Welfare Reform and Substance

Abuse Treatment 

Confidentiality: 

General Guidance for 

Reconciling

Need to Know and Privacy

Technical Assistance Publication Series

24

U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES

Public Health Service

Substance Abuse and Mental Health Services Administration

Center for Substance Abuse Treatment

Rockwall II, 5600 Fishers Lane

Rockville, MD 20857
 ii

This publication is part of the Substance

Abuse Prevention and Treatment Block

Grant technical assistance program. All

material appearing in this volume except

quoted passages from copyrighted sources

is in the public domain and may be

reproduced or copied without permission

from the Center for Substance Abuse

Treatment (CSAT) or the author. Citation

of the source is appreciated. 

This publication was written by the Legal

Action Center under contract 270-96-0005

from the Substance Abuse and Mental

Health Administration (SAMHSA). Nancy

S. Kilpatrick, M.A., of CSAT served as

the Government project officer. The

principal authors were Paul N. Samuels,

Esq., and Anita R. Marton, Esq., Judith

Galloway, Esq., Sharon K. Amatetti,

M.P.H., and Kerry Kemp provided

editorial support.

The opinions expressed herein are the

views of the author and do not necessarily

reflect the official position of CSAT or any

other part of the U.S. Department of

Health and Human Services (DHHS).

DHSS Publication No. (SMA) 99-3332

Printed 1999
iii

Contents

Foreword ................................................ v

I. Introduction ........................................... 1

II. Confidentiality of Alcohol and Drug Abuse 

 Patient Records: The Basics ............................. 2

III. Confidentiality and Welfare: The Key Areas ................ 3

1. Disclosure of Substance Abuse Diagnosis and Treatment 

Information From the Treatment System to the Welfare System ........................ 3

2. Disclosure of Substance Abuse Testing and Screening Information 

from the Welfare System to the Treatment System ................................... 5

3. Reporting of Attendance in—and Failure To Attend—Substance 

Abuse Programs to the Welfare System ............................................ 6

4. Patient/Client Revocation of Consent ............................................... 7

5. Reporting a Substance Abuse Patient’s Relapse to the Welfare System ................... 7

6. Combined Case Planning Between Substance Abuse Staff 

and Welfare Caseworkers ........................................................ 8

7. Qualified Service Organization Agreements Between Treatment 

and Welfare Systems ............................................................ 9

IV. Essential Considerations ................................ 10

1. Relationship with State Law ...................................................... 10

2. Assistance of Legal Counsel ..................................................... 10

Appendix A—The Federal Confidentiality Law and Regulations A-1

Appendix B—Sample Forms and Agreements To

 Facilitate Collaborative Efforts Between the 

Substance Abuse Treatment and Welfare

 Systems ................................................... B-1
v

Foreword

The need for this guidance emerged from a series of

four regional State Team-Building Workshops held

on welfare reform and its relationship to substance

abuse treatment. These workshops, sponsored by

the Center for Substance Abuse Treatment’s (CSAT)

Division of State and Community Assistance, were

conducted from July through October 1997. They

were attended by repre- sentatives of both substance

abuse treatment and welfare systems within each

participating State. These representatives identified

a mutual goal at the workshops: namely, assisting

shared clients in overcoming substance abuse issues

which create barriers to the clients’ ability to work. 

The Personal Responsibility and Work Opportunity

Reconciliation Act of 1996 (PRWA) (Public Law

104-193) has challenged States to help their citi-zens

leave welfare and become employed. As a

consequence, States are now trying harder than ever

to prepare welfare clients to enter and succeed in the

workforce. Among the barriers to work identified in

research regarding welfare clients are drug and

alcohol problems. This Technical Assistance

Publication (TAP) provides broad guidance on how

two systems—the substance abuse treatment and

welfare systems—can share information on their

mutual clients.

The goal of this TAP is to assist State alcohol and

other drug agencies, substance abuse treatment

providers, and welfare officials in addressing

confidentiality issues with respect to these shared

clients. It familiarizes welfare agency staff with

protections about which they may be unaware. It

discusses key issues such as how and when

disclosure is possible and it provides practical tips to

surmount real or perceived obstacles. 

Confidentiality laws relating to treatment for

substance abuse—defined as abuse of alcohol or

other drugs—were originally enacted to encourage

substance abusers to seek assistance without fear of

public disclosure of their abuse, including disclosure

of records of their treatment that could attach for life.

Federal regulations that protect the identities of

persons in substance abuse treatment have their

genesis in two statutes of the early 1970's: first, the

Comprehensive Alcohol Abuse and Alcoholism

Prevention, Treatment and Rehabilitation Act of

1970; and second, the Drug Abuse Prevention,

Treatment and Rehabilitation Act of 1972. These

two statutes were implemented by regulations issued

in 1975 by the U.S. Department of Health,

Education, and Welfare (DHEW). Revised in 1987

by DHEW’s successor, the U.S. Department of

Health and Human Services, the regulations are set

out at title 42, part 2, of the Code of Federal

Regulations. 

The confidentiality statutes and regulations were later

consolidated by Congress within the Public Health

Service Act—now title 42, section 290dd-3 of the

United States Code (42 U.S.C. §290dd-2). In this

TAP, references to the confidentiality law or

regulations mean the regulations at title 42, part 2, of

the Code of Federal Regulations (42 CFR Part 2).

The Federal confidentiality law and regulations are

presented as Appendix A. 

On behalf of the Center for Substance Abuse

Treatment of the Substance Abuse and Mental

Health Services Administration, I hope that this TAP

will promote compliance with the Federal

confidentiality regulations by both substance abuse

treatment and welfare officials, as well as facilitate

interactions between the two systems.

H. Westley Clark, M.D., J.D., M.P.H., CAS, 

 FASAM

Director

Center for Substance Abuse Treatment
1

I. Introduction

The purpose of this document is to provide guidance

in resolving issues related to the confidentiality of

patient/client information that are faced by alcohol

and other drug agencies, substance abuse treatment

providers, and welfare officials charged with

implementing State responses to the Personal

Responsibility and Work Opportunity Reconciliation

Act of 1996 (PRWA) (Public Law 104-193). These

parties confront several issues related to

confidentiality as they collaborate in helping their

shared clients overcome substance abuse problems

that create barriers to the clients’ ability to work.

The Federal alcohol and drug confidentiality law

requires covered programs that provide alcohol or

drug abuse diagnosis, treatment, or referral for

treatment to strictly maintain the confidentiality of

substance abuse patient records. This law (42

U.S.C. §290dd-2) and its accompanying regulations

(42 CFR Part 2) came about because the U.S.

Congress recognized that these safeguards on privacy

serve the important purpose of encouraging persons

to seek treatment by preventing the disclosure of

information related to their substance abuse diagnosis

and treatment. (For the full text of the Federal law

and regulations, see Appendix A.)

The Federal confidentiality law and regulations have

proved to be both remarkably effective and practical

in protecting patients from the potential harm of

unwarranted disclosures while permitting the release

of information in appropriate circumstances.

Increasingly, however, the substance abuse treatment

field is being called upon to interact and communicate

with outside entities, including staff of welfare

agencies who are not familiar with these protections

or how to utilize

the provisions authorizing appropriate

disclosures.

The PRWA has challenged States to help their

citizens leave welfare and enter the workforce. In

order to do this, States are having to help "harder-toserve" welfare clients prepare to enter—and succeed

in—the workforce. Among the barriers facing such

clients identified in the research are

drug and alcohol problems. 

Both welfare clients and officials believe that

treatment services are important to welfare reform.

Providing substance abuse treatment and prevention

services can help States meet their welfare reform

goals both by moving substance abusing welfare

recipients to sobriety/work and by averting intergenerational substance and welfare dependence

among young people. As a result, both systems

increasingly understand and appreciate the benefits

that will accrue from working together effectively.

For a successful collaboration between substance

abuse services and welfare systems to occur, both

systems must address the implications of the Federal

confidentiality law for communication of patient

information. How can necessary disclosures be made

between the two systems without violating the

confidentiality rules? 

This document promotes and facilitates compliance

with the Federal confidentiality law by both

substance abuse and welfare agencies, while

permitting communication and linkages between the

substance abuse and adult welfare systems essential

to successful implementation of welfare reform.

This document was developed for the following

audiences:

C staff of State agencies responsible for funding

and evaluating substance abuse treatment and

prevention programs;

C staff of substance abuse treatment and prevention programs, including clinical directors,

counselors, nurses and administrative personnel;

and

C welfare officials responsible for interacting with

welfare recipients with or at risk for substance

abuse problems.
2

The document describes the basic provisions of

Federal confidentiality law and outlines the key

confidentiality issues pertaining to the substance

abuse treatment system and the welfare system.

The Federal confidentiality law and regulations are

presented in Appendix A; sample patient consent and

other forms are presented in Appendix

B. 

The Federal confidentiality law discussed here

applies only to substance abuse patient records and

not to records of other health or mental health

services. For example, the child welfare system is

also undergoing change nationally, but confidentiality issues pertaining exclusively to clients within

that system are not included in the scope of this

guidance.

II. Confidentiality of

Alcohol and Drug Abuse

Patient Records: The

Basics

Federal law (42 U.S.C. §290dd-2) and regulations

(42 CFR Part 2) afford substance abuse treatment

client records special privacy protection out of

recognition that the confidentiality of such records

must be scrupulously protected if individuals are to

be encouraged to enter and stay in treatment.

These are the basic provisions of the Federal

confidentiality law and regulations: 

C Except under certain specified conditions, there is

a prohibition on disclosure of records or other

information concerning a patient in a Federally

assisted program. (See 42 CFR §2.11 for

definition of “program” and §2.12(b) for the

meaning of “Federally assisted.”) The prohibition

applies regardless of whether the person seeking

the information already has it, has other means of

obtaining it, enjoys official status, has obtained a

subpoena or even a warrant, or is authorized by

State law (42 CFR §2.13(b)). 

C Under certain conditions, limited disclosures are

permitted. These fall into nine categories: (1)

when there is written consent from the patient;

(2) when the disclosures are for the purpose of

internal communications; (3) when there is no

patient-identifying information; (4) when there is a

medical emergency; (5) when there is a court

order; (6) when the person involved has committed

a crime at program or against program personnel;

(7) when the disclosure is for research/audit and

evaluation; (8) when the disclosure is for child

abuse and neglect reporting; and (9) when there is

a Qualified Service Organization agreement

(QSOA).

C Most disclosures are permissible if a patient has

signed a valid consent form that has not expired or

been revoked. A proper patient consent form must

be in writing and contain each of the following nine

elements (42 CFR §2.31):

1. the name of the program making the

disclosure; 

2. the name of the individual or organization

that will receive the disclosure; 

3. the name of the patient; 

4. the purpose or need for the disclosure; 

5. how much and what kind of information

will be disclosed; 

6. a statement that the patient may revoke the

consent at any time; 

7. the date, event, or condition upon which

consent expires if not revoked; 

8. the signature of the patient; and 

9. the date on which the consent is signed.
3

General release forms and other forms that do not

contain all the above nine elements are not valid

for the purpose of authorizing disclosure of

 substance abuse patient records.

C Familiarity with the Federal confidentiality

provisions is essential to anyone directly or

indirectly involved with substance abuse

treatment, because the unknowing proceed at peril

of criminal and civil liability. Violating the

regulations is punishable by a fine of up to $500

for a first offense or up to $5,000 for each

subsequent offense (42 CFR §2.4). 

III. Confidentiality and

Welfare: The Key Areas

It is essential to understand that the Federal

confidentiality law and regulations do permit

disclosures to the welfare system of the records of

patients receiving substance abuse treatment in most

circumstances, as long as the Federal confidentiality

requirements are followed scrupulously. Typically,

this means obtaining the written consent of the

patient to authorize the disclosure. Key areas for

welfare caseworkers and substance abuse treatment

providers who work with welfare recipients are

discussed further below:

C disclosure of substance abuse diagnosis and

treatment information from the treatment system

to the welfare system;

C disclosure of substance abuse testing and

screening information from the welfare system to

the treatment system;

C reporting of attendance in—and failure to

attend—a substance abuse treatment program to

the welfare system;

C patient/client revocation of consent;

C reporting a substance abuse patient’s relapse to

the welfare system;

C combined case planning between substance abuse

staff and welfare caseworkers;

and

C Qualified Service Organization agreements

(QSOAs) between treatment and welfare systems.

1. Disclosure of Substance Abuse

Diagnosis and Treatment

Information From the Treatment

System to the Welfare System

Information concerning a patient’s diagnosis and

treatment is covered by the Federal

confidentiality law and regulations; disclosure

can be made only with the patient’s written

consent or other appropriate legal authorization.

The Federal confidentiality law and regulations state

that information obtained by Federally assisted

substance abuse programs regarding an individual’s

substance abuse drug treatment, and the “diagnosis”

of a patient’s substance abuse (defined as “any

reference to an individual’s alcohol or drug abuse or

to a condition which is identified as having been

caused by that abuse which is made for the purpose

of treatment or referral for treatment”), are covered

by the confidentiality protections (42 CFR §2.11 and

2.12(a)(ii)). Thus, a substance abuse program must

obtain the written consent of the patient or obtain

other authorization, as prescribed by the law and

regulations, before it can make any disclosure of

information related to treatment and/or a

diagnosis.

Substance abuse programs can disclose to the welfare

system information about treatment services only

with the written consent of the patient (42 CFR

Subpart C) or with other authorization such as a

court order issued in accordance with 42 CFR

Subpart D. Similarly, whenever a treatment program

makes a diagnosis (or “clinical assessment”) to

determine if an individual has a substance abuse

problem, it can communicate information related to

that diagnosis to the welfare system only with the

written consent of the patient or with other
4

authorization. These rules remain in force even if the

welfare system referred the individual for diagnosis

and treatment, and even if the welfare system

mandated the individual to obtain one or both of

those services.

In the great majority of situations involving

communication of treatment or diagnostic

information, written consent will be the vehicle that

authorizes disclosure of information from the

substance abuse treatment provider to the welfare

agency. Written consent is valid for the purpose of

authorizing disclosure of substance abuse patient

information covered by the Federal confidentiality

law only if it contains all nine elements required by

§2.31 of the regulations (see discussion above). 

Section 2.12(a)(1) states that the confidentiality

law and regulations govern information disclosed

by a “Federally assisted drug abuse...or...alcohol

abuse program.” In addition, §2.11 defines a

covered “program” as “an individual or entity. . .

who holds itself out as providing, and provides,

alcohol or drug abuse diagnosis, treatment, or

referral for treatment . . .”

A patient consent form that would authorize a

treatment program to communicate information

concerning the diagnosis and treatment of

substance abuse to the welfare system is presented

in Appendix B (Sample Form #1).

In some jurisdictions, the welfare agency itself

employs specialists in substance abuse problems who

assess and diagnose welfare recipients and then refer

those with substance abuse problems to treatment.

Such specialists are covered by the Federal

confidentiality law and regulations, so they would

need consent forms signed by the individuals they

diagnose before the results could be communicated to

any other section of the welfare agency.

The welfare and treatment systems can work

together to enhance their ability to obtain consent

and minimize confusion and misunderstanding. 

A little collaboration can go a long way in reducing

confusion and improving the working relationships

between the welfare and substance abuse treatment

systems. 

