HIPAA Policy

REGO PARK COUNSELING, LLC

HIPAA POLICIES

SUBCHAPTER A—GENERAL PROVISIONSPART 1 [RESERVED]

PART 2—CONFIDENTIALITY OF ALCOHOL

AND DRUG ABUSE PATIENT

RECORDS

Subpart A—Introduction

Sec.

2.1 Statutory authority for confidentiality

of drug abuse patient records.

2.2 Statutory authority for confidentiality

of alcohol abuse patient records.

2.3 Purpose and effect.

2.4 Criminal penalty for violation.

2.5 Reports of violations.

Subpart B—General Provisions

2.11 Definitions.

2.12 Applicability.

2.13 Confidentiality restrictions.

2.14 Minor patients.

2.15 Incompetent and deceased patients.

2.16 Security for written records.

2.17 Undercover agents and informants.

2.18 Restrictions on the use of identification

cards.

2.19 Disposition of records by discontinued

programs.

2.20 Relationship to State laws.

2.21 Relationship to Federal statutes protecting

research subjects against compulsory

disclosure of their identity.

2.22 Notice to patients of Federal confidentiality

requirements.

2.23 Patient access and restrictions on use.

Subpart C—Disclosures With Patient’s

Consent

2.31 Form of written consent.

2.32 Prohibition on redisclosure.

2.33 Disclosures permitted with written

consent.

2.34 Disclosures to prevent multiple enrollments

in detoxification and maintenance

treatment programs.

2.35 Disclosures to elements of the criminal

justice system which have referred patients.

Subpart D—Disclosures Without Patient

Consent

2.51 Medical emergencies.

2.52 Research activities.

2.53 Audit and evaluation activities.

Subpart E—Court Orders Authorizing

Disclosure and Use

2.61 Legal effect of order.

2.62 Order not applicable to records disclosed

without consent to researchers,

auditors and evaluators.

2.63 Confidential communications.

2.64 Procedures and criteria for orders authorizing

disclosures for noncriminal

purposes.

2.65 Procedures and criteria for orders authorizing

disclosure and use of records to

criminally investigate or prosecute patients.

2.66 Procedures and criteria for orders authorizing

disclosure and use of records to

investigate or prosecute a program or

the person holding the records.

2.67 Orders authorizing the use of undercover

agents and informants to criminally

investigate employees or agents of

a program.

AUTHORITY: Sec. 408 of Pub. L. 92–255, 86

Stat. 79, as amended by sec. 303 (a), (b) of

Pub L. 93–282, 83 Stat. 137, 138; sec. 4(c)(5)(A)

of Pub. L. 94–237, 90 Stat. 244; sec. 111(c)(3) of

Pub. L. 94–581, 90 Stat. 2852; sec. 509 of Pub.

L. 96–88, 93 Stat. 695; sec. 973(d) of Pub. L. 97–

35, 95 Stat. 598; and transferred to sec. 527 of

the Public Health Service Act by sec.

2(b)(16)(B) of Pub. L. 98–24, 97 Stat. 182 and as

amended by sec. 106 of Pub. L. 99–401, 100

Stat. 907 (42 U.S.C. 290ee–3) and sec. 333 of

Pub. L. 91–616, 84 Stat. 1853, as amended by

sec. 122(a) of Pub. L. 93–282, 88 Stat. 131; and

sec. 111(c)(4) of Pub. L. 94–581, 90 Stat. 2852

and transferred to sec. 523 of the Public

Health Service Act by sec. 2(b)(13) of Pub. L.

98–24, 97 Stat. 181 and as amended by sec. 106

of Pub. L. 99–401, 100 Stat. 907 (42 U.S.C.

290dd–3), as amended by sec. 131 of Pub. L.

102–321, 106 Stat. 368, (42 U.S.C. 290dd–2).

SOURCE: 52 FR 21809, June 9, 1987, unless

otherwise noted.

Subpart A—Introduction

§ 2.1 Statutory authority for confidentiality

of drug abuse patient

records.

The restrictions of these regulations

upon the disclosure and use of drug

abuse patient records were initially authorized

by section 408 of the Drug

Abuse Prevention, Treatment, and Rehabilitation

Act (21 U.S.C. 1175). That

section as amended was transferred by

Pub. L. 98–24 to section 527 of the Public

Health Service Act which is codified

at 42 U.S.C. 290ee–3. The amended statutory

authority is set forth below:

§ 290ee–3. CONFIDENTIALITY OF PATIENT

RECORDS.

(a) Disclosure authorization

Records of the identity, diagnosis, prognosis,

or treatment of any patient which are

maintained in connection with the performance

of any drug abuse prevention function

conducted, regulated, or directly or indirectly

assisted by any department or agency

of the United States shall, except as provided

in subsection (e) of this section, be confidential

and be disclosed only for the purposes

and under the circumstances expressly authorized

under subsection (b) of this section.

(b) Purposes and circumstances of disclosure

affecting consenting patient and patient regardless

of consent

(1) The content of any record referred to in

subsection (a) of this section may be disclosed

in accordance with the prior written

consent of the patient with respect to whom

such record is maintained, but only to such

extent, under such circumstances, and for

such purposes as may be allowed under regulations

prescribed pursuant to subsection (g)

of this section.

(2) Whether or not the patient, with respect

to whom any given record referred to

in subsection (a) of this section is maintained,

gives his written consent, the content

of such record may be disclosed as follows:

(A) To medical personnel to the extent necessary

to meet a bona fide medical emergency.

(B) To qualified personnel for the purpose

of conducting scientific research, management

audits, financial audits, or program

evaluation, but such personnel may not identify,

directly or indirectly, any individual

patient in any report of such research, audit,

or evaluation, or otherwise disclose patient

identities in any manner.

a court of competent jurisdiction granted

after application showing good cause therefor.

In assessing good cause the court shall

weigh the public interest and the need for

disclosure against the injury to the patient,

to the physician-patient relationship, and to

the treatment services. Upon the granting of

such order, the court, in determining the extent

to which any disclosure of all or any

part of any record is necessary, shall impose

appropriate safeguards against unauthorized

disclosure.

criminal charges or investigation of patient

Except as authorized by a court order

granted under subsection (b)(2)(C) of this section,

no record referred to in subsection (a)

of this section may be used to initiate or

substantiate any criminal charges against a

patient or to conduct any investigation of a

patient.

(d) Continuing prohibition against disclosure

irrespective of status as patient

The prohibitions of this section continue

to apply to records concerning any individual

who has been a patient, irrespective of

whether or when he ceases to be a patient.

(e) Armed Forces and Veterans’ Administration;

interchange of records; report of suspected

child abuse and neglect to State or local authorities

The prohibitions of this section do not

apply to any interchange of records—

(1) within the Armed Forces or witrhin

those components of the Veterans’ Administration

furnishing health care to veterans, or

(2) between such components and the

Armed Forces.

The prohibitions of this section do not

apply to the reporting under State law of incidents

of suspected child abuse and neglect

to the appropriate State or local authorities.

(f) Penalty for first and subsequent offenses

Any person who violates any provision of

this section or any regulation issued pursuant

to this section shall be fined not more

than $500 in the case of a first offense, and

not nore than $5,000 in the case of each subsequent

offense.

(g) Regulations; interagency consultations;

definitions, safeguards, and procedures, including

procedures and criteria for issuance and

scope of orders

Except as provided in subsection (h) of this

section, the Secretary, after consultation

with the Administrator of Veterans’ Affairs

and the heads of other Federal departments

and agencies substantially affected thereby,

shall prescribe regulations to carry out the

purposes of this section. These regulations

may contain such definitions, and may provide

for such safeguards and procedures, including

procedures and criteria for the

issuance and scope of orders under subsection

(b)(2)(C) of this section, as in the

judgment of the Secretary are necessary or

proper to effectuate the purposes of this section,

to prevent circumvention or evasion

thereof, or to facilitate compliance therewith.

(Subsection (h) was superseded by section

111(c)(3) of Pub. L. 94–581. The responsibility

of the Administrator of Veterans’ Affairs to

write regulations to provide for confidentiality

of drug abuse patient records under

Title 38 was moved from 21 U.S.C. 1175 to 38

U.S.C. 4134.)

§ 2.2 Statutory authority for confidentiality

of alcohol abuse patient

records.

The restrictions of these regulations

upon the disclosure and use of alcoholPublic Health Service, HHS § 2.2

abuse patient records were initially authorized

by section 333 of the Comprehensive

Alcohol Abuse and Alcoholism

Prevention, Treatment, and Rehabilitation

Act of 1970 (42 U.S.C. 4582).

