42 U.S.C. 290dd-2.
Title 42, United States Code, Section 290dd-2(g) authorizes the Secretary to prescribe regulations. Such regulations may contain such definitions, and may provide for such safeguards and procedures, including procedures and criteria for the issuance and scope of orders, as in the judgment of the Secretary are necessary or proper to effectuate the purposes of this statute, to prevent circumvention or evasion thereof, or to facilitate compliance therewith.
(a)
(1) Subpart B of this part: General Provisions, including definitions, applicability, and general restrictions;
(2) Subpart C of this part: Disclosures with Patient Consent, including disclosures which require patient consent and the consent form requirements;
(3) Subpart D of this part: Disclosures without Patient Consent, including disclosures which do not require patient consent or an authorizing court order; and
(4) Subpart E of this part: Court Orders Authorizing Disclosure and Use, including disclosures and uses of patient records which may be made with an authorizing court order and the procedures and criteria for the entry and scope of those orders.
(b)
(2) The regulations in this part are not intended to direct the manner in which substantive functions such as research, treatment, and evaluation are carried out. They are intended to ensure that a patient receiving treatment for a substance use disorder in a part 2 program is not made more vulnerable by reason of the availability of their patient record than an individual with a substance use disorder who does not seek treatment.
(3) Because there is a criminal penalty for violating the regulations, they are to be construed strictly in favor of the potential violator in the same manner as a criminal statute (see
Under 42 U.S.C. 290dd-2(f), any person who violates any provision of this section or any regulation issued pursuant to this section shall be fined in accordance with Title 18 of the U.S. Code.
(a) The report of any violation of the regulations in this part may be directed to the United States Attorney for the judicial district in which the violation occurs.
(b) The report of any violation of the regulations in this part by an opioid treatment program may be directed to the United States Attorney for the judicial district in which the violation occurs as well as to the Substance Abuse and Mental Health Services Administration (SAMHSA) office responsible for opioid treatment program oversight.
For purposes of the regulations in this part:
(1) Who is a patient or employee of a part 2 program or who becomes a patient or employee of a part 2 program at the request of a law enforcement agency or official; and
(2) Who at the request of a law enforcement agency or official observes one or more patients or employees of the part 2 program for the purpose of reporting the information obtained to the law enforcement agency or official.
(1) In the case of a part 2 program that is an individual, that individual.
(2) In the case of a part 2 program that is an entity, the individual designated as director or managing director, or individual otherwise vested with authority to act as chief executive officer of the part 2 program.
(1) An individual or entity (other than a general medical facility) who holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
(2) An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
(3) Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.
(1) Provides services to a part 2 program, such as data processing, bill collecting, dosage preparation, laboratory analyses, or legal, accounting, population health management, medical staffing, or other professional services, or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy, and
(2) Has entered into a written agreement with a part 2 program under which that individual or entity:
(i) Acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records from the part 2 program, it is fully bound by the regulations in this part; and
(ii) If necessary, will resist in judicial proceedings any efforts to obtain access to patient identifying information related to substance use disorder diagnosis, treatment, or referral for treatment except as permitted by the regulations in this part.
(1) A patient is, agrees to, or is legally required to be diagnosed, evaluated, and/or treated, or agrees to accept consultation, for any condition by an individual or entity, and;
(2) The individual or entity undertakes or agrees to undertake diagnosis, evaluation, and/or treatment of the patient, or consultation with the patient, for any condition.
(a)
(i) Would identify a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person; and
(ii) Is drug abuse information obtained by a federally assisted drug abuse program after March 20, 1972 (part 2 program), or is alcohol abuse information obtained by a federally assisted alcohol abuse program after May 13, 1974 (part 2 program); or if obtained before the pertinent date, is maintained by a part 2 program after that date as part of an ongoing treatment episode which extends past that date; for the purpose of treating a substance use disorder, making a diagnosis for that treatment, or making a referral for that treatment.