Practical Tip: As long as the patient consent

form contains all nine elements required by the

Federal confidentiality law and regulations, it does

not matter who presented the form to the patient

for signature. Thus, the welfare and substance

abuse treatment systems could collaborate on the

development of a common form and then use

that form routinely whenever information will be

needed. The welfare system could have the

patient sign the form whenever it refers recipients

to treatment or requires that an individual receive

treatment in order to receive welfare. The

treatment system could rely on that same

consent to disclose back to the welfare agency.

Practical Tip: Only the party (or parties)

named on a consent form can obtain information

from the treatment program, directly or indirectly. 

Thus, if a welfare case worker wishes to disclose

to another party information obtained via a

consent form, the case worker would need to

obtain, from the client, an additional consent form

permitting the specific disclosure before making

the redisclosure. The best way to avoid these

types of paperwork headaches is to make sure

that everyone who will need to receive the

information is listed (by name or descriptively) on

the initial consent form. The Federal regulations

allow consent forms to authorize disclosures to

multiple parties where all the other elements are

identical. A multiparty consent form is presented

in Appendix B (Sample Form #2).
5

Whenever a disclosure is made with the patient’s

written consent, the treatment program making the

disclosure must include with the information

conveyed a notice that redisclosure is prohibited

without further authorization. Such a notice is

presented in Appendix B (Sample Form #3). The

prohibition does not apply to sharing the information

with others within the welfare agency who are

included as recipients on the consent form.

2. Disclosure of Substance Abuse

Testing and Screening Information

From the Welfare System to the

Treatment System

Alcohol and drug testing that is not conducted as

part of a diagnosis of or treatment for an alcohol

or other drug problem is not covered by Federal

confidentiality rules; information related to a test

conducted as part of a diagnosis or treatment is

covered.

The Federal confidentiality law and regulations

provide that information gathered by a “program” as

defined in §2.11 CFR incident to diagnosis, treatment

or referral for treatment, is covered. Therefore, if a

welfare agency is a program as defined in §2.11 and

it conducts a urine test, blood alcohol count, or other

test for purposes other than a diagnosis or treatment

regimen, any information related to that test is not

covered by the Federal confidentiality regulations. In

that situation, the welfare agency could communicate

information about the test results without needing to

obtain consent or any other authorization under the

Federal confidentiality regulations.

The Federal confidentiality law and regulations

would apply if the welfare agency were a “program”

as defined in §2.11 CFR and the test was conducted

as part of developing a diagnosis or in the course of

referring for treatment services. If covered, the

welfare program must obtain the written consent of

the patient or obtain other authorization as prescribed

by the Federal regulations before it can make any

disclosure of information related to

treatment and/or a diagnosis.

Information gathered in a “prescreen” for the

purpose of referring an individual for a diagnosis

is not covered by the Federal law and

regulations.

Increasingly, many welfare agencies are instituting a

“screen” or “prescreen” procedure to identify welfare

recipients who may have alcohol and other drug

problems that could create a barrier to work.

Individuals identified by this screening mechanism as

possibly having an alcohol or other drug problem are

then referred to a specialist whose job is to diagnose

and, if the diagnosis reveals a substance abuse

problem, refer the individual for treatment. Since the

information gathered through the screening or

prescreening process does not constitute a diagnosis

and is not gathered for “the purpose of treatment or

referral for treatment,” it is not covered by the

Federal confidentiality rules. Thus, information

gathered from the screen or prescreen may be

communicated without restriction and without the

written consent of the individual or

any other authorization.

Practical Tip: If a welfare agency fits the

definition of a “program” as defined in §2.11 CFR,

the key issue in this analysis is whether a substance

abuse specialist determined that the individual has

an alcohol or drug problem. If such a determination

was made, then the information gathered and the

report generated is confidential under the Federal

requirements. But if no determination was actually

made as to whether the individual had a substance

abuse problem, and instead an attempt was made

simply to identify individuals who should be assessed

for a diagnosis because they might have a problem,

then nothing has been done that is covered by the

Federal confidentiality law and regulations.
6

3. Reporting of Attendance in—and

Failure To Attend—Substance

Abuse Programs to the Welfare

System

Substance abuse programs may report a welfare

recipient’s attendance and or failure to attend

treatment to the welfare system as long as a valid

written consent signed by the patient is in effect.

Information about a welfare recipient’s participation in substance abuse treatment can be

disclosed to the welfare system or any other person

or organization as long as the patient has signed a

written consent form authorizing the disclosure. This

includes information that may be detrimental to the

patient in the sense that it could lead to termination of

welfare benefits or other sanctions, including such

facts as the failure of the individual to comply with

treatment or leaving the program without permission

before completion of treatment.

A substance abuse patient is allowed to revoke

consent under §2.31(a)(8) CFR. If a patient does

this, the consent is no longer valid “except to the

extent that the program or person which is to make

the disclosure has already acted in reliance on it.”

That subsection of the Federal regulations states that

“[a]cting in reliance includes the provision of

treatment services in reliance on a valid consent to

disclose information to a third-party payer.”

Thus, to the extent that the welfare system is a

“third-party payer” providing payment to the

program for the welfare recipient’s treatment, and the

program relied on the consent to enable it to obtain

payment, the treatment program can (but is not

required to) continue making disclosures to the

welfare system for purposes of obtaining payment for

past services even after a patient revokes consent.

However, a program that continues to provide

services after a patient has revoked a consent to the

welfare system does so at its own financial peril.

Since the consent was already revoked when it

provided these services the program is not relying on

the consent and thus cannot make a disclosure to the

welfare system for the purpose of obtaining payment.

Practical Tip: A consent form is only in place

until the date, event, or condition on which it expires

(or the patient/client revokes consent), so it is a

good idea to make sure that the expiration set forth

on the consent form is sufficiently far in the future

to ensure that the welfare system can receive

appropriate information as needed. For example, if

the consent expires when the patient/client leaves

treatment, a treatment program would be unable to

report to the welfare system that a patient/client

left before completion of treatment since the

consent would have expired the moment he or she

left the program. It would be more advisable to

have the consent contain an end date that is

flexible, reasonable, and fits relevant circumstances

such as, “30 or 60 days after treatment ends” or

“when the patient/client is no longer eligible for

welfare benefits.”
7

4. Patient/Client Revocation of

Consent

Some welfare agencies are concerned about how to

handle the situation if a patient/client revokes

consent. As noted, treatment programs that relied on

a consent for disclosure to the welfare system,

consistent with §2.31(a)(8) CFR, are permitted to

continue making disclosures to the welfare system as

a third-party payer even if the client attempts to

revoke that consent. For example, the treatment

program has extended services in reliance on a

consent that enables the welfare system to reimburse

the program for treatment services. Substance abuse

programs and welfare agencies should be aware of

and use this provision when appropriate.

Practical Tip: Though revocation of patient

consent is rare, in those situations where it does

occur, there are ways in which substance abuse

programs and welfare agencies can still continue

their working relationship. While effective

revocation of patient consent precludes a

substance abuse program from making any

further disclosures, such as whether the patient is

still in treatment, welfare agencies that have been

receiving information and then abruptly run into a

“wall of silence” can make an educated surmise

that the client may have revoked consent. The

welfare agency could then approach the individual,

ask why the flow of information has stopped and,

where appropriate, require that verification of

treatment status be provided or eligibility for

benefits will end.

5. Reporting a Substance Abuse

Patient’s Relapse to the Welfare

System

Unfortunately, patients in substance abuse treatment

sometimes have relapses. For most patients who

have relapses, treatment will continue or resume. 

Substance abuse treatment programs may report

information about a patient’s treatment, including any

relapse, to welfare officials if that information is

covered by a valid written consent form signed by

the patient. The same issues involving

communication of treatment information and

revocation of consent discussed previously would

similarly apply to information about a patient’s

relapses.

Practical Tip: Relapse information is subject to

the same confidentiality protections as other

treatment information. For many welfare

agencies, the key information needed is whether

the welfare recipient is proceeding satisfactorily in

treatment—and satisfactory progress can include

relapse as long as the patient remains in or

resumes treatment—rather than whether a

patient has relapsed.
8

6. Combined Case Planning Between

Substance Abuse Staff and Welfare

Caseworkers

The success of a client’s transition to work will

involve collaborative planning between substance

abuse counselors and welfare caseworkers. Most of

the discussion between substance abuse staff and

welfare caseworkers necessary for joint case planning

will be permissible via a properly authorized consent

form. It is often useful to tell a client that his case

and progress will be discussed at periodic meetings

(or conference calls, etc.) between substance abuse

treatment and welfare staff. 

It is useful to explain to the client who specifically

will participate in such discussions. It is also a good

idea to explain that, unless authorized by the client’s

consent form, information from such a

discussion cannot be further disclosed.

Practical Tip: To avoid repeated paperwork and

confusion, it is useful to have the client complete a

multiparty consent form that lists all the potential

people who would be involved in case planning

meetings. Multiparty consent forms such as the

one shown in Appendix B (Sample Form #2) can be

designed to fit any case planning meeting. A

Qualified Service Organization agreement (QSOA)

between a substance abuse treatment program and

a service organization may also be used to conduct

combined case planning. QSOAs are described in

the section that follows.

7. Qualified Service Organization

Agreements (QSOAs) Between

Treatment and Welfare Systems
9

Substance abuse treatment programs may disclose

information to a “Qualified Service Organization”

without the patient’s consent (§2.12(c)(4) CFR). A

service organization is an organization that provides

services to the substance abuse program. An

agreement between a treatment program and a

Qualified Service Organization is a “Qualified Service

Organization agreement,” or QSOA. For an

illustration of such an agreement, see Appendix B

(Sample Form #4). 

A QSOA permits patient-identified communication

between the substance abuse treatment program and

the service organization without individual client

consent as long as the disclosure is for the purpose of

enabling the service organization to provide a service

to the treatment program and so long as the

information is only disclosed back to the treatment

program. In entering the QSOA, the service

organization agrees to be bound by the provisions of

42 CFR Part 2 and to resist in court any effort to

obtain access to information which would not be

permitted by Federal confidentiality regulations.

Practical Tip: Although the case planning

discussions could be conducted using consent

forms, they would also be permissible using a

QSOA as long as the information is not redisclosed

beyond the welfare agency and the treatment

program, unless further authorization were to be

obtained. The rationale for a QSOA in this

circumstance is that the service provided to the

program is the benefit of having coordinated

planning with welfare staff. The QSOA requires the

signatures of the director of the substance abuse

treatment program and the head of the welfare

agency. However, reimbursement by the welfare

system for substance abuse treatment is not a

“service” being provided to the treatment

organization. It is payment for a service being

rendered by the treatment program. Thus, in

order to make disclosures to the welfare agency for

the purpose of recovering reimbursement for

treatment, a program needs to obtain the client’s

written consent as discussed above.
10

IV. Essential

Considerations

1. Relationship with State Law

In using this guidance, the reader should be aware

that, apart from the Federal confidentiality law,

States may have laws and regulations that govern the

confidentiality of patient records for individuals who

are receiving substance abuse treatment services. In

instances in which a State’s confidentiality law is

more restrictive that the Federal law, a program must

follow the stricter State law. In instances where a

State’s confidentiality law is less protective of

confidentiality than the Federal law, however, the

Federal law controls. Only rarely is there an

irreconcilable conflict between Federal and State

law. (See §2.20 CFR in Appendix A for a discussion

of the relationship of Federal and State

confidentiality laws.)

2. Assistance of Legal Counsel

Because the primary responsibility for compliance

with the Federal confidentiality law and regulations

lies with the program and its staff, it would be

advisable for these guidelines to be thoroughly

discussed with the program’s legal counsel.

Likewise, readers are advised to seek the advice of

legal counsel when designing letters and forms based

on the samples provided here or when questions

arise concerning any of the issues discussed in this

guidance.
A-1

Appendix A—The Federal Confidentiality Law

and Regulations
A-2

Appendix A—The Federal Confidentiality Law

and Regulations
A-3

SUBCHAPTER A—GENERAL PROVISIONS

PART 1 [RESERVED]

PART 2—CONFIDENTIALITY OF

ALCOHOL AND DRUG ABUSE

PATIENT RECORDS 

Subpart A—Introduction

Sec.

2.2 Statutory authority for confidentiality of

alcohol abuse patient records.

2.3 Purpose and effect.

2.4 Criminal penalty for violation.

2.5 Reports of violations.

Subpart B—General Provisions

2.11 Definitions.

2.12 Applicability.

2.13 Confidentiality restrictions.

2.14 Minor patients.

2.15 Incompetent and deceased patients.

2.16 Security for written records.

2.17 Undercover agents and informants.

2.18 Restrictions on the use of identification

cards.

2.19 Disposition of records by discontinued programs.

2.20 Relationship to State laws.

2.21 Relationship to Federal statutes protecting

research subjects against compulsory disclosure of their identity.

2.22 Notice to patients of Federal confidentiality

requirements.

2.23 Patient access and restriction on use.

Subpart C—Disclosures With Patient’s Consent

2.31 Form of written consent.

2.32 Prohibition on redisclosure.

2.33 Disclosures permitted with written consent.

2.34 Disclosures to prevent multiple enrollments in

detoxification and maintenance treatment

programs.

2.35 Disclosures to elements of the criminal justice

system which have referred patients.

Subpart D—Disclosures Without Patient

Consent

2.51 Medical emergencies.

2.52 Research activities.

2.53 Audit and evaluation activities.

Subpart E—Court Orders Authorizing

Disclosures and Use

2.61 Legal effect of order.

2.62 Order not applicable to records disclosed

without consent to researchers, auditors

and evaluators.

2.63 Confidential communications.

2.64 Procedures and criteria for orders

authorizing disclosures for noncriminal

purposes.

2.65 Procedures and criteria for orders

authorizing disclosure and use of records to

criminally investigate or prosecute patients.

2.66 Procedures and criteria for orders

authorizing disclosure and use of records to

investigate or prosecute a program or the

person holding the records.

 2.67 Orders authorizing the use of undercover

agents and informants to criminally

investigate employees or agents of a

program.

AUTHORITY: Sec. 408 of Pub. L. 92–255, 86

Stat. 79, as amended by sec. 303 (a), (b) of Pub L.

93–282, 83 Stat. 137, 138; sec. 4(c)(5)(A) of Pub. L.

94–237, 90 Stat. 244; sec. 111(c)(3) of Pub. L. 94–581,

90 Stat. 2852; sec. 509 of Pub. L. 96–88, 93 Stat. 695;

sec. 973(d) of Pub. L. 97– 35, 95 Stat. 598; and

transferred to sec. 527 of the Public Health Service Act

by sec. 2(b)(16)(B) of Pub. L. 98–24, 97 Stat. 182 and

as amended by sec. 106 of Pub. L. 99–401, 100 Stat.

907 (42 U.S.C. 290ee–3) and sec. 333 of Pub. L.

91–616, 84 Stat. 1853, as amended by sec. 122(a) of

Pub. L. 93–282, 88 Stat. 131; and sec. 111(c)(4) of Pub.

L. 94–581, 90 Stat. 2852 and transferred to sec. 523 of

the Public Health Service Act by sec. 2(b)(13) of Pub. L.
98–24, 97 Stat. 181 and as amended by sec. 106 of Pub.

L. 99–401, 100 Stat. 907 (42 U.S.C. 290dd–3), as

amended by sec. 131 of Pub. L. 102–321, 106 Stat. 368,

(42 U.S.C. 290dd–2).

SOURCE: 52 FR 21809, June 9, 1987, unless

otherwise noted. 

Subpart A—Introduction

§ 2.1 Statutory authority for confidentiality of

drug abuse patient records. 

