragraph (d) of this section, or not later than the time prescribed by paragraph (e) of this section, whichever is earlier, the examiner shall furnish to the program concerned a written statement

(1) That there has been compliance with this section and with the provisions of this part prohibiting any disclosure of patient identifying information from records held by auditors or evaluators, or

(2) Specifying the particulars in which there has been a failure of compliance.

§ 2.54-1 Patient identifying information in connection with examinations.-Basis and purpose.

Confidence on the part of treatment progra. personnel in the integrity of auditing and regulatory processes is important to the effective functioning of the treatment system. It is the purpose of § 2.54 to foster practices which will both justify and engender such confidence.

§ 2.55 Supervision and regulation of narcotic maintenance and detoxification programs.-Rules.

(a) Definition of "registrant". For the purposes of this section, the term "registrant" means a person who (1) has pending an application for registration under section 303(g) of the Controlled Substances Act (21 U.S.C. 823(g)), or (2) has been registered under such section and whose registration has not expired or been surrendered or revoked.

(b) Drug Enforcement Administration. Duly authorized agents of the Drug Enforcement Administration shall have access to the premises of registrants for the purpose of ascertaining compliance (or ability to comply) with standards established by the Attorney General under section 303(g)(2) of the Controlled Substances Act (21 U.S.C. 823(g)(2)) respecting the security of stocks of narcotic drugs and the maintenance of records (in accordance with section 307 of the Controlled Substances Act, 21 U.S.C. 827) on such drugs. Registrants shall maintain such records separate from and in addition to patients' clinical records required to be maintained under 21 CFR 310.505(d)(7)(iii), which shall not be available to such agents except as authorized under a court order in accordance with Subpart E of this part. Records maintained by registrants for the purposes of section 307 of the Controlled Substances Act (21 U.S.C. 827) need not identify patients by name, address, social security number, or otherwise except by an identifying number assigned by the registrant, but where such a system is used, the registrant shall maintain on a current basis a cross-index referencing each identifying number to the name and address of the patient to whom it refers. Upon request at any time and without advance notice, but subject to the provisions of § 2.54, such agents shall be granted immediate access to any such index. Such agents may use names and addresses so obtained strictly for the purposes of auditing or verifying program records, and shall exercise all reasonable precautions to avoid inadvertent disclosure of patient identities to third parties. Names and other identifying information so obtained

may not be compiled or used in any registry or personal data bank of any description.

(c) Food and Drug Administration. Duly authorized agents of the Food and Drug Administration shall have access to the premises of registrants and to all records maintained by registrants, for the purpose of ascertaining compliance (or ability to comply) with standards established by the Secretary of Health, Education and Welfare under section 4 of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (42 U.S.C. 257a), sections 303(g)(1) and 303(g)(3) of the Controlled Substances Act (21 U.S.C. 823(g)(1) and 823(g)(3)), and sections 505 and 701(a) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 355 and 371(a)). When necessary in the conduct of their duties, and subject to the provisions of § 2.54, agents may use names and addresses of patients strictly for the purposes of auditing or verifying program records, and shall exercise all reasonable precautions to avoid inadvertent disclosure of patient identities to third parties. Names and other identifying information on patients obtained pursuant to this section or by any other compulsory process may not be compiled or used in any registry or personal data bank of any description. Except as authorized under this paragraph or by a court order granted under Subpart E of this part, (1) such agents may not, either orally or in writing, except in conversation with personnel of the registrant while on the premises of the registrant, identify any patient otherwise than by reference to an identifying number assigned by the registrant, and (2) such agents may not remove from the premises of the registrant any notes, documents, or copies thereof which contain patient identifying information.

(d) State drug law enforcement agencies. Duly authorized agents of any State drug law enforcement agency having jurisdiction and specific responsibility by statute or otherwise for the enforcement of criminal laws relating to controlled substances (as defined in the Controlled Substances Act) shall have access to the premises of any registrant for the purposes

(with respect to corresponding provisions, if any, of State law) and subject to the restrictions and limitations set forth in paragraph (b) of this section, and subject to § 2.54.

(e) State health authorities. (1) Definition of "qualified State health agency". As used in this paragraph, the term "qualified State health agency" means an agency of State government (i) which has express legal responsibility to ascertain that registrants under its jurisdiction comply with appropriate treatment standards; (ii) which is legally and administratively separate from any agency of State government responsible for investigation of violations of, or enforcement of, criminal law generally or criminal laws relating to controlled substances; (iii) whose personnel are qualified by training or experience to conduct inspections of health care facilities to ascertain compliance with treatment standards; and (iv) whose personnel are by State law, or by published administrative directive enforced by effective sanctions, required to maintain the confidentiality of any information concerning the identity of patients which they may acquire in the course of their official duties.