The section as amended was transferred

by Pub. L. 98–24 to section 523 of

the Public Health Service Act which is

codified at 42 U.S.C. 290dd–3. The

amended statutory authority is set

forth below:

§ 290dd–3. CONFIDENTIALITY OF PATIENT

RECORDS

(a) Disclosure authorization

Records of the identity, diagnosis, prognosis,

or treatment of any patient which are

maintained in connection with the performance

of any program or activity relating to

alcoholism or alcohol abuse education, training,

treatment, rehabilitation, or research,

which is conducted, regulated, or directly or

indirectly assisted by any department or

agency of the United States shall, except as

provided in subsection (e) of this section, be

confidential and be disclosed only for the

purposes and under the circumstances expressly

authorized under subsection (b) of

this section.

(b) Purposes and circumstances of disclosure

affecting consenting patient and patient regardless

of consent

(1) The content of any record referred to in

subsection (a) of this section may be disclosed

in accordance with the prior written

consent of the patient with respect to whom

such record is maintained, but only to such

extent, under such circumstances, and for

such purposes as may be allowed under regulations

prescribed pursuant to subsection (g)

of this section.

(2) Whether or not the patient, with respect

to whom any given record referred to

in subsection (a) of this section is maintained,

gives his written consent, the content

of such record may be disclosed as follows:

(A) To medical personnel to the extent necessary

to meet a bona fide medical emergency.

(B) To qualified personnel for the purpose

of conducting scientific research, management

audits, financial audits, or program

evaluation, but such personnel may not identify,

directly or indirectly, any individual

patient in any report of such research, audit,

or evaluation, or otherwise disclose patient

identities in any manner.

a court of competent jurisdiction granted

after application showing good cause therefor.

In assessing good cause the court shall

weigh the public interest and the need for

disclosure against the injury to the patient,

to the physician-patient relationship, and to

the treatment services. Upon the granting of

such order, the court, in determining the extent

to which any disclosure of all or any

part of any record is necessary, shall impose

appropriate safeguards against unauthorized

disclosure.

criminal charges or investigation of patient

Except as authorized by a court order

granted under subsection (b)(2)(C) of this section,

no record referred to in subsection (a)

of this section may be used to initiate or

substantiate any criminal charges against a

patient or to conduct any investigation of a

patient.

(d) Continuing prohibition against disclosure

irrespective of status as patient

The prohibitions of this section continue

to apply to records concerning any individual

who has been a patient, irrespective of

whether or when he ceases to be a patient.

(e) Armed Forces and Veterans’ Administration;

interchange of record of suspected child

abuse and neglect to State or local authorities

The prohibitions of this section do not

apply to any interchange of records—

(1) within the Armed Forces or within

those components of the Veterans’ Administration

furnishing health care to veterans, or

(2) between such components and the

Armed Forces.

The prohibitions of this section do not apply

to the reporting under State law of incidents

of suspected child abuse and neglect to the

appropriate State or local authorities.

(f) Penalty for first and subsequent offenses

Any person who violates any provision of

this section or any regulation issued pursuant

to this section shall be fined not more

than $500 in the case of a first offense, and

not more than $5,000 in the case of each subsequent

offense.

(g) Regulations of Secretary; definitions, safeguards,

and procedures, including procedures

and criteria for issuance and scope of orders

Except as provided in subsection (h) of this

section, the Secretary shall prescribe regulations

to carry out the purposes of this section.

These regulations may contain such

definitions, and may provide for such safeguards

and procedures, including procedures

and criteria for the issuance and scope of orders

under subsection(b)(2)(C) of this section,

as in the judgment of the Secretary are necessary

or proper to effectuate the purposes of

this section, to prevent circumvention or

evasion thereof, or to facilitate compliance

therewith.

(Subsection (h) was superseded by section

111(c)(4) of Pub. L. 94–581. The responsibility

of the Administrator of Veterans’ Affairs to

write regulations to provide for confidentiality

of alcohol abuse patient records under

Title 38was moved from 42 U.S.C. 4582 to 38

U.S.C. 4134.) § 2.3 42 CFR Ch. I (10–1–10 Edition)

§ 2.3 Purpose and effect.

(a) Purpose. Under the statutory provisions

quoted in §§ 2.1 and 2.2, these

regulations impose restrictions upon

the disclosure and use of alcohol and

drug abuse patient records which are

maintained in connection with the performance

of any federally assisted alcohol

and drug abuse program. The regulations

specify:

(1) Definitions, applicability, and

general restrictions in subpart B (definitions

applicable to § 2.34 only appear

in that section);

(2) Disclosures which may be made

with written patient consent and the

form of the written consent in subpart

(3) Disclosures which may be made

without written patient consent or an

authorizing court order in subpart D;

and

(4) Disclosures and uses of patient

records which may be made with an authorizing

court order and the procedures

and criteria for the entry and

scope of those orders in subpart E.

(b) Effect. (1) These regulations prohibit

the disclosure and use of patient

records unless certain circumstances

exist. If any circumstances exists

under which disclosure is permitted,

that circumstance acts to remove the

prohibition on disclosure but it does

not compel disclosure. Thus, the regulations

do not require disclosure under

any circumstances.

(2) These regulations are not intended

to direct the manner in which

substantive functions such as research,

treatment, and evaluation are carried

out. They are intended to insure that

an alcohol or drug abuse patient in a

federally assisted alcohol or drug abuse

program is not made more vulnerable

by reason of the availability of his or

her patient record than an individual

who has an alcohol or drug problem

and who does not seek treatment.

(3) Because there is a criminal penalty

(a fine—see 42 U.S.C. 290ee–3(f), 42

U.S.C. 290dd–3(f) and 42 CFR 2.4) for

violating the regulations, they are to

be construed strictly in favor of the potential

violator in the same manner as

a criminal statute (see M. Kraus &

Brothers v. United States, 327 U.S. 614,

621–22, 66 S. Ct. 705, 707–08 (1946)).

§ 2.4 Criminal penalty for violation.

Under 42 U.S.C. 290ee–3(f) and 42

U.S.C. 290dd–3(f), any person who violates

any provision of those statutes or

these regulations shall be fined not

more than $500 in the case of a first offense,

and not more than $5,000 in the

case of each subsequent offense.

§ 2.5 Reports of violations.

(a) The report of any violation of

these regulations may be directed to

the United States Attorney for the judicial

district in which the violation

occurs.

(b) The report of any violation of

these regulations by a methadone program

may be directed to the Regional

Offices of the Food and Drug Administration.

Subpart B—General Provisions

§ 2.11 Definitions.

For purposes of these regulations:

Alcohol abuse means the use of an alcoholic

beverage which impairs the

physical, mental, emotional, or social

well-being of the user.

Drug abuse means the use of a

psychoactive substance for other than

medicinal purposes which impairs the

physical, mental, emotional, or social

well-being of the user.

Diagnosis means any reference to an

individual’s alcohol or drug abuse or to

a condition which is identified as having

been caused by that abuse which is

made for the purpose of treatment or

referral for treatment.

Disclose or disclosure means a communication

of patient indentifying information,

the affirmative verification of

another person’s communication of patient

identifying information, or the

communication of any information

from the record of a patient who has

been identified.

Informant means an individual:

(a) Who is a patient or employee of a

program or who becomes a patient or

employee of a program at the request

of a law enforcement agency or official:

and

(b) Who at the request of a law enforcement

agency or official observes

one or more patients or employees ofPublic Health Service, HHS § 2.12

the program for the purpose of reporting

the information obtained to the

law enforcement agency or official.

Patient means any individual who has

applied for or been given diagnosis or

treatment for alcohol or drug abuse at

a federally assisted program and includes

any individual who, after arrest

on a criminal charge, is identified as an

alcohol or drug abuser in order to determine

that individual’s eligibility to

participate in a program.

Patient identifying information means

the name, address, social security number,

fingerprints, photograph, or similar

information by which the identity

of a patient can be determined with

reasonable accuracy and speed either

directly or by reference to other publicly

available information. The term

does not include a number assigned to

a patient by a program, if that number

does not consist of, or contain numbers

(such as a social security, or driver’s license

number) which could be used to

identify a patient with reasonable accuracy

and speed from sources external

to the program.

Person means an individual, partnership,

corporation, Federal, State or

local government agency, or any other

legal entity.

Program means:

(a) An individual or entity (other

than a general medical care facility)

who holds itself out as providing, and

provides, alcohol or drug abuse diagnosis,

treatment or referral for treatment;

(b) An identified unit within a general

medical facility which holds itself

out as providing, and provides, alcohol

or drug abuse diagnosis, treatment or

referral for treatment; or

in a general medical care facility

whose primary function is the provision

of alcohol or drug abuse diagnosis,

treatment or referral for treatment

and who are identified as such providers.