The restrictions of these regulations upon

the disclosure and use of drug abuse patient

records were initially authorized by section 408

of the Drug Abuse Prevention, Treatment, and

Rehabilitation Act (21 U.S.C. 1175). That

section as amended was transferred by Pub. L.

98–24 to section 527 of the Public Health

Service Act which is codified at 42 CFR Ch. I

(10-1-97 Edition § 2.2 at 42 U.S.C. 290ee–3. The

amended statutory authority is set forth below:

§ 290ee–3. CONFIDENTIALITY OF PATIENT

RECORDS.

(a) Disclosure authorization 

Records of the identity, diagnosis, prognosis, or

treatment of any patient which are maintained in

connection with the performance of any drug abuse

prevention function conducted, regulated, or directly or

indirectly assisted by any department or agency of the

United States shall, except as provided in subsection (e)

of this section, be confidential and be disclosed only for

the purposes and under the circumstances

 expressly authorized under subsection (b) of this

section.

(b) Purposes and circumstances of disclosure

affecting consenting patient and patient regardless

of consent

(1) The content of any record referred to in

subsection (a) of this section may be disclosed in

accordance with the prior written consent of the

patient with respect to whom such record is

maintained, but only to such extent, under such

circumstances, and for such purposes as may be

allowed under regulations prescribed pursuant to

subsection (g) of this section.

(2) Whether or not the patient, with respect to

whom any given record referred to in subsection (a) of

this section is maintained, gives his written consent,

the content of such record may be disclosed as

follows:

(A) To medical personnel to the extent necessary

to meet a bona fide medical emergency.

(B) To qualified personnel for the purpose of

conducting scientific research, management audits,

financial audits, or program evaluation, but such

personnel may not identify, directly or indirectly, any

individual patient in any report of such research, audit,

or evaluation, or otherwise disclose patient identities

in any manner.

(C) If authorized by an appropriate order of a court of

competent jurisdiction granted after application

showing good cause therefor. In assessing good cause

the court shall weigh the public interest and the need

for disclosure against the injury to the patient, to the

physician patient relationship, and to the treatment

services. Upon the granting of such order, the court, in

determining the extent to which any disclosure of all

or any part of any record is necessary, shall impose

appropriate safeguards against unauthorized

disclosure.

(c) Prohibition against use of record in making

criminal charges or investigation of patient

Except as authorized by a court order granted under

subsection (b)(2)(C) of this section, no record referred

to in subsection (a) of this section may be used to

initiate or substantiate any criminal charges against a

patient or to

 conduct any investigation of a patient.

(d) Continuing prohibition against disclosure

irrespective of status as patient

The prohibitions of this section continue to apply to

records concerning any individual who has been a

patient, irrespective of whether or when he ceases to be

a patient.

(e) Armed Forces and Veterans’ Administration;

interchange of records; report of suspected child

abuse and neglect to State or local authorities

The prohibitions of this section do not apply to any

interchange of records—

(1) within the Armed Forces or within those components

of the Veterans’ Administration furnishing health care to

veterans, or

(2) between such components and the Armed Forces.

The prohibitions of this section do not apply to the

reporting under State law of incidents of suspected child

abuse and neglect to the appropriate State or local

authorities.

(f) Penalty for first and subsequent offenses 

Any person who violates any provision of this section or

any regulation issued pursuant to this section shall be
A-5

fined not more than $500 in the case of a first offense,

and not more than $5,000 in the case of each subsequent

offense.

(g) Regulations; interagency consultations;

definitions, safeguards, and procedures, including

procedures and criteria for issuance and scope of

orders

Except as provided in subsection (h) of this section, the

Secretary, after consultation with the Administrator of

Veterans’ Affairs and the heads of other Federal

departments and agencies substantially affected thereby,

shall prescribe regulations to carry out the purposes of

this section. These regulations may contain such

definitions, and may provide for such safeguards and

procedures, including procedures and criteria for the

issuance and scope of orders under subsection (b)(2)(C)

of this section, as in the judgment of the Secretary are

necessary or proper to effectuate the purposes of this

section, to prevent circumvention or evasion thereof, or

to facilitate compliance therewith.

(Subsection (h) was superseded by section 111(c)(3) of

Pub. L. 94–581. The responsibility of the Administrator

of Veterans’ Affairs to write regulations to provide for

confidentiality of drug abuse patient records under Title

38 was moved from 21 U.S.C. 1175 to 38 U.S.C. 4134.)

§ 2.2 Statutory authority for confidentiality of

alcohol abuse patient records.

The restrictions of these regulations upon the

disclosure and use of alcohol abuse patient records

were initially authorized by section 333 of the

Comprehensive Alcohol Abuse and Alcoholism

Prevention, Treatment, and Rehabilitation Act of

1970 (42 U.S.C. 4582). The section as amended was

transferred by Pub. L. 98–24 to section 523 of the

Public Health Service Act which is codified at 42

U.S.C. 290dd–3. The amended statutory authority is

set forth below:

§ 290dd–3. CONFIDENTIALITY OF PATIENT

RECORDS

(a) Disclosure authorization 

Records of the identity, diagnosis, prognosis, or

treatment of any patient which are maintained in

connection with the performance of any program or

activity relating to alcoholism or alcohol abuse

education, training, treatment, rehabilitation, or

research, which is conducted, regulated, or directly or

indirectly assisted by any department or agency of the

United States shall, except as provided in subsection

(e) of this section, be confidential and be disclosed

only for the purposes and under the circumstances

expressly authorized under subsection (b) of this

section.

(b) Purposes and circumstances of disclosure

affecting consenting patient and patient regardless

of consent

(1) The content of any record referred to in subsection

(a) of this section may be disclosed in accordance

with the prior written consent of the patient with

respect to whom such record is maintained, but only to

such extent, under such circumstances, and for such

purposes as may be allowed under regulations

prescribed pursuant to subsection (g) of this section.

(2) Whether or not the patient, with respect to whom

any given record referred to in subsection (a) of this

section is maintained, gives his written consent, the

content of such record may be disclosed as follows:

(A) To medical personnel to the extent necessary to

meet a bona fide medical emergency.

(B) To qualified personnel for the purpose of

conducting scientific research, management audits,

financial audits, or program evaluation, but such

personnel may not identify, directly or indirectly, any

individual patient in any report of such research, audit,

or evaluation, or otherwise disclose patient identities

in any manner.

(C) If authorized by an appropriate order of a court of

competent jurisdiction granted after application

showing good cause therefor. In assessing good cause

the court shall weigh the public interest and the need

for disclosure against the injury to the patient, to the

physician patient relationship, and to the treatment

services. Upon the granting of such order, the court, in

determining the extent to which any disclosure of all

or any part of any record is necessary, shall impose

appropriate safeguards against unauthorized

disclosure. 

(c) Prohibition against use of record in making

criminal charges or investigation of patient

Except as authorized by a court order granted under

subsection (b)(2)(C) of this section, no record

referred to in subsection (a) of this section may be

used to initiate or substantiate any criminal charges

against a patient or to conduct any investigation of a

patient.

(d) Continuing prohibition against disclosure

irrespective of status as patient
A-6

The prohibitions of this section continue to apply to

records concerning any individual who has been a

patient, irrespective of whether or when he ceases to

be a patient.

(e) Armed Forces and Veterans’ Administration;

interchange of record of suspected child abuse and

neglect to State or local authorities

The prohibitions of this section do not apply to any

interchange of records—

(1) within the Armed Forces or within those

components of the Veterans’ Administration

furnishing health care to veterans, or

(2) between such components and the Armed Forces.

The prohibitions of this section do not apply to the

reporting under State law of incidents of suspected

child abuse and neglect to the appropriate State or

local authorities.

(f) Penalty for first and subsequent offenses

Any person who violates any provision of this section

or any regulation issued pursuant to this section shall

be fined not more than $500 in the case of a first

offense, and not more than $5,000 in the case of each

subsequent offense.

(g) Regulations of Secretary; definitions,

safeguards, and procedures, including procedures

and criteria for issuance and scope of orders

Except as provided in subsection (h) of this section,

the Secretary shall prescribe regulations to carry out

the purposes of this section. These regulations may

contain such definitions, and may provide for such

safeguards and procedures, including procedures and

criteria for the issuance and scope of orders under

subsection(b)(2)(C) of this section, as in the judgment

of the Secretary are necessary or proper to effectuate

the purposes of this section, to prevent circumvention

or evasion thereof, or to facilitate compliance

therewith.

(Subsection (h) was superseded by section 111(c)(4)

of Pub. L. 94–581. The responsibility of the

Administrator of Veterans’ Affairs to write

regulations to provide for confidentiality of alcohol

abuse patient records under Title 38 was moved from

42 U.S.C. 4582 to 38 U.S.C. 4134.)

§ 2.3 Purpose and effect.

(a) Purpose. Under the statutory provisions quoted in

§§ 2.1 and 2.2, these regulations impose restrictions

upon the disclosure and use of alcohol and drug abuse

patient records which are maintained in connection

with the performance of any federally assisted alcohol

and drug abuse program. The regulations specify:

(1) Definitions, applicability, and general

restrictions in subpart B (definitions applicable to §

2.34 only appear in that section);

(2) Disclosures which may be made with written

patient consent and the form of the written consent

in subpart C;

(3) Disclosures which may be made without written

patient consent or an authorizing court order in

subpart D; and

(4) Disclosures and uses of patient records which

may be made with an authorizing court order and

the procedures and criteria for the entry and scope

of those orders in subpart E.

(b) Effect. (1) These regulations prohibit the

disclosure and use of patient records unless certain

circumstances exist. If any circumstances exists under

which disclosure is permitted, that circumstance acts

to remove the prohibition on disclosure but it does not

compel disclosure. Thus, the regulations do not

require disclosure under any circumstances.

(2) These regulations are not intended to direct the

manner in which substantive functions such as

research, treatment, and evaluation are carried out.

They are intended to insure that an alcohol or drug

abuse patient in a federally assisted alcohol or drug

abuse program is not made more vulnerable by

reason of the availability of his or her patient record

than an individual who has an alcohol or drug

problem and who does not seek treatment.

(3) Because there is a criminal penalty (a fine—see

42 U.S.C. 290ee–3(f), 42 U.S.C. 290dd–3(f) and

42 CFR 2.4) for violating the regulations, they are

to be construed strictly in favor of the potential

violator in the same manner as a criminal statute

(see M. Kraus & Brothers v. United States, 327

U.S. 614, 621–22, 66 S. Ct. 705, 707–08 (1946)).

§ 2.4 Criminal penalty for violation.

Under 42 U.S.C. 290ee–3(f) and 42 U.S.C.

290dd–3(f), any person who violates any provision

of those statutes or these regulations shall be fined

not more than $500 in the case of a first offense,

and not more than $5,000 in the case of each

subsequent offense.

§ 2.5 Reports of violations.
A-7

(a) The report of any violation of these regulations

may be directed to the United States Attorney for

the judicial district in which the violation occurs.

(b) The report of any violation of these regulations

by a methadone program may be directed to the

Regional Offices of the Food and Drug

Administration.

Subpart B—General Provisions

§ 2.11 Definitions.

For purposes of these regulations: 

Alcohol abuse means the use of an alcoholic

beverage which impairs the physical, mental,

emotional, or social well-being of the user. 

Drug abuse means the use of a psychoactive

substance for other than medicinal purposes which

impairs the physical, mental, emotional, or social

well-being of the user. 

Diagnosis means any reference to an individual’s

alcohol or drug abuse or to a condition which is

identified as having been caused by that abuse

which is made for the purpose of treatment or

referral for treatment.

Disclose or disclosure means a communication of

patient identifying information, the affirmative

verification of another person’s communication of

patient identifying information, or the

communication of any information from the record

of a patient who has been identified.

Informant means an individual: 

(a) Who is a patient or employee of a program or

who becomes a patient or employee of a program

at the request of a law enforcement agency or

official: and

(b) Who at the request of a law enforcement

agency or official observes one or more patients or

employees of the program for the purpose of

reporting the information obtained to the law

enforcement agency or official.

Patient means any individual who has applied for

or been given diagnosis or treatment for alcohol or

drug abuse at a federally assisted program and

includes any individual who, after arrest on a

criminal charge, is identified as an alcohol or drug

abuser in order to determine that individual’s

eligibility to participate in a program.

Patient identifying information means the name,

address, social security number, fingerprints,

photograph, or similar information by which the

identity of a patient can be determined with

reasonable accuracy and speed either directly or by

reference to other publicly available information.

The term does not include a number assigned to a

patient by a program, if that number does not

consist of, or contain numbers (such as a social

security, or driver’s license number) which could

be used to identify a patient with reasonable

accuracy and speed from sources external to the

program.

Person means an individual, partnership,

corporation, Federal, State or local government

agency, or any other legal entity.

Program means:

(a) An individual or entity (other than a general

medical care facility) who holds itself out as

providing, and provides, alcohol or drug abuse

diagnosis, treatment or referral for treatment; or

(b) An identified unit within a general medical

facility which holds itself out as providing, and

provides, alcohol or drug abuse diagnosis,

treatment or referral for treatment; or

(c) Medical personnel or other staff in a general

medical care facility whose primary function is the

provision of alcohol or drug abuse diagnosis,

treatment or referral for treatment and who are

identified as such providers. (See § 2.12(e)(1) for

examples.)

Program director means:

(a) In the case of a program which is an individual,

that individual:

(b) In the case of a program which is an

organization, the individual designated as director,

managing director, or otherwise vested with

authority to act as chief executive of the

organization.
A-8

Qualified Service Organization means a

person which:

(a) Provides services to a program, such as data

processing, bill collecting, dosage preparation,

laboratory analyses, or legal, medical, accounting,

or other professional services, or services to

prevent or treat child abuse or neglect, including

training on nutrition and child care and individual

and group therapy, and

(b) Has entered into a written agreement with a

program under which that person:

(1) Acknowledges that in receiving, storing,

processing or otherwise dealing with any patient

records from the programs, it is fully bound by

these regulations; and

(2) If necessary, will resist in judicial proceedings

any efforts to obtain access to patient records

except as permitted by these regulations.

Records means any information, whether recorded

or not, relating to a patient received or acquired by

a federally assisted alcohol or drug program.

Third party payer means a person who pays, or

agrees to pay, for diagnosis or treatment furnished

to a patient on the basis of a contractual

relationship with the patient or a member of his

family or on the basis of the patient’s eligibility for

Federal, State, or local governmental benefits.

Treatment means the management and care of a

patient suffering from alcohol or drug abuse, a

condition which is identified as having been caused

by that abuse, or both, in order to reduce or

eliminate the adverse effects upon the patient.

Undercover agent means an officer of any

Federal, State, or local law enforcement agency who

enrolls in or becomes an employee of a program for

the purpose of investigating a suspected violation of

law or who pursues that purpose after enrolling or

becoming employed for other purposes. 

[52 FR 21809, June 9, 1987, as amended by 60 FR

22297, May 5, 1995]

§ 2.12 Applicability.

(a) General—(1) Restrictions on disclosure. The

restrictions on disclosure in these regulations apply

to any information, whether or not recorded, which:

(i) Would identify a patient as an alcohol or drug

abuser either directly, by reference to other publicly

available information, or through verification of

such an identification by another person; and

(ii) Is drug abuse information obtained by a

federally assisted drug abuse program after March

20, 1972, or is alcohol abuse information obtained

by a federally assisted alcohol abuse program after

May 13, 1974 (or if obtained before the pertinent

date, is maintained by a federally assisted alcohol or

drug abuse program after that date as part of an

ongoing treatment episode which extends past that

date) for the purpose of treating alcohol or drug

abuse, making a diagnosis for that treatment, or

making a referral for that treatment.