(2)
(b)
(1) It is conducted in whole or in part, whether directly or by contract or otherwise by any department or agency of the United States (but see paragraphs (c)(1) and (2) of this section relating to the Department of Veterans Affairs and the Armed Forces);
(2) It is being carried out under a license, certification, registration, or
(i) Participating provider in the Medicare program;
(ii) Authorization to conduct maintenance treatment or withdrawal management; or
(iii) Registration to dispense a substance under the Controlled Substances Act to the extent the controlled substance is used in the treatment of substance use disorders;
(3) It is supported by funds provided by any department or agency of the United States by being:
(i) A recipient of federal financial assistance in any form, including financial assistance which does not directly pay for the substance use disorder diagnosis, treatment, or referral for treatment; or
(ii) Conducted by a state or local government unit which, through general or special revenue sharing or other forms of assistance, receives federal funds which could be (but are not necessarily) spent for the substance use disorder program; or
(4) It is assisted by the Internal Revenue Service of the Department of the Treasury through the allowance of income tax deductions for contributions to the program or through the granting of tax exempt status to the program.
(c)
(2)
(i) Any interchange of that information within the Armed Forces; and
(ii) Any interchange of that information between the Armed Forces and those components of the Department of Veterans Affairs furnishing health care to veterans.
(3)
(i) Within a part 2 program; or
(ii) Between a part 2 program and an entity that has direct administrative control over the program.
(4)
(5)
(i) Are directly related to a patient's commission of a crime on the premises of the part 2 program or against part 2 program personnel or to a threat to commit such a crime; and
(ii) Are limited to the circumstances of the incident, including the patient status of the individual committing or threatening to commit the crime, that individual's name and address, and that individual's last known whereabouts.
(6)
(d)
(2)
(A) Third-party payers with regard to records disclosed to them by part 2 programs or under § 2.31(a)(4)(iii)(A);
(B) Entities having direct administrative control over part 2 programs with regard to information that is subject to the regulations in this part communicated to them by the part 2 program under paragraph (c)(3) of this section; and
(C) Individuals or entities who receive patient records directly from a part 2 program or other lawful holder of patient identifying information and who are notified of the prohibition on re-disclosure in accordance with § 2.32.
(ii) [Reserved]
(e)
(2)
(3)
(4)
(i) Diagnosis which is made solely for the purpose of providing evidence for use by law enforcement agencies or officials; or
(ii) A diagnosis of drug overdose or alcohol intoxication which clearly shows that the individual involved does not have a substance use disorder (
(a)
(b)
(c)
(2) Any answer to a request for a disclosure of patient records which is not permissible under the regulations in this part must be made in a way that will not affirmatively reveal that an identified individual has been, or is being, diagnosed or treated for a substance use disorder. An inquiring party may be provided a copy of the regulations in this part and advised that they restrict the disclosure of substance use disorder patient records, but may not be told affirmatively that the regulations restrict the disclosure of the records of an identified patient.
(d)
(1) Under this paragraph (d), patient requests:
(i) Must be made in writing; and
(ii) Are limited to disclosures made within the past two years;
(2) Under this paragraph (d), the entity named on the consent form that discloses information pursuant to a patient's general designation (the entity that serves as an intermediary, as described in § 2.31(a)(4)(iii)(B)) must:
(i) Respond in 30 or fewer days of receipt of the written request; and
(ii) Provide, for each disclosure, the name(s) of the entity(-ies) to which the disclosure was made, the date of the disclosure, and a brief description of
(3) The part 2 program is not responsible for compliance with this paragraph (d); the entity that serves as an intermediary, as described in § 2.31(a)(4)(iii)(B), is responsible for compliance with the list of disclosures requirement.
(a)
(b)
(2) Where state law requires parental consent to treatment, the fact of a minor's application for treatment may be communicated to the minor's parent, guardian, or other individual authorized under state law to act in the minor's behalf only if:
(i) The minor has given written consent to the disclosure in accordance with subpart C of this part; or
(ii) The minor lacks the capacity to make a rational choice regarding such consent as judged by the part 2 program director under paragraph (c) of this section.
(c)
(1) A minor applicant for services lacks capacity because of extreme youthor mental or physical condition to make a rational decision on whether to consent to a disclosure under subpart C of this part to their parent, guardian, or other individual authorized under state law to act in the minor's behalf; and
(2) The minor applicant's situation poses a substantial threat to the life or physical well-being of the minor applicant or any other individual which may be reduced by communicating relevant facts to the minor's parent, guardian, or other individual authorized under state law to act in the minor's behalf.