(2) Access. Duly authorized agents of a qualified State health agency shall have access to the premises of registrants and to all records maintained by registrants, for the purpose of ascertaining compliance (or ability to comply) with treatment standards (including those relating to quantities of narcotic drugs which may be provided for unsupervised use by individuals in treatment) established under State law. Such access, and the use of any information thereby obtained, shall be subject to the restrictions and limitations set forth in paragraph (c) of this section, and subject to § 2.54.

§ 2.55-1 Supervision and regulation of narcotic maintenance and detoxification programs.—Basis and purpose. (a) Section 2.55 is addressed to the general problem described in the following passage from the legislative history of Pub. L. 93-282:

A major element of the task of fashioning new regulations pursuant to the express rulemaking authority conferred by this legis

lation will be to reconcile the sometimes conflicting interests of research, audit, and evaluation with rights of privacy and the confidentiality of the relationship between patient and clinician. Such a reconciliation becomes particularly crucial where the functions of research, audit, or evaluation are conducted by a governmental agency with regulatory powers and responsibility, and the treatment involves the use of a drug such as methadone which is in a research status or which is readily susceptible of misuse or illicit diversion.

Because of the difficulty and complexity of the task, the rulemaking authority is intentionally cast in terms broad enough to permit the limitation of the scope, content, or circumstances of any disclosure under subsection (b), whether (b)(1) or (b)(2), in the light of the necessary purposes for which it is made or required. (Congressional Record, daily edition, May 6, 1974, page H3563).

(b) It has been the consistent interpretation of the Special Action Office for Drug Abuse Prevention that the only provision of the authorizing legislation which permits disclosures to compliance officers, whether of DEA, FDA, or state agencies, is subsection (b)(2)(B). That subsection strictly prohibits any further disclosure of names or other identifying information concerning patients, and the statutory prohibition has been buttressed by provisions of these regulations, notably 82.54, providing safeguards and procedures to assure that the statutory prohibition is respected.

(c) In testimony and written comment on the August 22, 1974 draft of these regulations, it has been urged that access to patient identifying information by law enforcement personnel, even for the limited purposes allowed by statute and regulation, should be prohibited except pursuant to a court order obtained under 21 U.S.C. 1175(b)(2)(C). We believe that such a prohibition is beyond our power to impose.

(d) Section 307(b) of the Controlled Substances Act (21 U.S.C. 827) provides, in pertinent part, "Every record .equired under this section shall be kept and be available, for at least two years, for inspection and copying by officers or employees of the United States authorized by the Attorney General." It is a well known principle of statutory construction

that amendments and repeals by implication are not favored. In People v. Newman, 32 N.Y.2d 379, 345 N.Y.S.2d 502, 298 N.E.2d 651 (1973), cert. denied 414 U.S. 1163, 94 S.Ct. 927, 39L. Ed. 2d 116 (1974), the United States filed amicus briefs with the Court of Appeals of New York and with the United States Supreme Court, arguing that section 408 of Pub. L. 92-255 (21 U.S.C. 1175) did not effect an implied amendment or repeal of the provisions of Pub. L. 91-513 (21 U.S.C. 872(c) and 42 U.S.C. 242a(a)) which confer on the Attorney General and the Secretary of Health, Education, and Welfare the power to grant the so-called research privilege discussed in § 2.24. This position was expressly adopted by the New York court. We cannot now take the inconsistent position that section 408 of Pub. L. 92-255 did indeed amend by implication section 307 of Pub. L. 91513, particularly in the face of a contrary contemporaneous administrative interpretation by both the Special Action Office for Drug Abuse Prevention and the Department of Justice. In short, if the right of access and copying conferred on Federal agents by 21 U.S.C. 827 is to be amended to provide that it may only be exercised pursuant to a court order in the case of maintenance and detoxification programs, that is a change which must be wrought by the Congress.

(e) In the case of inspections carried out by health supervisory agencies, we think that denial of access to any documents showing patient identifying information may have a serious adverse effect on the validity of the inspection process. Even if a program keeps its own records in terms of patient-identifying numbers assigned by the program, the patient file may containmay, indeed, be required to containdocuments signed by the patient or originating outside the program. Where signatures, names, and addresses are all obliterated, it is impossible for the inspector to check the file even for apparent internal consistency. We believe that outright forgery is and will remain a rarity, but the temptation to cover improper or inadequate documentation by "accidental misfilings," may be something else again.