(See § 2.12(e)(1) for examples.)

Program director means:

(a) In the case of a program which is

an individual, that individual:

(b) In the case of a program which is

an organization, the individual designated

as director, managing director,

or otherwise vested with authority to

act as chief executive of the organization.

Qualified service organization means a

person which:

(a) Provides services to a program,

such as data processing, bill collecting,

dosage preparation, laboratory analyses,

or legal, medical, accounting, or

other professional services, or services

to prevent or treat child abuse or neglect,

including training on nutrition

and child care and individual and group

therapy, and

(b) Has entered into a written agreement

with a program under which that

person:

(1) Acknowledges that in receiving,

storing, processing or otherwise dealing

with any patient records from the

progams, it is fully bound by these regulations;

and

(2) If necessary, will resist in judicial

proceedings any efforts to obtain access

to patient records except as permitted

by these regulations.

Records means any information,

whether recorded or not, relating to a

patient received or acquired by a federally

assisted alcohol or drug program.

Third party payer means a person who

pays, or agrees to pay, for diagnosis or

treatment furnished to a patient on the

basis of a contractual relationship with

the patient or a member of his family

or on the basis of the patient’s eligibility

for Federal, State, or local governmental

benefits.

Treatment means the management

and care of a patient suffering from alcohol

or drug abuse, a condition which

is identified as having been caused by

that abuse, or both, in order to reduce

or eliminate the adverse effects upon

the patient.

Undercover agent means an officer of

any Federal, State, or local law enforcement

agency who enrolls in or becomes

an employee of a program for

the purpose of investigating a suspected

violation of law or who pursues

that purpose after enrolling or becoming

employed for other purposes.

[52 FR 21809, June 9, 1987, as amended by 60

FR 22297, May 5, 1995]

§ 2.12 Applicability.

(a) General—(1) Restrictions on disclosure.

The restrictions on disclosure in§ 2.12 42 CFR Ch. I (10–1–10 Edition)

these regulations apply to any information,

whether or not recorded,

which:

(i) Would identify a patient as an alcohol

or drug abuser either directly, by

reference to other publicly available

information, or through verification of

such an identification by another person;

and

(ii) Is drug abuse information obtained

by a federally assisted drug

abuse program after March 20, 1972, or

is alcohol abuse information obtained

by a federally assisted alcohol abuse

program after May 13, 1974 (or if obtained

before the pertinent date, is

maintained by a federally assisted alcohol

or drug abuse program after that

date as part of an ongoing treatment

episode which extends past that date)

for the purpose of treating alcohol or

drug abuse, making a diagnosis for

that treatment, or making a referral

for that treatment.

(2) Restriction on use. The restriction

on use of information to initiate or

substantiate any criminal charges

against a patient or to conduct any

criminal investigation of a patient (42

U.S.C. 290ee–3(c), 42 U.S.C. 290dd–3(c))

applies to any information, whether or

not recorded which is drug abuse information

obtained by a federally assisted

drug abuse program after March 20,

1972, or is alcohol abuse information

obtained by a federally assisted alcohol

abuse program after May 13, 1974 (or if

obtained before the pertinent date, is

maintained by a federally assisted alcohol

or drug abuse program after that

date as part of an ongoing treatment

episode which extends past that date),

for the purpose of treating alcohol or

drug abuse, making a diagnosis for the

treatment, or making a referral for the

treatment.

(b) Federal assistance. An alcohol

abuse or drug abuse program is considered

to be federally assisted if:

(1) It is conducted in whole or in

part, whether directly or by contract

or otherwise by any department or

agency of the United States (but see

paragraphs (c)(1) and (c)(2) of this section

relating to the Veterans’ Administration

and the Armed Forces);

(2) It is being carried out under a license,

certification, registration, or

other authorization granted by any department

or agency of the United

States including but not limited to:

(i) Certification of provider status

under the Medicare program;

(ii) Authorization to conduct methadone

maintenance treatment (see 21

CFR 291.505); or

(iii) Registration to dispense a substance

under the Controlled Substances

Act to the extent the controlled substance

is used in the treatment of alcohol

or drug abuse;

(3) It is supported by funds provided

by any department or agency of the

United States by being:

(i) A recipient of Federal financial

assistance in any form, including financial

assistance which does not directly

pay for the alcohol or drug abuse

diagnosis, treatment, or referral activities;

(ii) Conducted by a State or local

government unit which, through general

or special revenue sharing or other

forms of assistance, receives Federal

funds which could be (but are not necessarily)

spent for the alcohol or drug

abuse program; or

(4) It is assisted by the Internal Revenue

Service of the Department of the

Treasury through the allowance of income

tax deductions for contributions

to the program or through the granting

of tax exempt status to the program.

These regulations do not apply

to information on alcohol and drug

abuse patients maintained in connection

with the Veterans’ Administration

provisions of hospital care, nursing

home care, domiciliary care, and medical

services under title 38, United

States Code. Those records are governed

by 38 U.S.C. 4132 and regulations

issued under that authority by the Administrator

of Veterans’ Affairs.

(2) Armed Forces. These regulations

apply to any information described in

paragraph (a) of this section which was

obtained by any component of the

Armed Forces during a period when the

patient was subject to the Uniform

Code of Military Justice except:

(i) Any interchange of that information

within the Armed Forces; and

(ii) Any interchange of that information

between the Armed Forces andPublic Health Service, HHS § 2.12

those components of the Veterans Administration

furnishing health care to

veterans.

(3) Communication within a program or

between a program and an entity having

direct administrative control over that

program. The restrictions on disclosure

in these regulations do not apply to

communications of information between

or among personnel having a

need for the information in connection

with their duties that arise out of the

provision of diagnosis, treatment, or

referral for treatment of alcohol or

drug abuse if the communications are

(i) Within a program or

(ii) Between a program and an entity

that has direct administrative control

over the program.

(4) Qualified Service Organizations.

The restrictions on disclosure in these

regulations do not apply to communications

between a program and a

qualified service organization of information

needed by the organization to

provide services to the program.

(5) Crimes on program premises or

against program personnel. The restrictions

on disclosure and use in these

regulations do not apply to communications

from program personnel to

law enforcement officers which—

(i) Are directly related to a patient’s

commission of a crime on the premises

of the program or against program personnel

or to a threat to commit such a

crime; and

(ii) Are limited to the circumstances

of the incident, including the patient

status of the individual committing or

threatening to commit the crime, that

individual’s name and address, and

that individual’s last known whereabouts.

(6) Reports of suspected child abuse and

neglect. The restrictions on disclosure

and use in these regulations do not

apply to the reporting under State law

of incidents of suspected child abuse

and neglect to the appropriate State or

local authorities. However, the restrictions

continue to apply to the original

alcohol or drug abuse patient records

maintained by the program including

their disclosure and use for civil or

criminal proceedings which may arise

out of the report of suspected child

abuse and neglect.

(d) Applicability to recipients of information—(

1) Restriction on use of information.

The restriction on the use of any

information subject to these regulations

to initiate or substantiate any

criminal charges against a patient or

to conduct any criminal investigation

of a patient applies to any person who

obtains that information from a federally

assisted alcohol or drug abuse program,

regardless of the status of the

person obtaining the information or of

whether the information was obtained

in accordance with these regulations.

This restriction on use bars, among

other things, the introduction of that

information as evidence in a criminal

proceeding and any other use of the information

to investigate or prosecute a

patient with respect to a suspected

crime. Information obtained by undercover

agents or informants (see § 2.17)

or through patient access (see § 2.23) is

subject to the restriction on use.

(2) Restrictions on disclosures—Third

party payers, administrative entities, and

others. The restrictions on disclosure in

these regulations apply to:

(i) Third party payers with regard to

records disclosed to them by federally

assisted alcohol or drug abuse programs;

(ii) Entities having direct administrative

control over programs with regard

to information communicated to

them by the program under § 2.12(c)(3);

and

(iii) Persons who receive patient

records directly from a federally assisted

alcohol or drug abuse program

and who are notified of the restrictions

on redisclosure of the records in accordance

with § 2.32 of these regulations.