(a)
(2)
(b)
(2)
(a) The part 2 program or other lawful holder of patient identifying information must have in place formal policies and procedures to reasonably protect against unauthorized uses and disclosures of patient identifying information and to protect against reasonably anticipated threats or hazards to the security of patient identifying information. These formal policies and procedures must address:
(1) Paper records, including:
(i) Transferring and removing such records;
(ii) Destroying such records, including sanitizing the hard copy media associated with the paper printouts, to render the patient identifying information non-retrievable;
(iii) Maintaining such records in a secure room, locked file cabinet, safe, or other similar container, or storage facility when not in use;
(iv) Using and accessing workstations, secure rooms, locked file cabinets, safes, or other similar containers, and storage facilities that use or store such information; and
(v) Rendering patient identifying information non-identifiable in a manner that creates a very low risk of re-identification (
(2) Electronic records, including:
(i) Creating, receiving, maintaining, and transmitting such records;
(ii) Destroying such records, including sanitizing the electronic media on which such records are stored, to render the patient identifying information non-retrievable;
(iii) Using and accessing electronic records or other electronic media containing patient identifying information; and
(iv) Rendering the patient identifying information non-identifiable in a manner that creates a very low risk of re-identification (
(b) [Reserved]
(a)
(b)
No person may require any patient to carry in their immediate possession while away from the part 2 program premises any card or other object which would identify the patient as having a substance use disorder. This section does not prohibit a person from requiring patients to use or carry cards or other identification objects on the premises of a part 2 program.
(a)
(1) The patient who is the subject of the records gives written consent (meeting the requirements of § 2.31) to a transfer of the records to the acquiring program or to any other program designated in the consent (the manner of obtaining this consent must minimize the likelihood of a disclosure of patient identifying information to a third party); or
(2) There is a legal requirement that the records be kept for a period specified by law which does not expire until after the discontinuation or acquisition of the part 2 program.
(b)
(1) Records, which are paper, must be:
(i) Sealed in envelopes or other containers labeled as follows: “Records of [insert name of program] required to be maintained under [insert citation to statute, regulation, court order or other legal authority requiring that records be kept] until a date not later than [insert appropriate date]”;
(A) All hard copy media from which the paper records were produced, such as printer and facsimile ribbons, drums, etc., must be sanitized to render the data non-retrievable; and
(B) [Reserved]
(ii) Held under the restrictions of the regulations in this part by a responsible person who must, as soon as practicable after the end of the required retention period specified on the label, destroy the records and sanitize any associated hard copy media to render the patient identifying information non-retrievable in a manner consistent with the discontinued program's or acquiring program's policies and procedures established under § 2.16.
(2) Records, which are electronic, must be:
(i) Transferred to a portable electronic device with implemented encryption to encrypt the data at rest so that there is a low probability of assigning meaning without the use of a confidential process or key and implemented access controls for the confidential process or key; or
(ii) Transferred, along with a backup copy, to separate electronic media, so that both the records and the backup copy have implemented encryption to encrypt the data at rest so that there is a low probability of assigning meaning without the use of a confidential process or key and implemented access controls for the confidential process or key; and
(iii) Within one year of the discontinuation or acquisition of the program, all electronic media on which the patient records or patient identifying information resided prior to being transferred to the device specified in (i) above or the original and backup electronic media specified in (ii) above, including email and other electronic communications, must be sanitized to render the patient identifying information non-retrievable in a manner consistent with the discontinued program's or acquiring program's policies and procedures established under § 2.16; and
(iv) The portable electronic device or the original and backup electronic media must be:
(A) Sealed in a container along with any equipment needed to read or access the information, and labeled as follows: “Records of [insert name of program] required to be maintained under [insert citation to statute, regulation, court order or other legal authority requiring that records be kept] until a date not later than [insert appropriate date];” and
(B) Held under the restrictions of the regulations in this part by a responsible person who must store the container in a manner that will protect the information (
(v) The responsible person must be included on the access control list and be provided a means for decrypting the data. The responsible person must store the decryption tools on a device or at a location separate from the data they are used to encrypt or decrypt; and
(vi) As soon as practicable after the end of the required retention period specified on the label, the portable electronic device or the original and backup electronic media must be sanitized to render the patient identifying information non-retrievable consistent with the policies established under § 2.16.
The statute authorizing the regulations in this part (42 U.S.C. 290dd-2) does not preempt the field of law which they cover to the exclusion of all state laws in that field. If a disclosure permitted under the regulations in this part is prohibited under state law, neither the regulations in this part nor the authorizing statute may be construed to authorize any violation of that state law. However, no state law may either authorize or compel any disclosure prohibited by the regulations in this part.
