# Presentation: 413985

## Confidentiality of Alcohol and Drug Abuse Patient RecordsU.S Department of Health and Human ServicesOffice of General Counsel Public Health DivisionAugust 19, 2004

- Constance L. Foster
- Senior Attorney

## Purpose of Part 2

- Restrict disclosure and use of alcohol and drug abuse patient records maintained by any federally assisted alcohol and drug abuse program

## Applicability

- Any information
- Federally assisted alcohol or drug abuse program for treatment, diagnosis for treatment, or referral for treatment
- Identification of patient as alcohol or drug abuser

## Information covered

- Part 2 “Patient identifying information” and Privacy Rule “Protected health information”
- Part 2: Any information that would disclose the identity of an individual as an alcohol or drug abuse patient, but not necessarily a number signed assigned to a patient by the program.
- Privacy Rule:  Any individually identifiable health information held or transmitted by a covered entity or business associate, including medical record numbers

## General Rule

- Programs may not disclose any identifying information unless the patient has given consent or otherwise specifically permitted under Part 2

## Disclosures

- Information may be disclosed or used only as permitted by Part 2
- Disclosures are permissive in nature
- The Privacy Rule contains certain mandatory disclosures that do not require authorization
- Disclosures are limited to that which is necessary to carry out the purpose of the disclosure

## Notice to patients of Federal confidentiality requirements

- Notice must be given at the time of admission
- Under Privacy Rule must be at first delivery of service
- Notice must inform the patient of the Federal law and regulations that protect alcohol and drug abuse patient records
- Description of limited circumstances of disclosure
- 	Statement that violation of the law and regulations is a crime
- 	Statement that the patient’s commission of a crime on the premises or against program personnel is not protected
- 	Statement that suspected child abuse or neglect may be reported
- 	Citations to the applicable Federal law and regulations

## Disclosures under the Privacy Rule and Part 2

- The Privacy Rule permits disclosures of information for treatment, payments and healthcare operations without authorization.
- Under Part 2, such information may not be disclosed unless the patient’s consent is obtained or:
- Disclosure within the program
- Disclosure to a qualified service organization

- The Privacy Rule mandates disclosures without authorization to the individual himself/herself and the Secretary of HHS
- Part 2 permits disclosures to the patient himself/herself.  Disclosures to the Secretary of HHS are permitted based on the audit and evaluation provision of Part 2.

## Disclosures with patient consent

## Consent must be in writing:

- Name or description of the program
- Name or title of the individual or organization
- Name of the patient
- Purpose of the disclosure
- Description of the information to be disclosed
- Statement that patient may revoke consent at any time, except to the extent the program has already acted in reliance upon the consent
- Date, event, or condition on which the consent will expire
- Signature of the patient
- Date on which the consent is signed

- The Privacy Rule has additional requirements:
- Statement reflecting ability or inability of the program to condition treatment on whether the patient signs the consent form
- Signed copy must be provided to the patient
- Program must retain consent form for a period of 6 years from expiration date

- The status of a person as a “minor” is determined by State law.
- A minor must sign a consent form for a program to release identifying information, except upon a determination by the program director that the minor lacks the requisite capacity a rational decision to give consent and that there exists a substantial threat to a person’s life or physical well-being
- Consent of patients adjudicated to be incompetent may be given by a guardian or person authorized by State law to act on behalf of patient
- Consent on behalf of deceased patients may be given by a personal representative under State law, spouse, or responsible family member

- Disclosures may be made to elements of the criminal justice system which have referred patients to the program
- Disclosure is made only to those individuals with a need to know in order to carry out their duties to monitor the patient
- Patient must provide written consent
- Irrevocable (Part 2), revocable (Privacy Rule)
- For programs covered under Part 2 and the Privacy Rule a court order should be sought for the release of such information

- Consent does not permit re-disclosure
- Revocation of consent may occur at any time, orally or in writing
- 	Under the Privacy Rule, the revocation must be in writing.  Programs governed by the Privacy Rule must still honor an oral revocation.

## Disclosures without patient consent

## Disclosures in internal communications

- Part 2 permits disclosures within a program or between a program and an entity having direct administrative control over the program

## Disclosures to QSOs

- Programs may make disclosures to a qualified service organization to enable the QSO to provide services to the program
- QSO must have written agreement with the program providing that the QSO is governed by Part 2 and will resist in judicial proceedings efforts to obtain patient records

- Under the Privacy Rule, business associates are allowed to re-disclose information to subcontractors.  Part 2 does not allow QSOs to re-disclose identifying information to subcontractors absent consent.

## Disclosures of suspected child abuse or neglect

- Programs may under State law report to the appropriate State or local officials instances of child abuse or neglect
- Restrictions still apply to the original patient records of the program

## Disclosures of criminal activity

- Part 2 allows disclosures to law enforcement officers concerning crimes on program premises or against program personnel

## Disclosures in medical emergencies

- Such disclosures can only be made to medical personnel having a need for the information to treat a condition that poses an immediate threat and requires immediate medical intervention
- Such disclosures must be documented in the patient’s records

## Disclosures for scientific research

- Recipient of the information must be qualified to conduct the research
- There must be a research protocol that has been reviewed by an independent group to ensure the protection of human research subjects and that the benefits of the research outweigh the risks of disclosure

## Disclosures for audit and evaluation activities

- Information may only be used to carry out the audit or evaluation
- Must abide by security requirements
- Must destroy all identifying information upon completion of the audit or evaluation
- May disclose only back to the program from which the information was obtained
- Governmental agency
- Accreditation bodies

## Disclosures authorized by order of the court

- Disclosures of confidential communications between a patient and a program in the course of diagnosis, treatment, or referral may be made pursuant to a court order only if the disclosure is
- Necessary to protect against threat to one’s life or of serious bodily injury
- Necessary in connection with the investigation or prosecution of a serious crime
- In connection with litigation or an administrative proceeding in which the patient offers testimony or other evidence relating to the content of the confidential communications

- Orders authorizing disclosure and use for non-criminal purposes must be based on a determination of good cause and must place limitations on the disclosure and use
- There are no other ways of obtaining the information
- The public interest in disclosure outweighs the potential risks of disclosure
- Disclosure is limited to parts of the patient’s record essential for fulfilling the objectives of the order
- Disclosure is made only to those person whose need for the information formed the basis of the order

- Orders authorizing disclosure and use to criminally investigate or prosecute patients must be based on specific findings
- There is a serious crime involved
- There is a reasonable likelihood that the disclosure will be of substantial value
- There are no other ways of obtaining the information
- The public interest in disclosure outweighs the potential risks of disclosure
- Disclosure is limited to parts of the patient’s record essential for fulfilling the objectives of the order
- Disclosure is made only to law enforcement and prosecutorial officials to carry out the investigation or prosecution

## Maintenance and disposition of records

- Alcohol and drug abuse records must be maintained in a secure room, locked file cabinet, safe or other similar container when not in use
- Programs must have written procedures for access to and use of such records
- Upon cessation or transfer of program operations, identifying information must be purged or the records destroyed unless the patient gives written consent to the transfer of his or her records or the law imposes a retention period

## Violations of Part 2

- The criminal penalty for violations of Part 2 provisions is a fine of not more than $500 for the first offense and not more than $5,000 for each subsequent offense
- Violations may be reported to the United States Attorney for the judicial district in which the violation occurred, or in the case involving a methadone program, to the regional offices of the FDA

## Print This Presentation

- For Live Meeting 5.0 Version
- Click on the File menu
- Select Print to PDF from the File menu
- For Live Meeting 4.3 Version
- Click on the blue Print to PDF button located in the lower left corner of the meeting window