(e) Explanation of applicability—(1)

Coverage. These regulations cover any

information (including information on

referral and intake) about alcohol and

drug abuse patients obtained by a program

(as the terms ‘‘patient’’ and

‘‘program’’ are defined in § 2.11) if the

program is federally assisted in any

manner described in § 2.12(b). Coverage

includes, but is not limited to, those

treatment or rehabilitation programs,

employee assistance programs, programs

within general hospitals, schoolbased

programs, and private practitioners

who hold themselves out as§ 2.13 42 CFR Ch. I (10–1–10 Edition)

providing, and provide alcohol or drug

abuse diagnosis, treatment, or referral

for treatment. However, these regulations

would not apply, for example, to

emergency room personnel who refer a

patient to the intensive care unit for

an apparent overdose, unless the primary

function of such personnel is the

provision of alcohol or drug abuse diagnosis,

treatment or referral and they

are identified as providing such services

or the emergency room has promoted

itself to the community as a

provider of such services.

(2) Federal assistance to program required.

If a patient’s alcohol or drug

abuse diagnosis, treatment, or referral

for treatment is not provided by a program

which is federally conducted, regulated

or supported in a manner which

constitutes Federal assistance under

§ 2.12(b), that patient’s record is not

covered by these regulations. Thus, it

is possible for an individual patient to

benefit from Federal support and not

be covered by the confidentiality regulations

because the program in which

the patient is enrolled is not federally

assisted as defined in § 2.12(b). For example,

if a Federal court placed an individual

in a private for-profit program

and made a payment to the program on

behalf of that individual, that patient’s

record would not be covered by these

regulations unless the program itself

received Federal assistance as defined

by § 2.12(b).

(3) Information to which restrictions are

applicable. Whether a restriction is on

use or disclosure affects the type of information

which may be available. The

restrictions on disclosure apply to any

information which would identify a patient

as an alcohol or drug abuser. The

restriction on use of information to

bring criminal charges against a patient

for a crime applies to any information

obtained by the program for

the purpose of diagnosis, treatment, or

referral for treatment of alcohol or

drug abuse. (Note that restrictions on

use and disclosure apply to recipients

of information under § 2.12(d).)

(4) How type of diagnosis affects coverage.

These regulations cover any

record of a diagnosis identifying a patient

as an alcohol or drug abuser

which is prepared in connection with

the treatment or referral for treatment

of alcohol or drug abuse. A diagnosis

prepared for the purpose of treatment

or referral for treatment but which is

not so used is covered by these regulations.

The following are not covered by

these regulations:

(i) Diagnosis which is made solely for

the purpose of providing evidence for

use by law enforcement authorities; or

(ii) A diagnosis of drug overdose or

alcohol intoxication which clearly

shows that the individual involved is

not an alcohol or drug abuser (e.g., involuntary

ingestion of alcohol or drugs

or reaction to a prescribed dosage of

one or more drugs).

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987, as amended at 60 FR 22297, May 5, 1995]

§ 2.13 Confidentiality restrictions.

(a) General. The patient records to

which these regulations apply may be

disclosed or used only as permitted by

these regulations and may not otherwise

be disclosed or used in any civil,

criminal, administrative, or legislative

proceedings conducted by any Federal,

State, or local authority. Any disclosure

made under these regulations

must be limited to that information

which is necessary to carry out the

purpose of the disclosure.

(b) Unconditional compliance required.

The restrictions on disclosure and use

in these regulations apply whether the

holder of the information believes that

the person seeking the information already

has it, has other means of obtaining

it, is a law enforcement or

other official, has obtained a subpoena,

or asserts any other justification for a

disclosure or use which is not permitted

by these regulations.

Responding to requests. (1) The

presence of an identified patient in a

facility or component of a facility

which is publicly identified as a place

where only alcohol or drug abuse diagnosis,

treatment, or referral is provided

may be acknowledged only if the patient’s

written consent is obtained in

accordance with subpart C of these regulations

or if an authorizing court

order is entered in accordance with

subpart E of these regulations. The

regulations permit acknowledgement

of the presence of an identified patient

in a facility or part of a facility if the

Public Health Service, HHS § 2.15

facility is not publicy identified as

only an alcohol or drug abuse diagnosis,

treatment or referral facility,

and if the acknowledgement does not

reveal that the patient is an alcohol or

drug abuser.

(2) Any answer to a request for a disclosure

of patient records which is not

permissible under these regulations

must be made in a way that will not affirmatively

reveal that an identified

individual has been, or is being diagnosed

or treated for alcohol or drug

abuse. An inquiring party may be given

a copy of these regulations and advised

that they restrict the disclosure of alcohol

or drug abuse patient records,

but may not be told affirmatively that

the regulations restrict the disclosure

of the records of an identified patient.

The regulations do not restrict a disclosure

that an identified individual is

not and never has been a patient.

§ 2.14 Minor patients.

(a) Definition of minor. As used in

these regulations the term ‘‘minor’’

means a person who has not attained

the age of majority specified in the applicable

State law, or if no age of majority

is specified in the applicable

State law, the age of eighteen years.

(b) State law not requiring parental

consent to treatment. If a minor patient

acting alone has the legal capacity

under the applicable State law to apply

for and obtain alcohol or drug abuse

treatment, any written consent for disclosure

authorized under subpart C of

these regulations may be given only by

the minor patient. This restriction includes,

but is not limited to, any disclosure

of patient identifying information

to the parent or guardian of a

minor patient for the purpose of obtaining

financial reimbursement.

These regulations do not prohibit a

program from refusing to provide

treatment until the minor patient consents

to the disclosure necessary to obtain

reimbursement, but refusal to provide

treatment may be prohibited

under a State or local law requiring

the program to furnish the service irrespective

of ability to pay.

to treatment. (1) Where State law requires

consent of a parent, guardian, or

other person for a minor to obtain alcohol

or drug abuse treatment, any

written consent for disclosure authorized

under subpart C of these regulations

must be given by both the minor

and his or her parent, guardian, or

other person authorized under State

law to act in the minor’s behalf.

(2) Where State law requires parental

consent to treatment the fact of a minor’s

application for treatment may be

communicated to the minor’s parent,

guardian, or other person authorized

under State law to act in the minor’s

behalf only if:

(i) The minor has given written consent

to the disclosure in accordance

with subpart C of these regulations or

(ii) The minor lacks the capacity to

make a rational choice regarding such

consent as judged by the program director

under paragraph (d) of this section.

(d) Minor applicant for services lacks

capacity for rational choice. Facts relevant

to reducing a threat to the life or

physical well being of the applicant or

any other individual may be disclosed

to the parent, guardian, or other person

authorized under State law to act

in the minor’s behalf if the program director

judges that:

(1) A minor applicant for services

lacks capacity because of extreme

youth or mental or physical condition

to make a rational decision on whether

to consent to a disclosure under subpart

C of these regulations to his or her

parent, guardian, or other person authorized

under State law to act in the

minor’s behalf, and

(2) The applicant’s situation poses a

substantial threat to the life or physical

well being of the applicant or any

other individual which may be reduced

by communicating relevant facts to

the minor’s parent, guardian, or other

person authorized under State law to

act in the minor’s behalf.

§ 2.15 Incompetent and deceased patients.

(a) Incompetent patients other than minors—(

1) Adjudication of incompetence.

In the case of a patient who has been

adjudicated as lacking the capacity,

for any reason other than insufficient

age, to manage his or her own affairs,

any consent which is required under

these regulations may be given by the

§ 2.16 42 CFR Ch. I (10–1–10 Edition)

guardian or other person authorized

under State law to act in the patient’s

behalf.

(2) No adjudication of incompetency.

For any period for which the program

director determines that a patient,

other than a minor or one who has been

adjudicated incompetent, suffers from

a medical condition that prevents

knowing or effective action on his or

her own behalf, the program director

may exercise the right of the patient to

consent to a disclosure under subpart C

of these regulations for the sole purpose

of obtaining payment for services

from a third party payer.

(b) Deceased patients—(1) Vital statistics.

These regulations do not restrict

the disclosure of patient identifying information

relating to the cause of

death of a patient under laws requiring

the collection of death or other vital

statistics or permitting inquiry into

the cause of death.

(2) Consent by personal representative.

Any other disclosure of information

identifying a deceased patient as an alcohol

or drug abuser is subject to these

regulations. If a written consent to the

disclosure is required, that consent

may be given by an executor, administrator,

or other personal representative

appointed under applicable State law.

If there is no such appointment the

consent may be given by the patient’s

spouse or, if none, by any responsible

member of the patient’s family.

§ 2.16 Security for written records.

(a) Written records which are subject

to these regulations must be maintained

in a secure room, locked file

cabinet, safe or other similar container

when not in use; and

(b) Each program shall adopt in writing

procedures which regulate and control

access to and use of written

records which are subject to these regulations.

§ 2.17 Undercover agents and informants.

(a) Restrictions on placement. Except

as specifically authorized by a court

order granted under § 2.67 of these regulations,

no program may knowingly

employ, or enroll as a patient, any undercover

agent or informant.