(a)
(b)
(a)
(1) Communicate to the patient that federal law and regulations protect the confidentiality of substance use disorder patient records; and
(2) Give to the patient a summary in writing of the federal law and regulations.
(b)
(1) A general description of the limited circumstances under which a part 2 program may acknowledge that an individual is present or disclose outside the part 2 program information identifying a patient as having or having had a substance use disorder;
(2) A statement that violation of the federal law and regulations by a part 2 program is a crime and that suspected violations may be reported to appropriate authorities consistent with § 2.4, along with contact information;
(3) A statement that information related to a patient's commission of a crime on the premises of the part 2 program or against personnel of the part 2 program is not protected;
(4) A statement that reports of suspected child abuse and neglect made under state law to appropriate state or local authorities are not protected; and
(5) A citation to the federal law and regulations.
(c)
(a)
(b)
(a)
(1) The name of the patient.
(2) The specific name(s) or general designation(s) of the part 2 program(s), entity(ies), or individual(s) permitted to make the disclosure.
(3) How much and what kind of information is to be disclosed, including an explicit description of the substance use disorder information that may be disclosed.
(4)(i) The name(s) of the individual(s) to whom a disclosure is to be made; or
(ii)
(iii)
(A) If the recipient entity does not have a treating provider relationship with the patient whose information is being disclosed and is a third-party payer, the name of the entity; or
(B) If the recipient entity does not have a treating provider relationship with the patient whose information is being disclosed and is not covered by paragraph (a)(4)(iii)(A) of this section, such as an entity that facilitates the exchange of health information or a research institution, the name(s) of the entity(-ies); and
(
(
(
(
(
(5) The purpose of the disclosure. In accordance with § 2.13(a), the disclosure must be limited to that information which is necessary to carry out the stated purpose.
(6) A statement that the consent is subject to revocation at any time except to the extent that the part 2 program or other lawful holder of patient identifying information that is permitted to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third-party payer
(7) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is provided.
(8) The signature of the patient and, when required for a patient who is a minor, the signature of an individual authorized to give consent under § 2.14; or, when required for a patient who is incompetent or deceased, the signature of an individual authorized to sign under § 2.15. Electronic signatures are permitted to the extent that they are not prohibited by any applicable law.
(9) The date on which the consent is signed.
(b)
(1) Has expired;
(2) On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section;
(3) Is known to have been revoked; or
(4) Is known, or through reasonable diligence could be known, by the individual or entity holding the records to be materially false.
(a)
(b) [Reserved]
If a patient consents to a disclosure of their records under § 2.31, a program may disclose those records in accordance with that consent to any person identified in the consent, except that disclosures to central registries and in connection with criminal justice referrals must meet the requirements of §§ 2.34 and 2.35, respectively.
(a)
(1) The disclosure is made when:
(i) The patient is accepted for treatment;
(ii) The type or dosage of the drug is changed; or
(iii) The treatment is interrupted, resumed or terminated.
(2) The disclosure is limited to:
(i) Patient identifying information;
(ii) Type and dosage of the drug; and
(iii) Relevant dates.
(3) The disclosure is made with the patient's written consent meeting the requirements of § 2.31, except that:
(i) The consent must list the name and address of each central registry and each known withdrawal management or maintenance treatment program to which a disclosure will be made; and
(ii) The consent may authorize a disclosure to any withdrawal management or maintenance treatment program established within 200 miles of the program, but does not need to individually name all programs.
(b)
(c)
(1) The name, address, and telephone number of the member program(s) in which the patient is already enrolled to the inquiring member program; and
(2) The name, address, and telephone number of the inquiring member program to the member program(s) in which the patient is already enrolled. The member programs may communicate as necessary to verify that no error has been made and to prevent or eliminate any multiple enrollments.
(d)
(a) A part 2 program may disclose information about a patient to those individuals within the criminal justice system who have made participation in the part 2 program a condition of the disposition of any criminal proceedings against the patient or of the patient's parole or other release from custody if:
(1) The disclosure is made only to those individuals within the criminal justice system who have a need for the information in connection with their duty to monitor the patient's progress (
(2) The patient has signed a written consent meeting the requirements of § 2.31 (except paragraph (a)(8) which is inconsistent with the revocation provisions of paragraph (c) of this section) and the requirements of paragraphs (b) and (c) of this section.