(2) Restriction on use. The restriction on use of

information to initiate or substantiate any criminal

charges against a patient or to conduct any criminal

investigation of a patient (42 U.S.C. 290ee–3(c), 42

U.S.C. 290dd–3(c)) applies to any information,

whether or not recorded which is drug abuse

information obtained by a federally assisted drug

abuse program after March 20, 1972, or is alcohol

abuse information obtained by a federally assisted

alcohol abuse program after May 13, 1974 (or if

obtained before the pertinent date, is maintained by

a federally assisted alcohol or drug abuse program

after that date as part of an ongoing treatment

episode which extends past that date), for the

purpose of treating alcohol or drug abuse, making a

diagnosis for the treatment, or making a referral for

the treatment.

(b) Federal assistance. An alcohol abuse or drug

abuse program is considered to be federally assisted

if:

(1) It is conducted in whole or in part, whether

directly or by contract or otherwise by any

department or agency of the United States (but see

paragraphs (c)(1) and (c)(2) of this section relating

to the Veterans’ Administration and the Armed

Forces);
A-9

(2) It is being carried out under a license,

certification, registration, or other authorization

granted by any department or agency of the United

States including but not limited to:

(i) Certification of provider status under the

Medicare program;

(ii) Authorization to conduct methadone

maintenance treatment (see 21 CFR 291.505); or

(iii) Registration to dispense a substance under the

Controlled Substances Act to the extent the

controlled substance is used in the treatment of

alcohol or drug abuse;

(3) It is supported by funds provided by any

department or agency of the United States by

being:

(i) A recipient of Federal financial assistance in any

form, including financial assistance which does not

directly pay for the alcohol or drug abuse diagnosis,

treatment, or referral activities; or

(ii) Conducted by a State or local government unit

which, through general or special revenue sharing

or other forms of assistance, receives Federal funds

which could be (but are not necessarily) spent for

the alcohol or drug abuse program; or

(4) It is assisted by the Internal Revenue Service of

the Department of the Treasury through the

allowance of income tax deductions for

contributions to the program or through the

granting of tax exempt status to the program.

(c) Exceptions—(1) Veterans’ Administration.

These regulations do not apply to information on

alcohol and drug abuse patients maintained in

connection with the Veterans’ Administration

provisions of hospital care, nursing home care,

domiciliary care, and medical services under title

38, United States Code. Those records are

governed by 38 U.S.C. 4132 and regulations issued

under that authority by the Administrator of

Veterans’ Affairs.

(2) Armed Forces. These regulations apply to any

information described in paragraph (a) of this

section which was obtained by any component of

the Armed Forces during a period when the patient

was subject to the Uniform Code of Military

Justice except:

(i) Any interchange of that information within the

Armed Forces; and

(ii) Any interchange of that information between

the Armed Forces and those components of the

Veterans Administration furnishing health care to

veterans.

(3) Communication within a program or between

a program and an entity having direct

administrative control over that program. The

restrictions on disclosure in these regulations do not

apply to communications of information between

or among personnel having a need for the

information in connection with their duties that

arise out of the provision of diagnosis, treatment, or

referral for treatment of alcohol or drug abuse if the

communications are 

(i) Within a program or 

(ii) Between a program and an entity that has direct

administrative control over the program.

(4) Qualified Service Organizations. The

restrictions on disclosure in these regulations do not

apply to communications between a program and a

qualified service organization of information needed

by the organization to provide services to the

program.

(5) Crimes on program premises or against

program personnel. The restrictions on disclosure

and use in these regulations do not apply to

communications from program personnel to law

enforcement officers which—

(i) Are directly related to a patient’s commission of

a crime on the premises of the program or against

program personnel or to a threat to commit such a

crime; and

(ii) Are limited to the circumstances of the incident,

including the patient status of the individual

committing or threatening to commit the crime, that

individual’s name and address, and that individual’s

last known whereabouts.

(6) Reports of suspected child abuse and neglect.

The restrictions on disclosure and use in these

regulations do not apply to the reporting under

State law of incidents of suspected child abuse and

neglect to the appropriate State or local authorities.

However, the restrictions continue to apply to the

original alcohol or drug abuse patient records

maintained by the program including their

disclosure and use for civil or criminal proceedings

which may arise out of the report of suspected

child abuse and neglect.
A-10

(d) Applicability to recipients of information—(1)

Restriction on use of information. The restriction

on the use of any information subject to these

regulations to initiate or substantiate any criminal

charges against a patient or to conduct any criminal

investigation of a patient applies to any person who

obtains that information from a federally assisted

alcohol or drug abuse program, regardless of the

status of the person obtaining the information or of

whether the information was obtained in

accordance with these regulations. This restriction

on use bars, among other things, the introduction

of that information as evidence in a criminal

proceeding and any other use of the information to

investigate or prosecute a patient with respect to a

suspected crime. Information obtained by

undercover agents or informants (see § 2.17) or

through patient access (see § 2.23) is subject to the

restriction on use.

(2) Restrictions on disclosures—Third party

payers, administrative entities, and others. The

restrictions on disclosure in these regulations apply

to:

(i) Third party payers with regard to records

disclosed to them by federally assisted alcohol or

drug abuse programs;

(ii) Entities having direct administrative control

over programs with regard to information

communicated to them by the program under §

2.12(c)(3); and

(iii) Persons who receive patient records directly

from a federally assisted alcohol or drug abuse

program and who are notified of the restrictions on

redisclosure of the records in accordance with §

2.32 of these regulations.

(e) Explanation of applicability—(1) Coverage.

These regulations cover any information (including

information on referral and intake) about alcohol

and drug abuse patients obtained by a program (as

the terms ‘‘patient’’ and ‘‘program’’ are defined in

§ 2.11) if the program is federally assisted in any

manner described in § 2.12(b). Coverage includes,

but is not limited to, those treatment or

rehabilitation programs, employee assistance

programs, programs within general hospitals, based

programs, and private practitioners who hold

themselves out as providing, and provide alcohol or

drug abuse diagnosis, treatment, or referral for

treatment. However, these regulations would not

apply, for example, to emergency room personnel

who refer a patient to the intensive care unit for an

apparent overdose, unless the primary function of

such personnel is the provision of alcohol or drug

abuse diagnosis, treatment or referral and they are

identified as providing such services or the

emergency room has promoted itself to the

community as a provider of such services.

(2) Federal assistance to program required. If a

patient’s alcohol or drug abuse diagnosis,

treatment, or referral for treatment is not provided

by a program which is federally conducted,

regulated or supported in a manner which

constitutes Federal assistance under § 2.12(b), that

patient’s record is not covered by these regulations.

Thus, it is possible for an individual patient to

benefit from Federal support and not be covered by

the confidentiality regulations because the program

in which the patient is enrolled is not federally

assisted as defined in § 2.12(b). For example, if a

Federal court placed an individual in a private forprofit program and made a payment to the program

on behalf of that individual, that patient’s record

would not be covered by these regulations unless

the program itself received Federal assistance as

defined by § 2.12(b).

(3) Information to which restrictions are

applicable. Whether a restriction is on use or

disclosure affects the type of information which

may be available. The restrictions on disclosure

apply to any information which would identify a

patient as an alcohol or drug abuser. The restriction

on use of information to bring criminal charges

against a patient for a crime applies to any

information obtained by the program for the

purpose of diagnosis, treatment, or referral for

treatment of alcohol or drug abuse. (Note that

restrictions on use and disclosure apply to

recipients of information under § 2.12(d).)

(4) How type of diagnosis affects coverage. These

regulations cover any record of a diagnosis

identifying a patient as an alcohol or drug abuser

which is prepared in connection with the treatment

or referral for treatment of alcohol or drug abuse. A

diagnosis prepared for the purpose of treatment or

referral for treatment but which is not so used is

covered by these regulations. The following are not

covered by these regulations:

(i) Diagnosis which is made solely for the purpose

of providing evidence for use by law enforcement

authorities; or
A-11

(ii) A diagnosis of drug overdose or alcohol

intoxication which clearly shows that the individual

involved is not an alcohol or drug abuser (e.g.,

involuntary ingestion of alcohol or drugs or reaction

to a prescribed dosage of one or more drugs).

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987, as amended at 60 FR 22297, May 5, 1995] 

§ 2.13 Confidentiality restrictions.

(a) General. The patient records to which these

regulations apply may be disclosed or used only as

permitted by these regulations and may not

otherwise be disclosed or used in any civil,

criminal, administrative, or legislative proceedings

conducted by any Federal, State, or local authority.

Any disclosure made under these regulations must

be limited to that information which is necessary to

carry out the purpose of the disclosure.

(b) Unconditional compliance required. The

restrictions on disclosure and use in these

regulations apply whether the holder of the

information believes that the person seeking the

information already has it, has other means of

obtaining it, is a law enforcement or other official,

has obtained a subpoena, or asserts any other

justification for a disclosure or use which is not

permitted by these regulations.

(c) Acknowledging the presence of patients:

Responding to requests. (1) The presence of an

identified patient in a facility or component of a

facility which is publicly identified as a place where

only alcohol or drug abuse diagnosis, treatment, or

referral is provided may be acknowledged only if

the patient’s written consent is obtained in

accordance with subpart C of these regulations or if

an authorizing court order is entered in accordance

with subpart E of these regulations. The regulations

permit acknowledgment of the presence of an

identified patient in a facility or part of a facility if

the facility is not publicly identified as only an

alcohol or drug abuse diagnosis, treatment or

referral facility, and if the acknowledgment does

not reveal that the patient is an alcohol or drug

abuser.

(2) Any answer to a request for a disclosure of

patient records which is not permissible under these

regulations must be made in a way that will not

affirmatively reveal that an identified individual has

been, or is being diagnosed or treated for alcohol or

drug abuse. An inquiring party may be given a copy

of these regulations and advised that they restrict

the disclosure of alcohol or drug abuse patient

records, but may not be told affirmatively that the

regulations restrict the disclosure of the records of

an identified patient. The regulations do not restrict

a disclosure that an identified individual is not and

never has been a patient.

§ 2.14 Minor patients.

(a) Definition of minor. As used in these

regulations the term ‘‘minor’’ means a person who

has not attained the age of majority specified in the

applicable State law, or if no age of majority is

specified in the applicable State law, the age of

eighteen years.

(b) State law not requiring parental consent to

treatment. If a minor patient acting alone has the

legal capacity under the applicable State law to

apply for and obtain alcohol or drug abuse

treatment, any written consent for disclosure

authorized under subpart C of these regulations

may be given only by the minor patient. This

restriction includes, but is not limited to, any

disclosure of patient identifying information to the

parent or guardian of a minor patient for the

purpose of obtaining financial reimbursement.

These regulations do not prohibit a program from

refusing to provide treatment until the minor patient

consents to the disclosure necessary to obtain

reimbursement, but refusal to provide treatment

may be prohibited under a State or local law

requiring the program to furnish the service

irrespective of ability to pay.

(c) State law requiring parental consent to

treatment. (1) Where State law requires consent of

a parent, guardian, or other person for a minor to

obtain alcohol or drug abuse treatment, any written

consent for disclosure authorized under subpart C

of these regulations must be given by both the

minor and his or her parent, guardian, or other

person authorized under State law to act in the

minor’s behalf. 

(2) Where State law requires parental consent to

treatment the fact of a minor’s application for

treatment may be communicated to the minor’s
A-12

parent, guardian, or other person authorized under

State law to act in the minor’s behalf only if:

(i) The minor has given written consent to the

disclosure in accordance with subpart C of these

regulations or

(ii) The minor lacks the capacity to make a rational

choice regarding such consent as judged by the

program director under paragraph (d) of this

section.

(d) Minor applicant for services lacks capacity for

rational choice. Facts relevant to reducing a threat

to the life or physical well being of the applicant or

any other individual may be disclosed to the parent,

guardian, or other person authorized under State

law to act in the minor’s behalf if the program

director judges that:

(1) A minor applicant for services lacks capacity

because of extreme youth or mental or physical

condition to make a rational decision on whether to

consent to a disclosure under subpart C of these

regulations to his or her parent, guardian, or other

person authorized under State law to act in the

minor’s behalf, and

(2) The applicant’s situation poses a substantial

threat to the life or physical well being of the

applicant or any other individual which may be

reduced by communicating relevant facts to the

minor’s parent, guardian, or other person

authorized under State law to act in the minor’s

behalf.

§ 2.15 Incompetent and deceased patients.

(a) Incompetent patients other than minors—(1)

Adjudication of incompetence. In the case of a

patient who has been adjudicated as lacking the

capacity, for any reason other than insufficient age,

to manage his or her own affairs, any consent

which is required under these regulations may be

given by the guardian or other person authorized

under State law to act in the patient’s behalf.

(2) No adjudication of incompetency. For any

period for which the program director determines

that a patient, other than a minor or one who has

been adjudicated incompetent, suffers from a

medical condition that prevents knowing or

effective action on his or her own behalf, the

program director may exercise the right of the

patient to consent to a disclosure under subpart C

of these regulations for the sole purpose of

obtaining payment for services from a third party

payer.

(b) Deceased patients—(1) Vital statistics. These

regulations do not restrict the disclosure of patient

identifying information relating to the cause of

death of a patient under laws requiring the

collection of death or other vital statistics or

permitting inquiry into the cause of death.

(2) Consent by personal representative. Any other

disclosure of information identifying a deceased

patient as an alcohol or drug abuser is subject to

these regulations. If a written consent to the

disclosure is required, that consent may be given by

an executor, administrator, or other personal

representative appointed under applicable State

law. If there is no such appointment the consent

may be given by the patient’s spouse or, if none,

by any responsible member of the patient’s family.

§ 2.16 Security for written records.

(a) Written records which are subject to these

regulations must be maintained in a secure room,

locked file cabinet, safe or other similar container

when not in use; and

(b) Each program shall adopt in writing procedures

which regulate and control access to and use of

written records which are subject to these

regulations.
A-13

§ 2.17 Undercover agents and informants.

(a) Restrictions on placement. Except as

specifically authorized by a court order granted

under § 2.67 of these regulations, no program may

knowingly employ, or enroll as a patient, any

undercover agent or informant.

(b) Restriction on use of information. No

information obtained by an undercover agent or

informant, whether or not that undercover agent or

informant is placed in a program pursuant to an

authorizing court order, may be used to criminally

investigate or prosecute any patient.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987]

§ 2.18 Restrictions on the use of identification

cards.

 No person may require any patient to carry on his or

her person while away from the program premises any

card or other object which would identify the patient as

an alcohol or drug abuser. This section does not prohibit

a person from requiring patients to use or carry cards

or other identification objects on the premises of a

program. 

§ 2.19 Disposition of records by discontinued

programs.

(a) General. If a program discontinues operations

or is taken over or acquired by another program, it

must purge patient identifying information from its

records or destroy the records unless—

(1) The patient who is the subject of the records gives

written consent (meeting the requirements of § 2.31) to a

transfer of the records to the acquiring program or to

any other program designated in the consent (the

manner of obtaining this consent must minimize the

likelihood of a disclosure of patient identifying

information to a third party); or

 (2) There is a legal requirement that the records be

kept for a period specified by law which does not expire

until after the discontinuation or acquisition of the

program.