(b) Restriction on use of information.

No information obtained by an undercover

agent or informant, whether or

not that undercover agent or informant

is placed in a program pursuant to

an authorizing court order, may be

used to criminally investigate or prosecute

any patient.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987]

§ 2.18 Restrictions on the use of identification

cards.

No person may require any patient to

carry on his or her person while away

from the program premises any card or

other object which would identify the

patient as an alcohol or drug abuser.

This section does not prohibit a person

from requiring patients to use or carry

cards or other identification objects on

the premises of a program.

§ 2.19 Disposition of records by discontinued

programs.

(a) General. If a program discontinues

operations or is taken over or acquired

by another program, it must purge patient

identifying information from its

records or destroy the records unless—

(1) The patient who is the subject of

the records gives written consent

(meeting the requirements of § 2.31) to

a transfer of the records to the acquiring

program or to any other program

designated in the consent (the manner

of obtaining this consent must minimize

the likelihood of a disclosure of

patient identifying information to a

third party); or

(2) There is a legal requirement that

the records be kept for a period specified

by law which does not expire until

after the discontinuation or acquisition

of the program.

(b) Procedure where retention period required

by law. If paragraph (a)(2) of this

section applies, the records must be:

(1) Sealed in envelopes or other containers

labeled as follows: ‘‘Records of

[insert name of program] required to be

maintained under [insert citation to

statute, regulation, court order or

other legal authority requiring that

records be kept] until a date not later

than [insert appropriate date]’’; and

(2) Held under the restrictions of

these regulations by a responsible person

who must, as soon as practicablePublic Health Service, HHS § 2.22

after the end of the retention period

specified on the label, destroy the

records.

§ 2.20 Relationship to State laws.

The statutes authorizing these regulations

(42 U.S.C. 290ee–3 and 42 U.S.C.

290dd–3) do not preempt the field of law

which they cover to the exclusion of all

State laws in that field. If a disclosure

permitted under these regulations is

prohibited under State law, neither

these regulations nor the authorizing

statutes may be construed to authorize

any violation of that State law. However,

no State law may either authorize

or compel any disclosure prohibited

by these regulations.

§ 2.21 Relationship to Federal statutes

protecting research subjects

against compulsory disclosure of

their identity.

(a) Research privilege description.

There may be concurrent coverage of

patient identifying information by

these regulations and by administrative

action taken under: Section 303(a)

of the Public Health Service Act (42

U.S.C. 242a(a) and the implementing

regulations at 42 CFR part 2a); or section

502(c) of the Controlled Substances

Act (21 U.S.C. 872(c) and the implementing

regulations at 21 CFR 1316.21).

These ‘‘research privilege’’ statutes

confer on the Secretary of Health and

Human Services and on the Attorney

General, respectively, the power to authorize

researchers conducting certain

types of research to withhold from all

persons not connected with the research

the names and other identifying

information concerning individuals

who are the subjects of the research.

(b) Effect of concurrent coverage. These

regulations restrict the disclosure and

use of information about patients,

while administrative action taken

under the research privilege statutes

and implementing regulations protects

a person engaged in applicable research

from being compelled to disclose any

identifying characteristics of the individuals

who are the subjects of that research.

The issuance under subpart E

of these regulations of a court order

authorizing a disclosure of information

about a patient does not affect an exercise

of authority under these research

privilege statutes. However, the research

privilage granted under 21 CFR

291.505(g) to treatment programs using

methadone for maintenance treatment

does not protect from compulsory disclosure

any imformation which is permitted

to be disclosed under those regulations.

Thus, if a court order entered

in accordance with subpart E of these

regulations authorizes a methadone

maintenance treatment program to

disclose certain information about its

patients, that program may not invoke

the research privilege under 21 CFR

291.505(g) as a defense to a subpoena for

that information.

§ 2.22 Notice to patients of Federal

confidentiality requirements.

(a) Notice required. At the time of admission

or as soon threreafter as the

patient is capable of rational communication,

each program shall:

(1) Communicate to the patient that

Federal law and regulations protect

the confidentiality of alcohol and drug

abuse patient records; and

(2) Give to the patient a summary in

writing of the Federal law and regulations.

(b) Required elements of written summary.

The written summary of the Federal

law and regulations must include:

(1) A general description of the limited

circumstances under which a program

may acknowledge that an individual

is present at a facility or disclose

outside the program information

identifying a patient as an alcohol or

drug abuser.

(2) A statement that violation of the

Federal law and regulations by a program

is a crime and that suspected violations

may be reported to appropriate

authorities in accordance with these

regulations.

(3) A statement that information related

to a patient’s commission of a

crime on the premises of the program

or against personnel of the program is

not protected.

(4) A statement that reports of suspected

child abuse and neglect made

under State law to appropriate State

or local authorities are not protected.

(5) A citation to the Federal law and

regulations.

devise its own notice or may use the§ 2.23 42 CFR Ch. I (10–1–10 Edition)

sample notice in paragraph (d) to comply

with the requirement to provide

the patient with a summary in writing

of the Federal law and regulations. In

addition, the program may include in

the written summary information concerning

State law and any program

policy not inconsistent with State and

Federal law on the subject of confidentiality

of alcohol and drug abuse patient

records.

(d) Sample notice.

CONFIDENTIALITY OF ALCOHOL AND DRUG

ABUSE PATIENT RECORDS

The confidentiality of alcohol and drug

abuse patient records maintained by this

program is protected by Federal law and regulations.

Generally, the program may not

say to a person outside the program that a

patient attends the program, or disclose any

information identifying a patient as an alcohol

or drug abuser Unless:

(1) The patient consents in writing:

(2) The disclosure is allowed by a court

order; or

(3) The disclosure is made to medical personnel

in a medical emergency or to qualified

personnel for research, audit, or program

evaluation.

Violation of the Federal law and regulations

by a program is a crime. Suspected violations

may be reported to appropriate authorities

in accordance with Federal regulations.

Federal law and regulations do not protect

any information about a crime committed

by a patient either at the program or against

any person who works for the program or

about any threat to commit such a crime.

Federal laws and regulations do not protect

any information about suspected child

abuse or neglect from being reported under

State law to appropriate State or local authorities.

(See 42 U.S.C. 290dd–3 and 42 U.S.C. 290ee–3

for Federal laws and 42 CFR part 2 for Federal

regulations.)

(Approved by the Office of Management and

Budget under control number 0930–0099)

§ 2.23 Patient access and restrictions

on use.

(a) Patient access not prohibited. These

regulations do not prohibit a program

from giving a patient access to his or

her own records, including the opportunity

to inspect and copy any records

that the program maintains about the

patient. The program is not required to

obtain a patient’s written consent or

other authorization under these regulations

in order to provide such access to

the patient.

(b) Restriction on use of information.

Information obtained by patient access

to his or her patient record is subject

to the restriction on use of his information

to initiate or substantiate any

criminal charges against the patient or

to conduct any criminal investigation

of the patient as provided for under

§ 2.12(d)(1).

Subpart C—Disclosures With

Patient’s Consent

§ 2.31 Form of written consent.

(a) Required elements. A written consent

to a disclosure under these regulations

must include:

(1) The specific name or general designation

of the program or person permitted

to make the disclosure.

(2) The name or title of the individual

or the name of the organization

to which disclosure is to be made.

(3) The name of the patient.

(4) The purpose of the disclosure.

(5) How much and what kind of information

is to be disclosed.

(6) The signature of the patient and,

when required for a patient who is a

minor, the signature of a person authorized

to give consent under § 2.14; or,

when required for a patient who is incompetent

or deceased, the signature

of a person authorized to sign under

§ 2.15 in lieu of the patient.

(7) The date on which the consent is

signed.

(8) A statement that the consent is

subject to revocation at any time except

to the extent that the program or

person which is to make the disclosure

has already acted in reliance on it.

Acting in reliance includes the provision

of treatment services in reliance

on a valid consent to disclose information

to a third party payer.

(9) The date, event, or condition upon

which the consent will expire if not revoked

before. This date, event, or condition

must insure that the consent

will last no longer than reasonably

necessary to serve the purpose for

which it is given.

(b) Sample consent form. The following

form complies with paragraph (a) of

this section, but other elements may

be added.