(b)
(1) The anticipated length of the treatment;
(2) The type of criminal proceeding involved, the need for the information in connection with the final disposition of that proceeding, and when the final disposition will occur; and
(3) Such other factors as the part 2 program, the patient, and the individual(s) within the criminal justice system who will receive the disclosure consider pertinent.
(c)
(d)
(a)
(b)
(c)
(1) The name of the medical personnel to whom disclosure was made and their affiliation with any health care facility;
(2) The name of the individual making the disclosure;
(3) The date and time of the disclosure; and
(4) The nature of the emergency (or error, if the report was to FDA).
(a) Notwithstanding other provisions of this part, including paragraph (b)(2) of this section, patient identifying information may be disclosed by the part 2 program or other lawful holder of part 2 data, for the purpose of conducting scientific research if the individual designated as director or managing director, or individual otherwise vested with authority to act as chief executive officer or their designee makes a determination that the recipient of the patient identifying information:
(1) If a HIPAA-covered entity or business associate, has obtained and documented authorization from the patient, or a waiver or alteration of authorization, consistent with the HIPAA Privacy Rule at 45 CFR 164.508 or 164.512(i), as applicable; or
(2) If subject to the HHS regulations regarding the protection of human subjects (45 CFR part 46), either provides documentation that the researcher is in compliance with the requirements of the HHS regulations, including the requirements related to informed consent or a waiver of consent (45 CFR 46.111 and 46.116) or that the research qualifies for exemption under the HHS regulations (45 CFR 46.101(b) and any successor regulations; or
(3) If both a HIPAA covered entity or business associate and subject to the HHS regulations regarding the protection of human subjects, has met the requirements of paragraphs (a)(1) and (2) of this section; and
(4) If neither a HIPAA covered entity or business associate or subject to the HHS regulations regarding the protection of human subjects, this section does not apply.
(b) Any individual or entity conducting scientific research using patient identifying information obtained under paragraph (a) of this section:
(1) Is fully bound by the regulations in this part and, if necessary, will resist in judicial proceedings any efforts to obtain access to patient records except as permitted by the regulations in this part.
(2) Must not re-disclose patient identifying information except back to the individual or entity from whom that patient identifying information was obtained or as permitted under paragraph (c) of this section.
(3) May include part 2 data in research reports only in aggregate form in which patient identifying information has been rendered non-identifiable such that the information cannot be re-identified and serve as an unauthorized means to identify a patient, directly or indirectly, as having or having had a substance use disorder.
(4) Must maintain and destroy patient identifying information in accordance with the security policies and procedures established under § 2.16.
(5) Must retain records in compliance with applicable federal, state, and local record retention laws.
(c)
(i) Have the request reviewed and approved by an Institutional Review Board (IRB) registered with the Department of Health and Human Services, Office for Human Research Protections in accordance with 45 CFR part 46 to ensure that patient privacy
(ii) Ensure that patient identifying information obtained under paragraph (a) of this section is not provided to law enforcement agencies or officials.
(2)
(i) After providing the researcher with the linked data, destroy or delete the linked data from its records, including sanitizing any associated hard copy or electronic media, to render the patient identifying information non-retrievable in a manner consistent with the policies and procedures established under § 2.16 Security for records.
(ii) Ensure that patient identifying information obtained under paragraph (a) of this section is not provided to law enforcement agencies or officials.
(2) Except as provided in paragraph (c) of this section, a researcher may not redisclose patient identifying information for data linkages purposes.
(a)
(1) Performs the audit or evaluation on behalf of:
(i) Any federal, state, or local government agency which provides financial assistance to the part 2 program or is authorized by law to regulate its activities; or
(ii) Any individual or entity who provides financial assistance to the part 2 program, which is a third-party payer covering patients in the part 2 program, or which is a quality improvement organization performing a utilization or quality control review; or
(2) Is determined by the part 2 program to be qualified to conduct an audit or evaluation of the part 2 program.
(b)
(1) Agrees in writing to:
(i) Maintain and destroy the patient identifying information in a manner consistent with the policies and procedures established under § 2.16;
(ii) Retain records in compliance with applicable federal, state, and local record retention laws; and
(iii) Comply with the limitations on disclosure and use in paragraph (d) of this section; and
(2) Performs the audit or evaluation on behalf of:
(i) Any federal, state, or local government agency which provides financial assistance to the part 2 program or is authorized by law to regulate its activities; or
(ii) Any individual or entity who provides financial assistance to the part 2 program, which is a third-party payer covering patients in the part 2 program, or which is a quality improvement organization performing a utilization or quality control review.