(b) Procedure where retention period required by

law. If paragraph (a)(2) of this section applies, the

records must be: 

(1) Sealed in envelopes or other containers labeled

as follows: ‘‘Records of [insert name of program]

required to be maintained under [insert citation to

statute, regulation, court order or other legal

authority requiring that records be kept] until a date

not later than [insert appropriate date]’’; and

(2) Held under the restrictions of these regulations

by a responsible person who must, as soon as

practicable after the end of the retention period

specified on the label, destroy the records.

§ 2.20 Relationship to State laws.

The statutes authorizing these regulations (42

U.S.C. 290ee–3 and 42 U.S.C. 290dd–3) do not

preempt the field of law which they cover to the

exclusion of all State laws in that field. If a

disclosure permitted under these regulations is

prohibited under State law, neither these regulations

nor the authorizing statutes may be construed to

authorize any violation of that State law. However,

no State law may either authorize or compel any

disclosure prohibited by these regulations.

§ 2.21 Relationship to Federal statutes protecting research subjects against compulsory

disclosure of their identity.

(a) Research privilege description. There may be

concurrent coverage of patient identifying

information by these regulations and by

administrative action taken under: Section 303(a) of

the Public Health Service Act (42 U.S.C. 242a(a)

and the implementing regulations at 42 CFR part

2a); or section 502(c) of the Controlled Substances

Act (21 U.S.C. 872(c) and the implementing

regulations at 21 CFR 1316.21). These ‘‘research

privilege’’ statutes confer on the Secretary of

Health and Human Services and on the Attorney

General, respectively, the power to authorize

researchers conducting certain types of research to

withhold from all persons not connected with the

research the names and other identifying

information concerning individuals who are the

subjects of the research.

(b) Effect of concurrent coverage. These

regulations restrict the disclosure and use of

information about patients, while administrative

action taken under the research privilege statutes

and implementing regulations protects a person
A-14

engaged in applicable research from being

compelled to disclose any identifying characteristics

of the individuals who are the subjects of that

research. The issuance under subpart E of these

regulations of a court order authorizing a disclosure

of information about a patient does not affect an

exercise of authority under these research privilege

statutes. However, the research privilege granted

under 21 CFR 291.505(g) to treatment programs

using methadone for maintenance treatment does

not protect from compulsory disclosure any

information which is permitted to be disclosed

under those regulations. Thus, if a court order

entered in accordance with subpart E of these

regulations authorizes a methadone maintenance

treatment program to disclose certain information

about its patients, that program may not invoke the

research privilege under 21 CFR 291.505(g) as a

defense to a subpoena for that information.

§ 2.22 Notice to patients of Federal

confidentiality requirements.

(a) Notice required. At the time of admission or as

soon thereafter as the patient is capable of rational

communication, each program shall:

(1) Communicate to the patient that Federal law

and regulations protect the confidentiality of

alcohol and drug abuse patient records; and

(2) Give to the patient a summary in writing of the

Federal law and regulations. 

(b) Required elements of written summary. The

written summary of the Federal law and regulations

must include:

(1) A general description of the limited

circumstances under which a program may

acknowledge that an individual is present at a

facility or disclose outside the program information

identifying a patient as an alcohol or drug abuser.

(2) A statement that violation of the Federal law

and regulations by a program is a crime and that

suspected violations may be reported to appropriate

authorities in accordance with these regulations.

(3) A statement that information related to a

patient’s commission of a crime on the premises of

the program or against personnel of the program is

not protected.

(4) A statement that reports of suspected child

abuse and neglect made under State law to

appropriate State or local authorities are not

protected.

(5) A citation to the Federal law and regulations.

(c) Program options. The program may devise its

own notice or may use the sample notice in

paragraph (d) to comply with the requirement to

provide the patient with a summary in writing of

the Federal law and regulations. In addition, the

program may include in the written summary

information concerning State law and any program

policy not inconsistent with State and Federal law

on the subject of confidentiality of alcohol and drug

abuse patient records.

(d) Sample notice. 

CONFIDENTIALITY OF ALCOHOL AND DRUG

ABUSE PATIENT RECORDS

The confidentiality of

alcohol and drug abuse patient

records maintained by this

program is protected by Federal

law and regulations. Generally,

the program may not say to a

person outside the program that

a patient attends the program,

or disclose any information

identifying a patient as an

alcohol or drug abuser Unless:

(1) The patient consents in writing:

(2) The disclosure is allowed by a court order; or

(3) The disclosure is made to medical personnel

in a medical emergency or to qualified personnel for

research, audit, or program evaluation. Violation of the

Federal law and regulations by a program is a crime.

Suspected violations may be reported to appropriate

authorities in accordance with Federal regulations.

Federal law and regulations do not protect any

information about a crime committed by a patient

either at the program or against any person who works

for the program or about any threat to commit such a

crime. Federal laws and regulations do not protect any

information about suspected child abuse or neglect

from being reported under State law to appropriate

State or local authorities.

(See 42 U.S.C. 290dd–3 and 42 U.S.C. 290ee–3 for

Federal laws and 42 CFR part 2 for Federal regulations.)

(Approved by the Office of Management and Budget

under control number 0930–0099)
A-15

§ 2.23 Patient access and restrictions on use.

(a) Patient access not prohibited. These regulations do

not prohibit a program from giving a patient access to

his or her own records, including the opportunity to

inspect and copy any records that the program maintains

about the patient. The program is not required to obtain

a patient’s written consent or other authorization under

these regulations in order to provide such access to the

patient.

(b) Restriction on use of information. Information

obtained by patient access to his or her patient record is

subject to the restriction on use of his information to

initiate or substantiate any criminal charges against the

patient or to conduct any criminal investigation of the

patient as provided for under § 2.12(d)(1).

Subpart C—Disclosures With Patient’s

Consent

§ 2.31 Form of written consent.

(a) Required elements. A written consent to a disclosure

under these regulations must include:

(1) The specific name or general designation of the

program or person permitted to make the

disclosure.

(2) The name or title of the individual or the name

of the organization to which disclosure is to be

made.

(3) The name of the patient.

(4) The purpose of the disclosure.

(5) How much and what kind of information is to

be disclosed.

(6) The signature of the patient and, when required

for a patient who is a minor, the signature of a

person authorized to give consent under § 2.14; or,

when required for a patient who is incompetent or

deceased, the signature of a person authorized to

sign under § 2.15 in lieu of the patient.

(7) The date on which the consent is signed.

(8) A statement that the consent is subject to

revocation at any time except to the extent that the

program or person which is to make the disclosure

has already acted in reliance on it. Acting in

reliance includes the provision of treatment services

in reliance on a valid consent to disclose

information to a third party payer.

(9) The date, event, or condition upon which the

consent will expire if not revoked before. This date,

event, or condition must insure that the consent will

last no longer than reasonably necessary to serve

the purpose for which it is given.

(b) Sample consent form. The following form complies

with paragraph (a) of this section, but other elements

may be added.

1. I (name of patient) 

———————————————————

Q Request Q Authorize:

2.(name or general designation of program which

is to make the disclosure)

———————————————————

3. To disclose: (kind and amount of information to

be disclosed)

———————————————————

4. To: (name or title of the person or organization

to which disclosure is to be made)

———————————————————

5. For: (purpose of the disclosure)

———————————————————

6. Date: (on which this consent is signed)

———————————————————

7. Signature of patient

———————————————————

8. Signature of parent or guardian (where required)

———————————————————

9. Signature of person authorized to sign in lieu of

the patient (where required)

———————————————————

10. This consent is subject to revocation at any time

except to the extent that the program which is to make

the disclosure has already taken action in reliance on it.

If not previously revoked, this consent will terminate

upon: (specific date, event, or condition)

———————————————————

(c) Expired, deficient, or false consent. A disclosure

may not be made on the basis of a consent which:
A-16

(1) Has expired;

(2) On its face substantially fails to conform to

any of the requirements set forth in paragraph (a) of

this section;

(3) Is known to have been revoked; or

(4) Is known, or through a reasonable effort

could be known, by the person holding the records to

be materially false.

(Approved by the Office of Management and Budget

under control number 0930–0099)

§ 2.32 Prohibition on redisclosure.

Notice to accompany disclosure. Each disclosure made with the patient’s written consent must

be accompanied by the following written statement:

This information has been disclosed to you from

records protected by Federal confidentiality rules (42

CFR part 2). The Federal rules prohibit you from making

any further disclosure of this information unless further

disclosure is expressly permitted by the written consent

of the person to whom it pertains or as otherwise

permitted by 42 CFR part 2. A general authorization for

the release of medical or other information is NOT

sufficient for this purpose. The Federal rules restrict any

use of the information to criminally investigate or

prosecute any alcohol or drug abuse patient.

[52 FR 21809, June 9, 1987; 52 FR 41997, Nov. 2,

1987]

§ 2.33 Disclosures permitted with written consent.

If a patient consents to a disclosure of his or her

records under § 2.31, a program may disclose those

records in accordance with that consent to any

individual or organization named in the consent,

except that disclosures to central registries and in

connection with criminal justice referrals must meet

the requirements of §§ 2.34 and 2.35, respectively.

§ 2.34 Disclosures to prevent multiple enrollments in detoxification and maintenance

treatment programs.

(a) Definitions. For purposes of this section:

Central registry means an organization which

obtains from two or more member programs patient

identifying information about individuals applying for

maintenance treatment or detoxification treatment for

the purpose of avoiding an individual’s concurrent

enrollment in more than one program. 

Detoxification treatment means the dispensing

of a narcotic drug in decreasing doses to an individual

in order to reduce or eliminate adverse physiological

or psychological effects incident to withdrawal from

the sustained use of a narcotic drug. 

Maintenance treatment means the

dispensing of a narcotic drug in the treatment of

an individual for dependence upon heroin or

other morphine-like drugs. 

Member program means a detoxification

treatment or maintenance treatment program

which reports patient identifying information to

a central registry and which is in the same State

as that central registry or is not more than 125

miles from any border of the State in which the

central registry is located. 

(b) Restrictions on disclosure. A program may

disclose patient records to a central registry or to any

detoxification or maintenance treatment program not

more than 200 miles away for the purpose of

preventing the multiple enrollment of a patient only if:

(1) The disclosure is made when:

(i) The patient is accepted for treatment;

(ii) The type or dosage of the drug is changed; or

(iii) The treatment is interrupted, resumed or

terminated.

 (2) The disclosure is limited to:

(i) Patient identifying information;

(ii) Type and dosage of the drug; and

(iii) Relevant dates.

(3) The disclosure is made with the patient’s written

consent meeting the requirements of §2.31, except

that:

(i) The consent must list the name and address of each

central registry and each known detoxification or

maintenance treatment program to which a disclosure

will be made; and

(ii) The consent may authorize a disclosure to any

detoxification or maintenance treatment program

established within 200 miles of the program after the

consent is given without naming any such program.

(c) Use of information limited to prevention of

multiple enrollments. A central registry and any

detoxification or maintenance treatment program to

which information is disclosed to prevent multiple

enrollments may not redisclose or use patient
A-17

identifying information for any purpose other than

the prevention of multiple enrollments unless

authorized by a court order under subpart E of these

regulations. 

(d) Permitted disclosure by a central registry to

prevent a multiple enrollment. When a member

program asks a central registry if an identified patient

is enrolled in another member program and the

registry determines that the patient is so enrolled, the

registry may disclose—

(1) The name, address, and telephone number of the

member program(s) in which the patient is already

enrolled to the inquiring member program; and 

(2) The name, address, and telephone number of the

inquiring member program to the member program(s) in

which the patient is already enrolled. The member

programs may communicate as necessary to verify that

no error has been made and to prevent or eliminate any

multiple enrollment.

(e) Permitted disclosure by a detoxification or

maintenance treatment program to prevent a

multiple enrollment. A detoxification or maintenance

treatment program which has received a disclosure

under this section and has determined that the patient

is already enrolled may communicate as necessary

with the program making the disclosure to verify that

no error has been made and to prevent or eliminate

any multiple enrollment.

§ 2.35 Disclosures to elements of the criminal

justice system which have referred patients.

(a) A program may disclose information about a

patient to those persons within the criminal justice

system which have made participation in the program

a condition of the disposition of any criminal

proceedings against the patient or of the patient’s

parole or other release from custody if:

(1) The disclosure is made only to those individuals

within the criminal justice system who have a need for

the information in connection with their duty to

monitor the patient’s progress (e.g., a prosecuting

attorney who is withholding charges against the

patient, a court granting pretrial or posttrial release,

probation or parole officers responsible for supervision

of the patient); and (2) The patient has signed a

written consent meeting the requirements of § 2.31

(except paragraph (a)(8) which is inconsistent with the

revocation provisions of paragraph (c) of this section)

and the requirements of paragraphs (b) and (c) of this

section.

(b) Duration of consent. The written consent must

state the period during which it remains in effect.

This period must be reasonable, taking into account:

(1) The anticipated length of the treatment;

(2) The type of criminal proceeding involved, the

need for the information in connection with the final

disposition of that proceeding, and when the final

disposition will occur; and

(3) Such other factors as the program, the patient,

and the person(s) who will receive the disclosure

consider pertinent.

(c) Revocation of consent. The written consent must

state that it is revocable upon the passage of a

specified amount of time or the occurrence of a

specified, ascertainable event. The time or

occurrence upon which consent becomes revocable

may be no later than the final disposition of the

conditional release or other action in connection with

which consent was given.

(d) Restrictions on redisclosure and use. A person

who receives patient information under this section

may redisclose and use it only to carry out that

person’s official duties with regard to the patient’s

conditional release or other action in connection with

which the consent was given.

Subpart D—Disclosures Without Patient

Consent

§ 2.51 Medical emergencies.

(a) General Rule. Under the procedures required

by paragraph (c) of this section, patient identifying

information may be disclosed to medical personnel

who have a need for information about a patient

for the purpose of treating a condition which poses

an immediate threat to the health of any individual

and which requires immediate medical intervention.

(b) Special Rule. Patient identifying information

may be disclosed to medical personnel of the Food

and Drug Administration (FDA) who assert a

reason to believe that the health of any individual

may be threatened by an error in the manufacture,

labeling, or sale of a product under FDA

jurisdiction, and that the information will be used

for the exclusive purpose of notifying patients or
A-18

their physicians of potential dangers.

(c) Procedures. Immediately following disclosure, the

program shall document the disclosure in the

patient’s records, setting forth in writing:

(1) The name of the medical personnel to whom

disclosure was made and their affiliation with any

health care facility;

(2) The name of the individual making the disclosure;

(3) The date and time of the disclosure; and

(4) The nature of the emergency (or error, if the

report was to FDA).

(Approved by the Office of Management and Budget

 under control number 0930–0099)

§ 2.52 Research activities.

(a) Patient identifying information may be disclosed

for the purpose of conducting scientific research if

the program director makes a determination that the

recipient of the patient identifying information:

(1) Is qualified to conduct the research;

(2) Has a research protocol under which the patient

identifying information:

(i) Will be maintained in accordance with the security

requirements of § 2.16 of these regulations (or more

stringent requirements); and

(ii) Will not be redisclosed except as permitted under

paragraph (b) of this section; and

(3) Has provided a satisfactory written statement

that a group of three or more individuals who are

independent of the research project has reviewed

the protocol and determined that:

(i) The rights and welfare of patients will be

adequately protected; and

(ii) The risks in disclosing patient identifying

information are outweighed by the potential benefits

of the research.