Public Health Service, HHS § 2.34

1. I (name of patient) b Request b Authorize:

2. (name or general designation of program

which is to make the disclosure)

llllllllllllllllllllllll

3. To disclose: (kind and amount of information

to be disclosed)

llllllllllllllllllllllll

4. To: (name or title of the person or organization

to which disclosure is to be made)

llllllllllllllllllllllll

5. For (purpose of the disclosure)

llllllllllllllllllllllll

6. Date (on which this consent is signed)

llllllllllllllllllllllll

7. Signature of patient

llllllllllllllllllllllll

8. Signature of parent or guardian (where required)

llllllllllllllllllllllll

9. Signature of person authorized to sign in

lieu of the patient (where required)

llllllllllllllllllllllll

10. This consent is subject to revocation at

any time except to the extent that the program

which is to make the disclosure has already

taken action in reliance on it. If not

previously revoked, this consent will terminate

upon: (specific date, event, or condition)

A disclosure may not be made on the

basis of a consent which:

(1) Has expired;

(2) On its face substantially fails to

conform to any of the requirements set

forth in paragraph (a) of this section;

(3) Is known to have been revoked; or

(4) Is known, or through a reasonable

effort could be known, by the person

holding the records to be materially

false.

(Approved by the Office of Management and

Budget under control number 0930–0099)

§ 2.32 Prohibition on redisclosure.

Notice to accompany disclosure. Each

disclosure made with the patient’s

written consent must be accompanied

by the following written statement:

This information has been disclosed to you

from records protected by Federal confidentiality

rules (42 CFR part 2). The Federal

rules prohibit you from making any further

disclosure of this information unless further

disclosure is expressly permitted by the written

consent of the person to whom it pertains

or as otherwise permitted by 42 CFR

part 2. A general authorization for the release

of medical or other information is NOT

sufficient for this purpose. The Federal rules

restrict any use of the information to criminally

investigate or prosecute any alcohol or

drug abuse patient.

[52 FR 21809, June 9, 1987; 52 FR 41997, Nov. 2,

1987]

§ 2.33 Disclosures permitted with written

consent.

If a patient consents to a disclosure

of his or her records under § 2.31, a program

may disclose those records in accordance

with that consent to any individual

or organization named in the

consent, except that disclosures to central

registries and in connection with

criminal justice referrals must meet

the requirements of §§ 2.34 and 2.35, respectively.

§ 2.34 Disclosures to prevent multiple

enrollments in detoxification and

maintenance treatment programs.

(a) Definitions. For purposes of this

section:

Central registry means an organization

which obtains from two or more

member progams patient identifying

information about individuals applying

for maintenance treatment or detoxification

treatment for the purpose of

avoiding an individual’s concurrent enrollment

in more than one program.

Detoxification treatment means the

dispensing of a narcotic drug in decreasing

doses to an individual in order

to reduce or eliminate adverse physiological

or psychological effects incident

to withdrawal from the sustained

use of a narcotic drug.

Maintenance treatment means the dispensing

of a narcotic drug in the treatment

of an individual for dependence

upon heroin or other morphine-like

drugs.

Member program means a detoxification

treatment or maintenance treatment

program which reports patient

identifying information to a central

registry and which is in the same State

as that central registry or is not more

than 125 miles from any border of the

State in which the central registry is

located.

(b) Restrictions on disclosure. A program

may disclose patient records to a

central registry or to any detoxification

or maintenance treatment program

not more than 200 miles away for

the purpose of preventing the multiple

enrollment of a patient only if§ 2.35 42 CFR Ch. I (10–1–10 Edition)

(1) The disclosure is made when:

(i) The patient is accepted for treatment;

(ii) The type or dosage of the drug is

changed; or

(iii) The treatment is interrupted, resumed

or terminated.

(2) The disclosure is limited to:

(i) Patient identifying information;

(ii) Type and dosage of the drug; and

(iii) Relevant dates.

(3) The disclosure is made with the

patient’s written consent meeting the

requirements of § 2.31, except that:

(i) The consent must list the name

and address of each central registry

and each known detoxification or

maintenance treatment program to

which a disclosure will be made; and

(ii) The consent may authorize a disclosure

to any detoxification or maintenance

treatment program established

within 200 miles of the program after

the consent is given without naming

any such program.

of multiple enrollments. A central

registry and any detoxification or

maintenance treatment program to

which information is disclosed to prevent

multiple enrollments may not redisclose

or use patient identifying information

for any purpose other than

the prevention of multiple enrollments

unless authorized by a court order

under subpart E of these regulations.

(d) Permitted disclosure by a central

registry to prevent a multiple enrollment.

When a member program asks a central

registry if an identified patient is enrolled

in another member program and

the registry determines that the patient

is so enrolled, the registry may

disclose—

(1) The name, address, and telephone

number of the member program(s) in

which the patient is already enrolled to

the inquiring member program; and

(2) The name, address, and telephone

number of the inquiring member program

to the member program(s) in

which the patient is already enrolled.

The member programs may communicate

as necessary to verify that no

error has been made and to prevent or

eliminate any multiple enrollment.

(e) Permitted disclosure by a detoxification

or maintenance treatment program to

prevent a multiple enrollment. A detoxification

or maintenance treatment program

which has received a disclosure

under this section and has determined

that the patient is already enrolled

may communicate as necessary with

the program making the disclosure to

verify that no error has been made and

to prevent or eliminate any multiple

enrollment.

§ 2.35 Disclosures to elements of the

criminal justice system which have

referred patients.

(a) A program may disclose information

about a patient to those persons

within the criminal justice system

which have made participation in the

program a condition of the disposition

of any criminal proceedings against the

patient or of the patient’s parole or

other release from custody if:

(1) The disclosure is made only to

those individuals within the criminal

justice system who have a need for the

information in connection with their

duty to monitor the patient’s progress

(e.g., a prosecuting attorney who is

withholding charges against the patient,

a court granting pretrial or

posttrial release, probation or parole

officers responsible for supervision of

the patient); and

(2) The patient has signed a written

consent meeting the requirements of

§ 2.31 (except paragraph (a)(8) which is

inconsistent with the revocation provisions

of paragraph (c) of this section)

and the requirements of paragraphs (b)

and (c) of this section.

(b) Duration of consent. The written

consent must state the period during

which it remains in effect. This period

must be reasonable, taking into account:

(1) The anticipated length of the

treatment;

(2) The type of criminal proceeding

involved, the need for the information

in connection with the final disposition

of that proceeding, and when the final

disposition will occur; and

(3) Such other factors as the program,

the patient, and the person(s)

who will receive the disclosure consider

pertinent.

consent must state that it is revocable

upon the passage of a specified amount

of time or the occurrence of a specified,: Public Health Service, HHS § 2.53

ascertainable event. The time or occurrence

upon which consent becomes revocable

may be no later than the final

disposition of the conditional release

or other action in connection with

which consent was given.

(d) Restrictions on redisclosure and use.

A person who receives patient information

under this section may redisclose

and use it only to carry out that person’s

official duties with regard to the

patient’s conditional release or other

action in connection with which the

consent was given.

Subpart D—Disclosures Without

Patient Consent

§ 2.51 Medical emergencies.

(a) General Rule. Under the procedures

required by paragraph (c) of this

section, patient identifying information

may be disclosed to medical personnel

who have a need for information

about a patient for the purpose of

treating a condition which poses an immediate

threat to the health of any individual

and which requires immediate

medical intervention.

(b) Special Rule. Patient identifying

information may be disclosed to medical

personnel of the Food and Drug

Administration (FDA) who assert a

reason to believe that the health of any

individual may be threatened by an

error in the manufacture, labeling, or

sale of a product under FDA jurisdiction,

and that the information will be

used for the exclusive purpose of notifying

patients or their physicians of

potential dangers.

disclosure, the program shall document

the disclosure in the patient’s records,

setting forth in writing:

(1) The name of the medical personnel

to whom disclosure was made

and their affiliation with any health

care facility;

(2) The name of the individual making

the disclosure;

(3) The date and time of the disclosure;

and

(4) The nature of the emergency (or

error, if the report was to FDA).

(Approved by the Office of Management and

Budget under control number 0930–0099)

§ 2.52 Research activities.

(a) Patient identifying information

may be disclosed for the purpose of

conducting scientific research if the

program director makes a determination

that the recipient of the patient

identifying information:

(1) Is qualified to conduct the research;

(2) Has a research protocol under

which the patient identifying information:

(i) Will be maintained in accordance

with the security requirements of § 2.16

of these regulations (or more stringent

requirements); and

(ii) Will not be redisclosed except as

permitted under paragraph (b) of this

section; and

(3) Has provided a satisfactory written

statement that a group of three or

more individuals who are independent

of the research project has reviewed

the protocol and determined that:

(i) The rights and welfare of patients

will be adequately protected; and

(ii) The risks in disclosing patient

identifying information are outweighed

by the potential benefits of the research.