(c)
(i) Maintain and destroy the patient identifying information in a manner consistent with the policies and procedures established under § 2.16;
(ii) Retain records in compliance with applicable federal, state, and local record retention laws; and
(iii) Comply with the limitations on disclosure and use in paragraph (d) of this section.
(2) A Medicare, Medicaid, or CHIP audit or evaluation under this section includes a civil or administrative investigation of a part 2 program by any federal, state, or local government agency with oversight responsibilities for Medicare, Medicaid, or CHIP and includes administrative enforcement, against the part 2 program by the government agency, of any remedy authorized by law to be imposed as a result of the findings of the investigation.
(3) An audit or evaluation necessary to meet the requirements for a CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE) must be conducted in accordance with the following:
(i) A CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE) must:
(A) Have in place administrative and/or clinical systems; and
(B) Have in place a leadership and management structure, including a governing body and chief executive officer with responsibility for oversight of the organization's management and for ensuring compliance with and adherence to the terms and conditions of the Participation Agreement or similar documentation with CMS; and
(ii) A CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE) must have a signed Participation Agreement or similar documentation with CMS, which provides that the CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE):
(A) Is subject to periodic evaluations by CMS or its agents, or is required by CMS to evaluate participants in the CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE) relative to CMS-defined or approved quality and/or cost measures;
(B) Must designate an executive who has the authority to legally bind the organization to ensure compliance with 42 U.S.C. 290dd-2 and this part and the terms and conditions of the Participation Agreement in order to receive patient identifying information from CMS or its agents;
(C) Agrees to comply with all applicable provisions of 42 U.S.C. 290dd-2 and this part;
(D) Must ensure that any audit or evaluation involving patient identifying information occurs in a confidential and controlled setting approved by the designated executive;
(E) Must ensure that any communications or reports or other documents resulting from an audit or evaluation under this section do not allow for the direct or indirect identification (
(F) Must establish policies and procedures to protect the confidentiality of the patient identifying information consistent with this part, the terms and conditions of the Participation Agreement, and the requirements set forth in paragraph (c)(1) of this section.
(4) Program, as defined in § 2.11, includes an employee of, or provider of medical services under the program when the employee or provider is the subject of a civil investigation or administrative remedy, as those terms are used in paragraph (c)(2) of this section.
(5) If a disclosure to an individual or entity is authorized under this section for a Medicare, Medicaid, or CHIP audit or evaluation, including a civil investigation or administrative remedy, as those terms are used in paragraph (c)(2) of this section, then a quality improvement organization which obtains the information under paragraph (a) or (b) of this section may disclose the information to that individual or entity but only for the purpose of conducting a Medicare, Medicaid, or CHIP audit or evaluation.
(6) The provisions of this paragraph do not authorize the part 2 program, the federal, state, or local government agency, or any other individual or entity to disclose or use patient identifying information obtained during the audit
(d)
(a)
(b)
(2) An authorizing court order is entered under the regulations in this part, but the person holding the records does not want to make the disclosure. If there is no subpoena or other compulsory process or a subpoena for the records has expired or been quashed, that person may refuse to make the disclosure. Upon the entry of a valid subpoena or other compulsory process the person holding the records must disclose, unless there is a valid legal defense to the process other than the confidentiality restrictions of the regulations in this part.
A court order under the regulations in this part may not authorize qualified personnel, who have received patient identifying information without consent for the purpose of conducting research, audit or evaluation, to disclose that information or use it to conduct any criminal investigation or prosecution of a patient. However, a court order under § 2.66 may authorize disclosure and use of records to investigate or prosecute qualified personnel holding the records.
(a) A court order under the regulations in this part may authorize disclosure of confidential communications made by a patient to a part 2 program in the course of diagnosis, treatment, or referral for treatment only if:
(1) The disclosure is necessary to protect against an existing threat to life or of serious bodily injury, including circumstances which constitute suspected child abuse and neglect and verbal threats against third parties;
(2) The disclosure is necessary in connection with investigation or prosecution of an extremely serious crime allegedly committed by the patient, such as one which directly threatens loss of life or serious bodily injury, including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, or child abuse and neglect; or
(3) The disclosure is in connection with litigation or an administrative proceeding in which the patient offers testimony or other evidence pertaining to the content of the confidential communications.