(b) A person conducting research may disclose

patient identifying information obtained under

paragraph (a) of this section only back to the

program from which that information was obtained

and may not identify any individual patient in any

report of that research or otherwise disclose patient

identities.

[52 FR 21809, June 9, 1987, as amended at 52 FR

41997, Nov. 2, 1987]

§ 2.53 Audit and evaluation activities.

(a) Records not copied or removed. If patient

records are not copied or removed, patient identifying

information may be disclosed in the course of a

review of records on program premises to any person

who agrees in writing to comply with the limitations

on redisclosure and use in paragraph (d) of this

section and who:

(1) Performs the audit or evaluation activity on behalf

of:

(i) Any Federal, State, or local governmental agency

which provides financial assistance to the program or is

authorized by law to regulate its activities; or

(ii) Any private person which provides financial

assistance to the program, which is a third party payer

covering patients in the program, or which is a peer

review organization performing a utilization or quality

control review; or
A-19

(2) Is determined by the program director to be

qualified to conduct the audit or evaluation activities.

(b) Copying or removal of records. Records

containing patient identifying information may be

copied or removed from program premises by any

person who:

(1) Agrees in writing to:

(i) Maintain the patient identifying information in

accordance with the security requirements provided in

§ 2.16 of these regulations (or more stringent requirements);

(ii) Destroy all the patient identifying information upon

completion of the audit or evaluation; and

(iii) Comply with the limitations on disclosure and use in

paragraph (d) of this section; and

(2) Performs the audit or evaluation activity on behalf

of:

(i) Any Federal, State, or local governmental agency

which provides financial assistance to the program or is

authorized by law to regulate its activities; or

(ii) Any private person which provides financial

assistance to the program, which is a third part payer

covering patients in the program, or which is a peer

review organization performing a utilization or quality

control review.

(c) Medicare or Medicaid audit or evaluation. (1)

For purposes of Medicare or Medicaid audit or

evaluation under this section, audit or evaluation

includes a civil or administrative investigation of the

program by any Federal, State, or local agency

responsible for oversight of the Medicare or Medicaid

program and includes administrative enforcement,

against the program by the agency, of any remedy

authorized by law to be imposed as a result of the

findings of the investigation.

(2) Consistent with the definition of program in § 2.11,

program includes an employee of, or provider of medical

services under, the program when the employee or

provider is the subject of a civil investigation or

administrative remedy, as those terms are used in

paragraph (c)(1) of this section.

(3) If a disclosure to a person is authorized under this

section for a Medicare or Medicaid audit or evaluation,

including a civil investigation or administrative remedy,

as those terms are used in paragraph (c)(1) of this

section, then a peer review organization which obtains

the information under paragraph (a) or (b) may disclose

the information to that person but only for purposes of

Medicare or Medicaid audit or evaluation.

(4) The provisions of this paragraph do not authorize

the agency, the program, or any other person to

disclose or use patient identifying information obtained

during the audit or evaluation for any purposes other than

those necessary to complete the Medicare or Medicaid audit or

evaluation activity as specified in this paragraph.

(d) Limitations on disclosure and use. Except as

provided in paragraph (c) of this section, patient

identifying information disclosed under this section

may be disclosed only back to the program from

which it was obtained and used only to carry out an

audit or evaluation purpose or to investigate or

prosecute criminal or other activities, as authorized

by a court order entered under § 2.66 of these

regulations.

Subpart E—Court Orders

Authorizing Disclosure and Use

§ 2.61 Legal effect of order.

(a) Effect. An order of a court of competent

jurisdiction entered under this subpart is a unique

kind of court order. Its only purpose is to authorize

a disclosure or use of patient information which

would otherwise be prohibited by 42 U.S.C.

290ee–3, 42 U.S.C. 290dd–3 and these regulations.

Such an order does not compel disclosure. A

subpoena or a similar legal mandate must be issued in

order to compel disclosure. This mandate may be

entered at the same time as and accompany an

authorizing court order entered under these

regulations.

(b) Examples. (1) A person holding records subject

to these regulations receives a subpoena for those

records: a response to the subpoena is not permitted

under the regulations unless an authorizing court

order is entered. The person may not disclose the

records in response to the subpoena unless a court of

competent jurisdiction enters an authorizing order

under these regulations.

(2) An authorizing court order is entered under

these regulations, but the person authorized does

not want to make the disclosure. If there is no

subpoena or other compulsory process or a

subpoena for the records has expired or been

quashed, that person may refuse to make the

disclosure. Upon the entry of a valid subpoena or

other compulsory process the person authorized to

disclose must disclose, unless there is a valid legal

defense to the process other than the confi-
A-20

dentiality restrictions of these regulations.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987]

§ 2.62 Order not applicable to records disclosed

without consent to researchers, auditors and

evaluators.

A court order under these regulations may not

authorize qualified personnel, who have received

patient identifying information without consent for

the purpose of conducting research, audit or

evaluation, to disclose that information or use it to

conduct any criminal investigation or prosecution

of a patient. However, a court order under § 2.66

may authorize disclosure and use of records to

investigate or prosecute qualified personnel holding

the records.

§ 2.63 Confidential communications.

(a) A court order under these regulations may

authorize disclosure of confidential

communications made by a patient to a program in

the course of diagnosis, treatment, or referral for

treatment only if:

(1) The disclosure is necessary to protect against

an existing threat to life or of serious bodily

injury, including circumstances which constitute

suspected child abuse and neglect and verbal

threats against third parties;

(2) The disclosure is necessary in connection

with investigation or prosecution of an extremely

serious crime, such as one which directly

threatens loss of life or serious bodily injury,

including homicide, rape, kidnaping, armed

robbery, assault with a deadly weapon, or child

abuse and neglect; or

(3) The disclosure is in connection with litigation

or an administrative proceeding in which the

patient offers testimony or other evidence

pertaining to the content of the confidential

communications.

(b) [Reserved]

§ 2.64 Procedures and criteria for orders

authorizing disclosures for noncriminal

purposes.

(a) Application. An order authorizing the disclosure

of patient records for purposes other than criminal

investigation or prosecution may be applied for by

any person having a legally recognized interest in

the disclosure which is sought. The application may

be filed separately or as part of a pending civil

action in which it appears that the patient records

are needed to provide evidence. An application

must use a fictitious name, such as John Doe, to

refer to any patient and may not contain or

otherwise disclose any patient identifying

information unless the patient is the applicant or

has given a written consent (meeting the

requirements of these regulations) to disclosure or

the court has ordered the record of the proceeding

sealed from public scrutiny.

(b) Notice. The patient and the person holding the

records from whom disclosure is sought must be

given:

(1) Adequate notice in a manner which will not

disclose patient identifying information to other

persons; and

(2) An opportunity to file a written response to

the application, or to appear in person, for the

limited purpose of providing evidence on the

statutory and regulatory criteria for the issuance

of the court order.
A-21

(c) Review of evidence: Conduct of hearing. Any

oral argument, review of evidence, or hearing on

the application must be held in the judge’s

chambers or in some manner which ensures that

patient identifying information is not disclosed to

anyone other than a party to the proceeding, the

patient, or the person holding the record, unless the

patient requests an open hearing in a manner which

meets the written consent requirements of these

regulations. The proceeding may include an

examination by the judge of the patient records

referred to in the application.

(d) Criteria for entry of order. An order under this

section may be entered only if the court determines

that good cause exists. To make this determination

the court must find that:

(1) Other ways of obtaining the information are

not available or would not be effective; and

(2) The public interest and need for the

disclosure outweigh the potential injury to the

patient, the physician-patient relationship and

the treatment services.

(e) Content of order. An order authorizing a

disclosure must:

(1) Limit disclosure to those parts of the patient’s

record which are essential to fulfill the objective

of the order;

(2) Limit disclosure to those persons whose need

for information is the basis for the order; and

(3) Include such other measures as are

necessary to limit disclosure for the protection of

the patient, the physician patient relationship and

the treatment services; for example, sealing

from public scrutiny the record of any proceeding

for which disclosure of a patient’s record has been

ordered.

§ 2.65 Procedures and criteria for orders

authorizing disclosure and use of records to

criminally investigate or prosecute patients.

(a) Application. An order authorizing the

disclosure or use of patient records to criminally

investigate or prosecute a patient may be applied

for by the person holding the records or by any

person conducting investigative or prosecutorial

activities with respect to the enforcement of

criminal laws. The application may be filed

separately, as part of an application for a subpoena

or other compulsory process, or in a pending

criminal action. An application must use a fictitious

name such as John Doe, to refer to any patient and

may not contain or otherwise disclose patient

identifying information unless the court has ordered

the record of the proceeding sealed from public

scrutiny.

(b) Notice and hearing. Unless an order under §

2.66 is sought with an order under this section, the

person holding the records must be given:

(1) Adequate notice (in a manner which will not

disclose patient identifying information to third

parties) of an application by a person performing

a law enforcement function;

(2) An opportunity to appear and be heard for the

limited purpose of providing evidence on the

statutory and regulatory criteria for the issuance

of the court order; and

(3) An opportunity to be represented by counsel

independent of counsel for an applicant who is a

person performing a law enforcement function.

(c) Review of evidence: Conduct of hearings. Any

oral argument, review of evidence, or hearing on

the application shall be held in the judge’s

chambers or in some other manner which ensures

that patient identifying information is not disclosed

to anyone other than a party to the proceedings, the

patient, or the person holding the records. The

proceeding may include an examination by the

judge of the patient records referred to in the

application.

(d) Criteria. A court may authorize the disclosure

and use of patient records for the purpose of

conducting a criminal investigation or prosecution

of a patient only if the court finds that all of the

following criteria are met:

(1) The crime involved is extremely serious, such

as one which causes or directly threatens loss of

life or serious bodily injury including homicide,

rape, kidnaping, armed robbery, assault with a

deadly weapon, and child abuse and neglect.

(2) There is a reasonable likelihood that the

records will disclose information of substantial

value in the investigation or prosecution.

(3) Other ways of obtaining the information are

not available or would not be effective.
A-22

(4) The potential injury to the patient, to the

physician-patient relationship and to the

ability of the program to provide services to

other patients is outweighed by the public

interest and the need for the disclosure.

(5) If the applicant is a person performing a law

enforcement function that:

(i) The person holding the records has been

afforded the opportunity to be represented by

independent counsel; and

(ii) Any person holding the records which is an

entity within Federal, State, or local government

has in fact been represented by counsel

independent of the applicant.

(e) Content of order. Any order authorizing a

disclosure or use of patient records under this

section must:

(1) Limit disclosure and use to those parts of the

patient’s record which are essential to fulfill the

objective of the order;

(2) Limit disclosure to those law enforcement and

prosecutorial officials who are responsible for, or

are conducting, the investigation or prosecution,

and limit their use of the records to investigation

and prosecution of extremely serious crime or

suspected crime specified in the application; and

(3) Include such other measures as are

necessary to limit disclosure and use to the

fulfillment of only that public interest and need

found by the court.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987]

§ 2.66 Procedures and criteria for orders

authorizing disclosure and use of records to

investigate or prosecute a program or the

person holding the records.

(a) Application. (1) An order authorizing the

disclosure or use of patient records to criminally or

administratively investigate or prosecute a program

or the person holding the records (or employees or

agents of that program or person) may be applied

for by any administrative, regulatory, supervisory,

investigative, law enforcement, or prosecutorial

agency having jurisdiction over the program’s or

person’s activities.

(2) The application may be filed separately or as

part of a pending civil or criminal action against a

program or the person holding the records (or

agents or employees of the program or person) in

which it appears that the patient records are

needed to provide material evidence. The

application must use a fictitious name, such as

John Doe, to refer to any patient and may not

contain or otherwise disclose any patient

identifying information unless the court has

ordered the record of the proceeding sealed from

public scrutiny or the patient has given a written

consent (meeting the requirements of § 2.31 of

these regulations) to that disclosure.

(b) Notice not required. An application under this

section may, in the discretion of the court, be

granted without notice. Although no express notice

is required to the program, to the person holding

the records, or to any patient whose records are to

be disclosed, upon implementation of an order so

granted any of the above persons must be afforded

an opportunity to seek revocation or amendment of

that order, limited to the presentation of evidence

on the statutory and regulatory criteria for the

issuance of the court order.

(c) Requirements for order. An order under this

section must be entered in accordance with, and

comply with the requirements of, paragraphs (d)

and (e) of § 2.64 of these regulations.

(d) Limitations on disclosure and use of patient

identifying information:

(1) An order entered under this section must

require the deletion of patient identifying

information from any documents made available

to the public.

(2) No information obtained under this section

may be used to conduct any investigation or

prosecution of a patient, or be used as the basis

for an application for an order under § 2.65 of

these regulations.

§ 2.67 Orders authorizing the use of undercover

agents and informants to criminally investigate

employees or agents of a program.

(a) Application. A court order authorizing the

placement of an undercover agent or informant in a

program as an employee or patient may be applied
A-23

for by any law enforcement or prosecutorial

agency which has reason to believe that employees

or agents of the program are engaged in criminal

misconduct.

(b) Notice. The program director must be given

adequate notice of the application and an

opportunity to appear and be heard (for the limited

purpose of providing evidence on the statutory and

regulatory criteria for the issuance of the court

order), unless the application asserts a belief that:

(1) The program director is involved in the

criminal activities to be investigated by the

undercover agent or informant; or

(2) The program director will intentionally or

unintentionally disclose the proposed placement

of an undercover agent or informant to the

employees or agents who are suspected of

criminal activities.

(c) Criteria. An order under this section may be

entered only if the court determines that good

cause exists. To make this determination the court

must find:

(1) There is reason to believe that an employee

or agent of the program is engaged in criminal

activity;

(2) Other ways of obtaining evidence of this

criminal activity are not available or would not be

effective; and

(3) The public interest and need for the

placement of an undercover agent or informant in

the program outweigh the potential injury to

patients of the program, physician-patient

relationships and the treatment services.

(d) Content of order. An order authorizing the

placement of an undercover agent or informant in a

program must:

(1) Specifically authorize the placement of an

undercover agent or an informant;

(2) Limit the total period of the placement to six

months;

(3) Prohibit the undercover agent or informant

from disclosing any patient identifying

information obtained from the placement except

as necessary to criminally investigate or

prosecute employees or agents of the program;

and

(4) Include any other measures which are

appropriate to limit any potential disruption of

the program by the placement and any potential

for a real or apparent breach of patient

confidentiality; for example, sealing from public

scrutiny the record of any proceeding for which

disclosure of a patient’s record has been ordered.

(e) Limitation on use of information. No

information obtained by an undercover agent or

informant placed under this section may be used to

criminally investigate or prosecute any patient or as

the basis for an application for an order under §

2.65 of these regulations.
A-23
A-2

Appendix A—The Federal Confidentiality Law

and Regulations
A-3

SUBCHAPTER A—GENERAL PROVISIONS

PART 1 [RESERVED]

PART 2—CONFIDENTIALITY OF

ALCOHOL AND DRUG ABUSE

PATIENT RECORDS 

Subpart A—Introduction

Sec.

2.2 Statutory authority for confidentiality of

alcohol abuse patient records.

2.3 Purpose and effect.

2.4 Criminal penalty for violation.

2.5 Reports of violations.

Subpart B—General Provisions

2.11 Definitions.

2.12 Applicability.

2.13 Confidentiality restrictions.

2.14 Minor patients.

2.15 Incompetent and deceased patients.

2.16 Security for written records.

2.17 Undercover agents and informants.

2.18 Restrictions on the use of identification

cards.