(b) A person conducting research may

disclose patient identifying information

obtained under paragraph (a) of

this section only back to the program

from which that information was obtained

and may not identify any individual

patient in any report of that research

or otherwise disclose patient

identities.

[52 FR 21809, June 9, 1987, as amended at 52

FR 41997, Nov. 2, 1987]

§ 2.53 Audit and evaluation activities.

(a) Records not copied or removed. If

patient records are not copied or removed,

patient identifying information

may be disclosed in the course of a review

of records on program premises to

any person who agrees in writing to

comply with the limitations on redisclosure

and use in paragraph (d) of

this section and who:

(1) Performs the audit or evaluation

activity on behalf of:

(i) Any Federal, State, or local governmental

agency which provides financial

assistance to the program or is§ 2.61 42 CFR Ch. I (10–1–10 Edition)

authorized by law to regulate its activities;

(ii) Any private person which provides

financial assistance to the program,

which is a third party payer covering

patients in the program, or which

is a quality improvement organization

performing a utilization or quality control

review; or

(2) Is determined by the program director

to be qualified to conduct the

audit or evaluation activities.

(b) Copying or removal of records.

Records containing patient identifying

information may be copied or removed

from program premises by any person

who:

(1) Agrees in writing to:

(i) Maintain the patient identifying

information in accordance with the security

requirements provided in § 2.16

of these regulations (or more stringent

requirements);

(ii) Destroy all the patient identifying

information upon completion of

the audit or evaluation; and

(iii) Comply with the limitations on

disclosure and use in paragraph (d) of

this section; and

(2) Performs the audit or evaluation

activity on behalf of:

(i) Any Federal, State, or local governmental

agency which provides financial

assistance to the program or is

authorized by law to regulate its activities;

(ii) Any private person which provides

financial assistance to the program,

which is a third part payer covering

patients in the program, or which

is a quality improvement organization

performing a utilization or quality control

review.

(1) For purposes of Medicare or

Medicaid audit or evaluation under

this section, audit or evaluation includes

a civil or administrative investigation

of the program by any Federal,

State, or local agency responsible

for oversight of the Medicare or Medicaid

program and includes administrative

enforcement, against the program

by the agency, of any remedy authorized

by law to be imposed as a result of

the findings of the investigation.

(2) Consistent with the definition of

program in § 2.11, program includes an

employee of, or provider of medical

services under, the program when the

employee or provider is the subject of a

civil investigation or administrative

remedy, as those terms are used in

paragraph (c)(1) of this section.

(3) If a disclosure to a person is authorized

under this section for a Medicare

or Medicaid audit or evaluation,

including a civil investigation or administrative

remedy, as those terms

are used in paragraph (c)(1) of this section,

then a quality improvement organization

which obtains the information

under paragraph (a) or (b) may disclose

the information to that person but

only for purposes of Medicare or Medicaid

audit or evaluation.

(4) The provisions of this paragraph

do not authorize the agency, the program,

or any other person to disclose

or use patient identifying information

obtained during the audit or evaluation

for any purposes other than those necessary

to complete the Medicare or

Medicaid audit or evaluation activity

as specified in this paragraph.

(d) Limitations on disclosure and use.

Except as provided in paragraph (c) of

this section, patient identifying information

disclosed under this section

may be disclosed only back to the program

from which it was obtained and

used only to carry out an audit or evaluation

purpose or to investigate or

prosecute criminal or other activities,

as authorized by a court order entered

under § 2.66 of these regulations.

Subpart E—Court Orders

Authorizing Disclosure and Use

§ 2.61 Legal effect of order.

(a) Effect. An order of a court of competent

jurisdiction entered under this

subpart is a unique kind of court order.

Its only purpose is to authorize a disclosure

or use of patient information

which would otherwise be prohibited by

42 U.S.C. 290ee–3, 42 U.S.C. 290dd–3 and

these regulations. Such an order does

not compel disclosure. A subpoena or a

similar legal mandate must be issued

in order to compel disclosure. This

mandate may be entered at the same

time as and accompany an authorizing

court order entered under these regulations.

Public Health Service, HHS § 2.64

(b) Examples. (1) A person holding

records subject to these regulations receives

a subpoena for those records: a

response to the subpoena is not permitted

under the regulations unless an

authorizing court order is entered. The

person may not disclose the records in

response to the subpoena unless a court

of competent jurisdiction enters an authorizing

order under these regulations.

(2) An authorizing court order is entered

under these regulations, but the

person authorized does not want to

make the disclosure. If there is no subpoena

or other compulsory process or a

subpoena for the records has expired or

been quashed, that person may refuse

to make the disclosure. Upon the entry

of a valid subpoena or other compulsory

process the person authorized to

disclose must disclose, unless there is a

valid legal defense to the process other

than the confidentiality restrictions of

these regulations.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987]

§ 2.62 Order not applicable to records

disclosed without consent to researchers,

auditors and evaluators.

A court order under these regulations

may not authorize qualified personnel,

who have received patient identifying

information without consent for the

purpose of conducting research, audit

or evaluation, to disclose that information

or use it to conduct any criminal

investigation or prosecution of a patient.

However, a court order under

§ 2.66 may authorize disclosure and use

of records to investigate or prosecute

qualified personnel holding the records.

§ 2.63 Confidential communications.

(a) A court order under these regulations

may authorize disclosure of confidential

communications made by a

patient to a program in the course of

diagnosis, treatment, or referral for

treatment only if:

(1) The disclosure is necessary to protect

against an existing threat to life

or of serious bodily injury, including

circumstances which constitute suspected

child abuse and neglect and

verbal threats against third parties;

(2) The disclosure is necessary in connection

with investigation or prosecution

of an extremely serious crime,

such as one which directly threatens

loss of life or serious bodily injury, including

homicide, rape, kidnapping,

armed robbery, assault with a deadly

weapon, or child abuse and neglect; or

(3) The disclosure is in connection

with litigation or an administrative

proceeding in which the patient offers

testimony or other evidence pertaining

to the content of the confidential communications.

(b) [Reserved]

§ 2.64 Procedures and criteria for orders

authorizing disclosures for

noncriminal purposes.

(a) Application. An order authorizing

the disclosure of patient records for

purposes other than criminal investigation

or prosecution may be applied for

by any person having a legally recognized

interest in the disclosure which

is sought. The application may be filed

separately or as part of a pending civil

action in which it appears that the patient

records are needed to provide evidence.

An application must use a fictitious

name, such as John Doe, to refer

to any patient and may not contain or

otherwise disclose any patient identifying

information unless the patient is

the applicant or has given a written

consent (meeting the requirements of

these regulations) to disclosure or the

court has ordered the record of the proceeding

sealed from public scrunity.

(b) Notice. The patient and the person

holding the records from whom disclosure

is sought must be given:

(1) Adequate notice in a manner

which will not disclose patient identifying

information to other persons; and

(2) An opportunity to file a written

response to the application, or to appear

in person, for the limited purpose

of providing evidence on the statutory

and regulatory criteria for the issuance

of the court order.

hearing. Any oral argument, review of

evidence, or hearing on the application

must be held in the judge’s chambers

or in some manner which ensures that

patient identifying information is not

disclosed to anyone other than a party

to the proceeding, the patient, or the

person holding the record, unless the

patient requests an open hearing in a§ 2.65 42 CFR Ch. I (10–1–10 Edition)

manner which meets the written consent

requirements of these regulations.

The proceeding may include an examination

by the judge of the patient

records referred to in the application.

(d) Criteria for entry of order. An order

under this section may be entered only

if the court determines that good cause

exists. To make this determination the

court must find that:

(1) Other ways of obtaining the information

are not available or would not

be effective; and

(2) The public interest and need for

the disclosure outweigh the potential

injury to the patient, the physician-patient

relationship and the treatment

services.

(e) Content of order. An order authorizing

a disclosure must:

(1) Limit disclosure to those parts of

the patient’s record which are essential

to fulfill the objective of the order;

(2) Limit disclosure to those persons

whose need for information is the basis

for the order; and

(3) Include such other measures as

are necessary to limit disclosure for

the protection of the patient, the physician-

patient relationship and the

treatment services; for example, sealing

from public scrutiny the record of

any proceeding for which disclosure of

a patient’s record has been ordered.

§ 2.65 Procedures and criteria for orders

authorizing disclosure and use

of records to criminally investigate

or prosecute patients.

(a) Application. An order authorizing

the disclosure or use of patient records

to criminally investigate or prosecute

a patient may be applied for by the person

holding the records or by any person

conducting investigative or prosecutorial

activities with respect to the

enforcement of criminal laws. The application

may be filed separately, as

part of an application for a subpoena or

other compulsory process, or in a pending

criminal action. An application

must use a fictitious name such as

John Doe, to refer to any patient and

may not contain or otherwise disclose

patient identifying information unless

the court has ordered the record of the

proceeding sealed from public scrutiny.