(b) [Reserved]
(a)
(b)
(1) Adequate notice in a manner which does not disclose patient identifying information to other persons; and
(2) An opportunity to file a written response to the application, or to appear in person, for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order as described in
(c)
(d)
(1) Other ways of obtaining the information are not available or would not be effective; and
(2) The public interest and need for the disclosure outweigh the potential injury to the patient, the physician-patient relationship and the treatment services.
(e)
(1) Limit disclosure to those parts of the patient's record which are essential to fulfill the objective of the order;
(2) Limit disclosure to those persons whose need for information is the basis for the order; and
(3) Include such other measures as are necessary to limit disclosure for the protection of the patient, the physician-patient relationship and the treatment services; for example, sealing from public scrutiny the record of any proceeding for which disclosure of a patient's record has been ordered.
(a)
(b)
(1) Adequate notice (in a manner which will not disclose patient identifying information to other persons) of an application by a law enforcement agency or official;
(2) An opportunity to appear and be heard for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order as described in § 2.65(d); and
(3) An opportunity to be represented by counsel independent of counsel for an applicant who is a law enforcement agency or official.
(c)
(d)
(1) The crime involved is extremely serious, such as one which causes or directly threatens loss of life or serious bodily injury including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, and child abuse and neglect.
(2) There is a reasonable likelihood that the records will disclose information of substantial value in the investigation or prosecution.
(3) Other ways of obtaining the information are not available or would not be effective.
(4) The potential injury to the patient, to the physician-patient relationship and to the ability of the part 2 program to provide services to other patients is outweighed by the public interest and the need for the disclosure.
(5) If the applicant is a law enforcement agency or official, that:
(i) The person holding the records has been afforded the opportunity to be represented by independent counsel; and
(ii) Any person holding the records which is an entity within federal, state, or local government has in fact been represented by counsel independent of the applicant.
(e)
(1) Limit disclosure and use to those parts of the patient's record which are essential to fulfill the objective of the order;
(2) Limit disclosure to those law enforcement and prosecutorial officials who are responsible for, or are conducting, the investigation or prosecution, and limit their use of the records to investigation and prosecution of the extremely serious crime or suspected crime specified in the application; and
(3) Include such other measures as are necessary to limit disclosure and use to the fulfillment of only that public interest and need found by the court.
(a)
(2) The application may be filed separately or as part of a pending civil or criminal action against a part 2 program or the person holding the records (or agents or employees of the part 2 program or person holding the records) in which the applicant asserts that the patient records are needed to provide material evidence. The application must use a fictitious name, such as John Doe, to refer to any patient and may not contain or otherwise disclose any patient identifying information unless the court has ordered the record of the proceeding sealed from public scrutiny or the patient has provided written consent (meeting the requirements of § 2.31) to that disclosure.
(b)
(c)
(d)
(2) No information obtained under this section may be used to conduct any investigation or prosecution of a patient in connection with a criminal matter, or be used as the basis for an application for an order under § 2.65.
(a)
(b)
(1) The part 2 program director is involved in the suspected criminal activities to be investigated by the undercover agent or informant; or
(2) The part 2 program director will intentionally or unintentionally disclose the proposed placement of an undercover agent or informant to the employees or agents of the program who are suspected of criminal activities.
(c)
(1) There is reason to believe that an employee or agent of the part 2 program is engaged in criminal activity;
(2) Other ways of obtaining evidence of the suspected criminal activity are not available or would not be effective; and
(3) The public interest and need for the placement of an undercover agent or informant in the part 2 program outweigh the potential injury to patients of the part 2 program, physician-patient relationships and the treatment services.
(d)
(1) Specifically authorize the placement of an undercover agent or an informant;
(2) Limit the total period of the placement to six months;
(3) Prohibit the undercover agent or informant from disclosing any patient identifying information obtained from the placement except as necessary to investigate or prosecute employees or agents of the part 2 program in connection with the suspected criminal activity; and
(4) Include any other measures which are appropriate to limit any potential disruption of the part 2 program by the placement and any potential for a real or apparent breach of patient confidentiality; for example, sealing from public scrutiny the record of any proceeding for which disclosure of a patient's record has been ordered.
(e)