2.19 Disposition of records by discontinued programs.

2.20 Relationship to State laws.

2.21 Relationship to Federal statutes protecting

research subjects against compulsory disclosure of their identity.

2.22 Notice to patients of Federal confidentiality

requirements.

2.23 Patient access and restriction on use.

Subpart C—Disclosures With Patient’s Consent

2.31 Form of written consent.

2.32 Prohibition on redisclosure.

2.33 Disclosures permitted with written consent.

2.34 Disclosures to prevent multiple enrollments in

detoxification and maintenance treatment

programs.

2.35 Disclosures to elements of the criminal justice

system which have referred patients.

Subpart D—Disclosures Without Patient

Consent

2.51 Medical emergencies.

2.52 Research activities.

2.53 Audit and evaluation activities.

Subpart E—Court Orders Authorizing

Disclosures and Use

2.61 Legal effect of order.

2.62 Order not applicable to records disclosed

without consent to researchers, auditors

and evaluators.

2.63 Confidential communications.

2.64 Procedures and criteria for orders

authorizing disclosures for noncriminal

purposes.

2.65 Procedures and criteria for orders

authorizing disclosure and use of records to

criminally investigate or prosecute patients.

2.66 Procedures and criteria for orders

authorizing disclosure and use of records to

investigate or prosecute a program or the

person holding the records.

 2.67 Orders authorizing the use of undercover

agents and informants to criminally

investigate employees or agents of a

program.

AUTHORITY: Sec. 408 of Pub. L. 92–255, 86

Stat. 79, as amended by sec. 303 (a), (b) of Pub L.

93–282, 83 Stat. 137, 138; sec. 4(c)(5)(A) of Pub. L.

94–237, 90 Stat. 244; sec. 111(c)(3) of Pub. L. 94–581,

90 Stat. 2852; sec. 509 of Pub. L. 96–88, 93 Stat. 695;

sec. 973(d) of Pub. L. 97– 35, 95 Stat. 598; and

transferred to sec. 527 of the Public Health Service Act

by sec. 2(b)(16)(B) of Pub. L. 98–24, 97 Stat. 182 and

as amended by sec. 106 of Pub. L. 99–401, 100 Stat.

907 (42 U.S.C. 290ee–3) and sec. 333 of Pub. L.

91–616, 84 Stat. 1853, as amended by sec. 122(a) of

Pub. L. 93–282, 88 Stat. 131; and sec. 111(c)(4) of Pub.

L. 94–581, 90 Stat. 2852 and transferred to sec. 523 of

the Public Health Service Act by sec. 2(b)(13) of Pub. L.

98–24, 97 Stat. 181 and as amended by sec. 106 of Pub.

L. 99–401, 100 Stat. 907 (42 U.S.C. 290dd–3), as

amended by sec. 131 of Pub. L. 102–321, 106 Stat. 368,

(42 U.S.C. 290dd–2).
SOURCE: 52 FR 21809, June 9, 1987, unless

otherwise noted. 

Subpart A—Introduction

§ 2.1 Statutory authority for confidentiality of

drug abuse patient records. 

The restrictions of these regulations upon

the disclosure and use of drug abuse patient

records were initially authorized by section 408

of the Drug Abuse Prevention, Treatment, and

Rehabilitation Act (21 U.S.C. 1175). That

section as amended was transferred by Pub. L.

98–24 to section 527 of the Public Health

Service Act which is codified at 42 CFR Ch. I

(10-1-97 Edition § 2.2 at 42 U.S.C. 290ee–3. The

amended statutory authority is set forth below:

§ 290ee–3. CONFIDENTIALITY OF PATIENT

RECORDS.

(a) Disclosure authorization 

Records of the identity, diagnosis, prognosis, or

treatment of any patient which are maintained in

connection with the performance of any drug abuse

prevention function conducted, regulated, or directly or

indirectly assisted by any department or agency of the

United States shall, except as provided in subsection (e)

of this section, be confidential and be disclosed only for

the purposes and under the circumstances

 expressly authorized under subsection (b) of this

section.

(b) Purposes and circumstances of disclosure

affecting consenting patient and patient regardless

of consent

(1) The content of any record referred to in

subsection (a) of this section may be disclosed in

accordance with the prior written consent of the

patient with respect to whom such record is

maintained, but only to such extent, under such

circumstances, and for such purposes as may be

allowed under regulations prescribed pursuant to

subsection (g) of this section.

(2) Whether or not the patient, with respect to

whom any given record referred to in subsection (a) of

this section is maintained, gives his written consent,

the content of such record may be disclosed as

follows:

(A) To medical personnel to the extent necessary

to meet a bona fide medical emergency.

(B) To qualified personnel for the purpose of

conducting scientific research, management audits,

financial audits, or program evaluation, but such

personnel may not identify, directly or indirectly, any

individual patient in any report of such research, audit,

or evaluation, or otherwise disclose patient identities

in any manner.

(C) If authorized by an appropriate order of a court of

competent jurisdiction granted after application

showing good cause therefor. In assessing good cause

the court shall weigh the public interest and the need

for disclosure against the injury to the patient, to the

physician patient relationship, and to the treatment

services. Upon the granting of such order, the court, in

determining the extent to which any disclosure of all

or any part of any record is necessary, shall impose

appropriate safeguards against unauthorized

disclosure.

(c) Prohibition against use of record in making

criminal charges or investigation of patient

Except as authorized by a court order granted under

subsection (b)(2)(C) of this section, no record referred

to in subsection (a) of this section may be used to

initiate or substantiate any criminal charges against a

patient or to

 conduct any investigation of a patient.

(d) Continuing prohibition against disclosure

irrespective of status as patient

The prohibitions of this section continue to apply to

records concerning any individual who has been a

patient, irrespective of whether or when he ceases to be

a patient.

(e) Armed Forces and Veterans’ Administration;

interchange of records; report of suspected child

abuse and neglect to State or local authorities

The prohibitions of this section do not apply to any

interchange of records—

(1) within the Armed Forces or within those components

of the Veterans’ Administration furnishing health care to

veterans, or

(2) between such components and the Armed Forces.

The prohibitions of this section do not apply to the

reporting under State law of incidents of suspected child

abuse and neglect to the appropriate State or local

authorities.

(f) Penalty for first and subsequent offenses 

Any person who violates any provision of this section or

any regulation issued pursuant to this section shall be

fined not more than $500 in the case of a first offense,

and not more than $5,000 in the case of each subsequent

offense.

(g) Regulations; interagency consultations;

definitions, safeguards, and procedures, including

procedures and criteria for issuance and scope of

orders

Except as provided in subsection (h) of this section, the

Secretary, after consultation with the Administrator of

Veterans’ Affairs and the heads of other Federal

departments and agencies substantially affected thereby,
A-5

shall prescribe regulations to carry out the purposes of

this section. These regulations may contain such

definitions, and may provide for such safeguards and

procedures, including procedures and criteria for the

issuance and scope of orders under subsection (b)(2)(C)

of this section, as in the judgment of the Secretary are

necessary or proper to effectuate the purposes of this

section, to prevent circumvention or evasion thereof, or

to facilitate compliance therewith.

(Subsection (h) was superseded by section 111(c)(3) of

Pub. L. 94–581. The responsibility of the Administrator

of Veterans’ Affairs to write regulations to provide for

confidentiality of drug abuse patient records under Title

38 was moved from 21 U.S.C. 1175 to 38 U.S.C. 4134.)

§ 2.2 Statutory authority for confidentiality of

alcohol abuse patient records.

The restrictions of these regulations upon the

disclosure and use of alcohol abuse patient records

were initially authorized by section 333 of the

Comprehensive Alcohol Abuse and Alcoholism

Prevention, Treatment, and Rehabilitation Act of

1970 (42 U.S.C. 4582). The section as amended was

transferred by Pub. L. 98–24 to section 523 of the

Public Health Service Act which is codified at 42

U.S.C. 290dd–3. The amended statutory authority is

set forth below:

§ 290dd–3. CONFIDENTIALITY OF PATIENT

RECORDS

(a) Disclosure authorization 

Records of the identity, diagnosis, prognosis, or

treatment of any patient which are maintained in

connection with the performance of any program or

activity relating to alcoholism or alcohol abuse

education, training, treatment, rehabilitation, or

research, which is conducted, regulated, or directly or

indirectly assisted by any department or agency of the

United States shall, except as provided in subsection

(e) of this section, be confidential and be disclosed

only for the purposes and under the circumstances

expressly authorized under subsection (b) of this

section.

(b) Purposes and circumstances of disclosure

affecting consenting patient and patient regardless

of consent

(1) The content of any record referred to in

subsection (a) of this section may be disclosed in

accordance with the prior written consent of the

patient with respect to whom such record is

maintained, but only to such extent, under such

circumstances, and for such purposes as may be

allowed under regulations prescribed pursuant to

subsection (g) of this section.

(2) Whether or not the patient, with respect to whom

any given record referred to in subsection (a) of this

section is maintained, gives his written consent, the

content of such record may be disclosed as follows:

(A) To medical personnel to the extent necessary to

meet a bona fide medical emergency.

(B) To qualified personnel for the purpose of

conducting scientific research, management audits,

financial audits, or program evaluation, but such

personnel may not identify, directly or indirectly, any

individual patient in any report of such research, audit,

or evaluation, or otherwise disclose patient identities

in any manner.

(C) If authorized by an appropriate order of a court of

competent jurisdiction granted after application

showing good cause therefor. In assessing good cause

the court shall weigh the public interest and the need

for disclosure against the injury to the patient, to the

physician patient relationship, and to the treatment

services. Upon the granting of such order, the court, in

determining the extent to which any disclosure of all

or any part of any record is necessary, shall impose

appropriate safeguards against unauthorized

disclosure. 

(c) Prohibition against use of record in making

criminal charges or investigation of patient

Except as authorized by a court order granted under

subsection (b)(2)(C) of this section, no record

referred to in subsection (a) of this section may be

used to initiate or substantiate any criminal charges

against a patient or to conduct any investigation of a

patient.

(d) Continuing prohibition against disclosure

irrespective of status as patient

The prohibitions of this section continue to apply to

records concerning any individual who has been a

patient, irrespective of whether or when he ceases to

be a patient.

(e) Armed Forces and Veterans’ Administration;

interchange of record of suspected child abuse and

neglect to State or local authorities

The prohibitions of this section do not apply to any

interchange of records—

(1) within the Armed Forces or within those

components of the Veterans’ Administration

furnishing health care to veterans, or

(2) between such components and the Armed Forces.

The prohibitions of this section do not apply to the

reporting under State law of incidents of suspected

child abuse and neglect to the appropriate State or

local authorities.
A-6

(f) Penalty for first and subsequent offenses

Any person who violates any provision of this section

or any regulation issued pursuant to this section shall

be fined not more than $500 in the case of a first

offense, and not more than $5,000 in the case of each

subsequent offense.

(g) Regulations of Secretary; definitions,

safeguards, and procedures, including procedures

and criteria for issuance and scope of orders

Except as provided in subsection (h) of this section,

the Secretary shall prescribe regulations to carry out

the purposes of this section. These regulations may

contain such definitions, and may provide for such

safeguards and procedures, including procedures and

criteria for the issuance and scope of orders under

subsection(b)(2)(C) of this section, as in the judgment

of the Secretary are necessary or proper to effectuate

the purposes of this section, to prevent circumvention

or evasion thereof, or to facilitate compliance

therewith.

(Subsection (h) was superseded by section 111(c)(4)

of Pub. L. 94–581. The responsibility of the

Administrator of Veterans’ Affairs to write

regulations to provide for confidentiality of alcohol

abuse patient records under Title 38 was moved from

42 U.S.C. 4582 to 38 U.S.C. 4134.)

§ 2.3 Purpose and effect.

(a) Purpose. Under the statutory provisions quoted in

§§ 2.1 and 2.2, these regulations impose restrictions

upon the disclosure and use of alcohol and drug abuse

patient records which are maintained in connection

with the performance of any federally assisted alcohol

and drug abuse program. The regulations specify:

(1) Definitions, applicability, and general

restrictions in subpart B (definitions applicable to §

2.34 only appear in that section);

(2) Disclosures which may be made with written

patient consent and the form of the written consent

in subpart C;

(3) Disclosures which may be made without

written patient consent or an authorizing court

order in subpart D; and

(4) Disclosures and uses of patient records which

may be made with an authorizing court order and

the procedures and criteria for the entry and scope

of those orders in subpart E.

(b) Effect. (1) These regulations prohibit the

disclosure and use of patient records unless certain

circumstances exist. If any circumstances exists under

which disclosure is permitted, that circumstance acts

to remove the prohibition on disclosure but it does not

compel disclosure. Thus, the regulations do not

require disclosure under any circumstances.

(2) These regulations are not intended to direct the

manner in which substantive functions such as

research, treatment, and evaluation are carried out.

They are intended to insure that an alcohol or drug

abuse patient in a federally assisted alcohol or drug

abuse program is not made more vulnerable by

reason of the availability of his or her patient record

than an individual who has an alcohol or drug

problem and who does not seek treatment.

(3) Because there is a criminal penalty (a fine—see

42 U.S.C. 290ee–3(f), 42 U.S.C. 290dd–3(f) and

42 CFR 2.4) for violating the regulations, they are

to be construed strictly in favor of the potential

violator in the same manner as a criminal statute

(see M. Kraus & Brothers v. United States, 327

U.S. 614, 621–22, 66 S. Ct. 705, 707–08 (1946)).

§ 2.4 Criminal penalty for violation.

Under 42 U.S.C. 290ee–3(f) and 42 U.S.C.

290dd–3(f), any person who violates any provision

of those statutes or these regulations shall be fined

not more than $500 in the case of a first offense,

and not more than $5,000 in the case of each

subsequent offense.

§ 2.5 Reports of violations.

(a) The report of any violation of these regulations

may be directed to the United States Attorney for

the judicial district in which the violation occurs.

(b) The report of any violation of these regulations

by a methadone program may be directed to the

Regional Offices of the Food and Drug

Administration.

Subpart B—General Provisions

§ 2.11 Definitions.

For purposes of these regulations: 

Alcohol abuse means the use of an alcoholic

beverage which impairs the physical, mental,

emotional, or social well-being of the user. 

Drug abuse means the use of a psychoactive

substance for other than medicinal purposes which

impairs the physical, mental, emotional, or social

well-being of the user. 

Diagnosis means any reference to an individual’s

alcohol or drug abuse or to a condition which is
A-7

identified as having been caused by that abuse

which is made for the purpose of treatment or

referral for treatment.

Disclose or disclosure means a communication of

patient identifying information, the affirmative

verification of another person’s communication of

patient identifying information, or the

communication of any information from the record

of a patient who has been identified.

Informant means an individual: 

(a) Who is a patient or employee of a program or

who becomes a patient or employee of a program

at the request of a law enforcement agency or

official: and

(b) Who at the request of a law enforcement

agency or official observes one or more patients or

employees of the program for the purpose of

reporting the information obtained to the law

enforcement agency or official.

Patient means any individual who has applied for

or been given diagnosis or treatment for alcohol or

drug abuse at a federally assisted program and

includes any individual who, after arrest on a

criminal charge, is identified as an alcohol or drug

abuser in order to determine that individual’s

eligibility to participate in a program.

Patient identifying information means the name,

address, social security number, fingerprints,

photograph, or similar information by which the

identity of a patient can be determined with

reasonable accuracy and speed either directly or by

reference to other publicly available information.