(b) Notice and hearing. Unless an

order under § 2.66 is sought with an

order under this section, the person

holding the records must be given:

(1) Adequate notice (in a manner

which will not disclose patient identifying

information to third parties) of

an application by a person performing

a law enforcement function;

(2) An opportunity to appear and be

heard for the limited purpose of providing

evidence on the statutory and

regulatory criteria for the issuance of

the court order; and

(3) An opportunity to be represented

by counsel independent of counsel for

an applicant who is a person performing

a law enforcement function.

hearings. Any oral argument, review of

evidence, or hearing on the application

shall be held in the judge’s chambers or

in some other manner which ensures

that patient identifying information is

not disclosed to anyone other than a

party to the proceedings, the patient,

or the person holding the records. The

proceeding may include an examination

by the judge of the patient records

referred to in the application.

(d) Criteria. A court may authorize

the disclosure and use of patient

records for the purpose of conducting a

criminal investigation or prosecution

of a patient only if the court finds that

all of the following criteria are met:

(1) The crime involved is extremely

serious, such as one which causes or directly

threatens loss of life or serious

bodily injury including homicide, rape,

kidnapping, armed robbery, assault

with a deadly weapon, and child abuse

and neglect.

(2) There is a reasonable likelihood

that the records will disclose information

of substantial value in the investigation

or prosecution.

(3) Other ways of obtaining the information

are not available or would not

be effective.

(4) The potential injury to the patient,

to the physician-patient relationship

and to the ability of the program

to provide services to other patients

is outweighed by the public interest

and the need for the disclosure.

(5) If the applicant is a person performing

a law enforcement function

that:

(i) The person holding the records has

been afforded the opportunity to bePublic Health Service, HHS § 2.67

represented by independent counsel;

and

(ii) Any person holding the records

which is an entity within Federal,

State, or local government has in fact

been represented by counsel independent

of the applicant.

(e) Content of order. Any order authorizing

a disclosure or use of patient

records under this section must:

(1) Limit disclosure and use to those

parts of the patient’s record which are

essential to fulfill the objective of the

order;

(2) Limit disclosure to those law enforcement

and prosecutorial officials

who are responsible for, or are conducting,

the investigation or prosecution,

and limit their use of the records

to investigation and prosecution of extremely

serious crime or suspected

crime specified in the application; and

(3) Include such other measures as

are necessary to limit disclosure and

use to the fulfillment of only that public

interest and need found by the

court.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987]

§ 2.66 Procedures and criteria for orders

authorizing disclosure and use

of records to investigate or prosecute

a program or the person holding

the records.

(a) Application. (1) An order authorizing

the disclosure or use of patient

records to criminally or administratively

investigate or prosecute a program

or the person holding the records

(or employees or agents of that program

or person) may be applied for by

any administrative, regulatory, supervisory,

investigative, law enforcement,

or prosecutorial agency having jurisdiction

over the program’s or person’s

activities.

(2) The application may be filed separately

or as part of a pending civil or

criminal action against a program or

the person holding the records (or

agents or employees of the program or

person) in which it appears that the patient

records are needed to provide material

evidence. The application must

use a fictitious name, such as John

Doe, to refer to any patient and may

not contain or otherwise disclose any

patient identifying information unless

the court has ordered the record of the

proceeding sealed from public scrutiny

or the patient has given a written consent

(meeting the requirements of § 2.31

of these regulations) to that disclosure.

(b) Notice not required. An application

under this section may, in the discretion

of the court, be granted without

notice. Although no express notice is

required to the program, to the person

holding the records, or to any patient

whose records are to be disclosed, upon

implementation of an order so granted

any of the above persons must be afforded

an opportunity to seek revocation

or amendment of that order, limited

to the presentation of evidence on

the statutory and regulatory criteria

for the issuance of the court order.

under this section must be entered in

accordance with, and comply with the

requirements of, paragraphs (d) and (e)

of § 2.64 of these regulations.

(d) Limitations on disclosure and use of

patient identifying information: (1) An

order entered under this section must

require the deletion of patient identifying

information from any documents

made available to the public.

(2) No information obtained under

this section may be used to conduct

any investigation or prosecution of a

patient, or be used as the basis for an

application for an order under § 2.65 of

these regulations.

§ 2.67 Orders authorizing the use of

undercover agents and informants

to criminally investigate employees

or agents of a program.

(a) Application. A court order authorizing

the placement of an undercover

agent or informant in a program as an

employee or patient may be applied for

by any law enforcement or prosecutorial

agency which has reason to believe

that employees or agents of the

program are engaged in criminal misconduct.

(b) Notice. The program director must

be given adequate notice of the application

and an opportunity to appear

and be heard (for the limited purpose of

providing evidence on the statutory

and regulatory criteria for the issuance

of the court order), unless the application

asserts a belief that: Pt. 2a 42 CFR Ch. I (10–1–10 Edition)

(1) The program director is involved

in the criminal activities to be investigated

by the undercover agent or informant;

(2) The program director will intentionally

or unintentionally disclose the

proposed placement of an undercover

agent or informant to the employees or

agents who are suspected of criminal

activities.

may be entered only if the court

determines that good cause exists. To

make this determination the court

must find:

(1) There is reason to believe that an

employee or agent of the program is

engaged in criminal activity;

(2) Other ways of obtaining evidence

of this criminal activity are not available

or would not be effective; and

(3) The public interest and need for

the placement of an undercover agent

or informant in the program outweigh

the potential injury to patients of the

program, physician-patient relationships

and the treatment services.

(d) Content of order. An order authorizing

the placement of an undercover

agent or informant in a program must:

(1) Specifically authorize the placement

of an undercover agent or an informant;

(2) Limit the total period of the

placement to six months;

(3) Prohibit the undercover agent or

informant from disclosing any patient

identifying information obtained from

the placement except as necessary to

criminally investigate or prosecute

employees or agents of the program;

and

(4) Include any other measures which

are appropriate to limit any potential

disruption of the program by the placement

and any potential for a real or

apparent breach of patient confidentiality;

for example, sealing from public

scrutiny the record of any proceeding

for which disclosure of a patient’s

record has been ordered.

(e) Limitation on use of information. No

information obtained by an undercover

agent or informant placed under this

section may be used to criminally investigate

or prosecute any patient or

as the basis for an application for an

order under § 2.65 of these regulations.

PART 2a—PROTECTION OF

IDENTITY—RESEARCH SUBJECTS

Sec.

2a.1 Applicability.

2a.2 Definitions.

2a.3 Application; coordination.

2a.4 Contents of application; in general.

2a.5 Contents of application; research

projects in which drugs will be administered.

2a.6 Issuance of Confidentiality Certificates;

single project limitation.

2a.7 Effect of Confidentiality Certificate.

2a.8 Termination.

AUTHORITY: Sec. 3(a), Pub. L. 91–513 as

amended by sec. 122(b), Pub. L. 93–282; 84

Stat. 1241 (42 U.S.C. 242a(a)), as amended by

88 Stat. 132.

SOURCE: 44 FR 20384, Apr. 4, 1979, unless

otherwise noted.

§ 2a.1 Applicability.

(a) Section 303(a) of the Public

Health Service Act (42 U.S.C. 242a(a))

provides that ‘‘[t]he Secretary [of

Health and Human Services] may authorize

persons engaged in research on

mental health, including research on

the use and effect of alcohol and other

psychoactive drugs, to protect the privacy

of individuals who are the subject

of such research by withholding from

all persons not connected with the conduct

of such research the names or

other identifying characteristics of

such individuals. Persons so authorized

to protect the privacy of such individuals

may not be compelled in any Federal,

State, or local civil, criminal, administrative,

legislative, or other proceedings

to identify such individuals.’’

The regulations in this part establish

procedures under which any person engaged

in research on mental health including

research on the use and effect

of alcohol and other psychoactive

drugs (whether or not the research is

federally funded) may, subject to the

exceptions set forth in paragraph (b) of

this section, apply for such an authorization

of confidentiality.

(b) These regulations do not apply to:

(1) Authorizations of confidentiality

for research requiring an Investigational

New Drug exemption under section

505(i) of the Federal Food, Drug,

and Cosmetic Act (21 U.S.C. 355(i)) or to

approved new drugs, such as methadone,

requiring continuation of long-

NA Meetings & AA Meetings Queens NY

HIPAA Policy

REGO PARK COUNSELING, LLC

HIPAA POLICIES