The term does not include a number assigned to a

patient by a program, if that number does not

consist of, or contain numbers (such as a social

security, or driver’s license number) which could

be used to identify a patient with reasonable

accuracy and speed from sources external to the

program.

Person means an individual, partnership,

corporation, Federal, State or local government

agency, or any other legal entity.

Program means:

(a) An individual or entity (other than a general

medical care facility) who holds itself out as

providing, and provides, alcohol or drug abuse

diagnosis, treatment or referral for treatment; or

(b) An identified unit within a general medical

facility which holds itself out as providing, and

provides, alcohol or drug abuse diagnosis,

treatment or referral for treatment; or

(c) Medical personnel or other staff in a general

medical care facility whose primary function is the

provision of alcohol or drug abuse diagnosis,

treatment or referral for treatment and who are

identified as such providers. (See § 2.12(e)(1) for

examples.)

Program director means:

(a) In the case of a program which is an individual,

that individual:

(b) In the case of a program which is an

organization, the individual designated as director,

managing director, or otherwise vested with

authority to act as chief executive of the

organization.
A-8

Qualified Service Organization means a

person which:

(a) Provides services to a program, such as data

processing, bill collecting, dosage preparation,

laboratory analyses, or legal, medical, accounting,

or other professional services, or services to

prevent or treat child abuse or neglect, including

training on nutrition and child care and individual

and group therapy, and

(b) Has entered into a written agreement with a

program under which that person:

(1) Acknowledges that in receiving, storing,

processing or otherwise dealing with any patient

records from the programs, it is fully bound by

these regulations; and

(2) If necessary, will resist in judicial proceedings

any efforts to obtain access to patient records

except as permitted by these regulations.

Records means any information, whether recorded

or not, relating to a patient received or acquired by

a federally assisted alcohol or drug program.

Third party payer means a person who pays, or

agrees to pay, for diagnosis or treatment furnished

to a patient on the basis of a contractual

relationship with the patient or a member of his

family or on the basis of the patient’s eligibility for

Federal, State, or local governmental benefits.

Treatment means the management and care of a

patient suffering from alcohol or drug abuse, a

condition which is identified as having been caused

by that abuse, or both, in order to reduce or

eliminate the adverse effects upon the patient.

Undercover agent means an officer of any

Federal, State, or local law enforcement agency who

enrolls in or becomes an employee of a program for

the purpose of investigating a suspected violation of

law or who pursues that purpose after enrolling or

becoming employed for other purposes. 

[52 FR 21809, June 9, 1987, as amended by 60 FR

22297, May 5, 1995]

§ 2.12 Applicability.

(a) General—(1) Restrictions on disclosure. The

restrictions on disclosure in these regulations apply

to any information, whether or not recorded, which:

(i) Would identify a patient as an alcohol or drug

abuser either directly, by reference to other publicly

available information, or through verification of

such an identification by another person; and

(ii) Is drug abuse information obtained by a

federally assisted drug abuse program after March

20, 1972, or is alcohol abuse information obtained

by a federally assisted alcohol abuse program after

May 13, 1974 (or if obtained before the pertinent

date, is maintained by a federally assisted alcohol or

drug abuse program after that date as part of an

ongoing treatment episode which extends past that

date) for the purpose of treating alcohol or drug

abuse, making a diagnosis for that treatment, or

making a referral for that treatment.

(2) Restriction on use. The restriction on use of

information to initiate or substantiate any criminal

charges against a patient or to conduct any criminal

investigation of a patient (42 U.S.C. 290ee–3(c), 42

U.S.C. 290dd–3(c)) applies to any information,

whether or not recorded which is drug abuse

information obtained by a federally assisted drug

abuse program after March 20, 1972, or is alcohol

abuse information obtained by a federally assisted

alcohol abuse program after May 13, 1974 (or if

obtained before the pertinent date, is maintained by

a federally assisted alcohol or drug abuse program

after that date as part of an ongoing treatment

episode which extends past that date), for the

purpose of treating alcohol or drug abuse, making a

diagnosis for the treatment, or making a referral for

the treatment.

(b) Federal assistance. An alcohol abuse or drug

abuse program is considered to be federally assisted

if:

(1) It is conducted in whole or in part, whether

directly or by contract or otherwise by any

department or agency of the United States (but see

paragraphs (c)(1) and (c)(2) of this section relating

to the Veterans’ Administration and the Armed

Forces);

(2) It is being carried out under a license,

certification, registration, or other authorization

granted by any department or agency of the United

States including but not limited to:

(i) Certification of provider status under the

Medicare program;

(ii) Authorization to conduct methadone

maintenance treatment (see 21 CFR 291.505); or
A-9

(iii) Registration to dispense a substance under the

Controlled Substances Act to the extent the

controlled substance is used in the treatment of

alcohol or drug abuse;

(3) It is supported by funds provided by any

department or agency of the United States by

being:

(i) A recipient of Federal financial assistance in any

form, including financial assistance which does not

directly pay for the alcohol or drug abuse diagnosis,

treatment, or referral activities; or

(ii) Conducted by a State or local government unit

which, through general or special revenue sharing

or other forms of assistance, receives Federal funds

which could be (but are not necessarily) spent for

the alcohol or drug abuse program; or

(4) It is assisted by the Internal Revenue Service of

the Department of the Treasury through the

allowance of income tax deductions for

contributions to the program or through the

granting of tax exempt status to the program.

(c) Exceptions—(1) Veterans’ Administration.

These regulations do not apply to information on

alcohol and drug abuse patients maintained in

connection with the Veterans’ Administration

provisions of hospital care, nursing home care,

domiciliary care, and medical services under title

38, United States Code. Those records are

governed by 38 U.S.C. 4132 and regulations issued

under that authority by the Administrator of

Veterans’ Affairs.

(2) Armed Forces. These regulations apply to any

information described in paragraph (a) of this

section which was obtained by any component of

the Armed Forces during a period when the patient

was subject to the Uniform Code of Military

Justice except:

(i) Any interchange of that information within the

Armed Forces; and

(ii) Any interchange of that information between

the Armed Forces and those components of the

Veterans Administration furnishing health care to

veterans.

(3) Communication within a program or between

a program and an entity having direct

administrative control over that program. The

restrictions on disclosure in these regulations do not

apply to communications of information between

or among personnel having a need for the

information in connection with their duties that

arise out of the provision of diagnosis, treatment,

or referral for treatment of alcohol or drug abuse if

the communications are 

(i) Within a program or 

(ii) Between a program and an entity that has direct

administrative control over the program.

(4) Qualified Service Organizations. The

restrictions on disclosure in these regulations do not

apply to communications between a program and a

qualified service organization of information needed

by the organization to provide services to the

program.

(5) Crimes on program premises or against

program personnel. The restrictions on disclosure

and use in these regulations do not apply to

communications from program personnel to law

enforcement officers which—

(i) Are directly related to a patient’s commission of

a crime on the premises of the program or against

program personnel or to a threat to commit such a

crime; and

(ii) Are limited to the circumstances of the incident,

including the patient status of the individual

committing or threatening to commit the crime, that

individual’s name and address, and that individual’s

last known whereabouts.

(6) Reports of suspected child abuse and neglect.

The restrictions on disclosure and use in these

regulations do not apply to the reporting under

State law of incidents of suspected child abuse and

neglect to the appropriate State or local authorities.

However, the restrictions continue to apply to the

original alcohol or drug abuse patient records

maintained by the program including their

disclosure and use for civil or criminal proceedings

which may arise out of the report of suspected

child abuse and neglect.
A-10

(d) Applicability to recipients of information—(1)

Restriction on use of information. The restriction

on the use of any information subject to these

regulations to initiate or substantiate any criminal

charges against a patient or to conduct any criminal

investigation of a patient applies to any person who

obtains that information from a federally assisted

alcohol or drug abuse program, regardless of the

status of the person obtaining the information or of

whether the information was obtained in

accordance with these regulations. This restriction

on use bars, among other things, the introduction

of that information as evidence in a criminal

proceeding and any other use of the information to

investigate or prosecute a patient with respect to a

suspected crime. Information obtained by

undercover agents or informants (see § 2.17) or

through patient access (see § 2.23) is subject to the

restriction on use.

(2) Restrictions on disclosures—Third party

payers, administrative entities, and others. The

restrictions on disclosure in these regulations apply

to:

(i) Third party payers with regard to records

disclosed to them by federally assisted alcohol or

drug abuse programs;

(ii) Entities having direct administrative control

over programs with regard to information

communicated to them by the program under §

2.12(c)(3); and

(iii) Persons who receive patient records directly

from a federally assisted alcohol or drug abuse

program and who are notified of the restrictions on

redisclosure of the records in accordance with §

2.32 of these regulations.

(e) Explanation of applicability—(1) Coverage.

These regulations cover any information (including

information on referral and intake) about alcohol

and drug abuse patients obtained by a program (as

the terms ‘‘patient’’ and ‘‘program’’ are defined in

§ 2.11) if the program is federally assisted in any

manner described in § 2.12(b). Coverage includes,

but is not limited to, those treatment or

rehabilitation programs, employee assistance

programs, programs within general hospitals, based

programs, and private practitioners who hold

themselves out as providing, and provide alcohol or

drug abuse diagnosis, treatment, or referral for

treatment. However, these regulations would not

apply, for example, to emergency room personnel

who refer a patient to the intensive care unit for an

apparent overdose, unless the primary function of

such personnel is the provision of alcohol or drug

abuse diagnosis, treatment or referral and they are

identified as providing such services or the

emergency room has promoted itself to the

community as a provider of such services.

(2) Federal assistance to program required. If a

patient’s alcohol or drug abuse diagnosis,

treatment, or referral for treatment is not provided

by a program which is federally conducted,

regulated or supported in a manner which

constitutes Federal assistance under § 2.12(b), that

patient’s record is not covered by these regulations.

Thus, it is possible for an individual patient to

benefit from Federal support and not be covered by

the confidentiality regulations because the program

in which the patient is enrolled is not federally

assisted as defined in § 2.12(b). For example, if a

Federal court placed an individual in a private forprofit program and made a payment to the program

on behalf of that individual, that patient’s record

would not be covered by these regulations unless

the program itself received Federal assistance as

defined by § 2.12(b).

(3) Information to which restrictions are

applicable. Whether a restriction is on use or

disclosure affects the type of information which

may be available. The restrictions on disclosure

apply to any information which would identify a

patient as an alcohol or drug abuser. The restriction

on use of information to bring criminal charges

against a patient for a crime applies to any

information obtained by the program for the

purpose of diagnosis, treatment, or referral for

treatment of alcohol or drug abuse. (Note that

restrictions on use and disclosure apply to

recipients of information under § 2.12(d).)

(4) How type of diagnosis affects coverage. These

regulations cover any record of a diagnosis

identifying a patient as an alcohol or drug abuser

which is prepared in connection with the treatment

or referral for treatment of alcohol or drug abuse. A

diagnosis prepared for the purpose of treatment or

referral for treatment but which is not so used is

covered by these regulations. The following are not

covered by these regulations:

(i) Diagnosis which is made solely for the purpose

of providing evidence for use by law enforcement

authorities; or

(ii) A diagnosis of drug overdose or alcohol

intoxication which clearly shows that the individual

involved is not an alcohol or drug abuser (e.g.,

involuntary ingestion of alcohol or drugs or reaction

to a prescribed dosage of one or more drugs).
A-11

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987, as amended at 60 FR 22297, May 5, 1995] 

§ 2.13 Confidentiality restrictions.

(a) General. The patient records to which these

regulations apply may be disclosed or used only as

permitted by these regulations and may not

otherwise be disclosed or used in any civil,

criminal, administrative, or legislative proceedings

conducted by any Federal, State, or local authority.

Any disclosure made under these regulations must

be limited to that information which is necessary to

carry out the purpose of the disclosure.

(b) Unconditional compliance required. The

restrictions on disclosure and use in these

regulations apply whether the holder of the

information believes that the person seeking the

information already has it, has other means of

obtaining it, is a law enforcement or other official,

has obtained a subpoena, or asserts any other

justification for a disclosure or use which is not

permitted by these regulations.

(c) Acknowledging the presence of patients:

Responding to requests. (1) The presence of an

identified patient in a facility or component of a

facility which is publicly identified as a place where

only alcohol or drug abuse diagnosis, treatment, or

referral is provided may be acknowledged only if

the patient’s written consent is obtained in

accordance with subpart C of these regulations or if

an authorizing court order is entered in accordance

with subpart E of these regulations. The regulations

permit acknowledgment of the presence of an

identified patient in a facility or part of a facility if

the facility is not publicly identified as only an

alcohol or drug abuse diagnosis, treatment or

referral facility, and if the acknowledgment does

not reveal that the patient is an alcohol or drug

abuser.

(2) Any answer to a request for a disclosure of

patient records which is not permissible under these

regulations must be made in a way that will not

affirmatively reveal that an identified individual has

been, or is being diagnosed or treated for alcohol or

drug abuse. An inquiring party may be given a

copy of these regulations and advised that they

restrict the disclosure of alcohol or drug abuse

patient records, but may not be told affirmatively

that the regulations restrict the disclosure of the

records of an identified patient. The regulations do

not restrict a disclosure that an identified individual

is not and never has been a patient.

§ 2.14 Minor patients.

(a) Definition of minor. As used in these

regulations the term ‘‘minor’’ means a person who

has not attained the age of majority specified in the

applicable State law, or if no age of majority is

specified in the applicable State law, the age of

eighteen years.

(b) State law not requiring parental consent to

treatment. If a minor patient acting alone has the

legal capacity under the applicable State law to

apply for and obtain alcohol or drug abuse

treatment, any written consent for disclosure

authorized under subpart C of these regulations

may be given only by the minor patient. This

restriction includes, but is not limited to, any

disclosure of patient identifying information to the

parent or guardian of a minor patient for the

purpose of obtaining financial reimbursement.

These regulations do not prohibit a program from

refusing to provide treatment until the minor patient

consents to the disclosure necessary to obtain

reimbursement, but refusal to provide treatment

may be prohibited under a State or local law

requiring the program to furnish the service

irrespective of ability to pay.

(c) State law requiring parental consent to

treatment. (1) Where State law requires consent of

a parent, guardian, or other person for a minor to

obtain alcohol or drug abuse treatment, any written

consent for disclosure authorized under subpart C

of these regulations must be given by both the

minor and his or her parent, guardian, or other

person authorized under State law to act in the

minor’s behalf. 

(2) Where State law requires parental consent to

treatment the fact of a minor’s application for

treatment may be communicated to the minor’s

parent, guardian, or other person authorized under

State law to act in the minor’s behalf only if:

(i) The minor has given written consent to the

disclosure in accordance with subpart C of these

regulations or

(ii) The minor lacks the capacity to make a rational

choice regarding such consent as judged by the

program director under paragraph (d) of this

section.
A-12

(d) Minor applicant for services lacks capacity for

rational choice. Facts relevant to reducing a threat

to the life or physical well being of the applicant or

any other individual may be disclosed to the parent,

guardian, or other person authorized under State

law to act in the minor’s behalf if the program

director judges that:

(1) A minor applicant for services lacks capacity

because of extreme youth or mental or physical

condition to make a rational decision on whether to

consent to a disclosure under subpart C of these

regulations to his or her parent, guardian, or other

person authorized under State law to act in the

minor’s behalf, and

(2) The applicant’s situation poses a substantial

threat to the life or physical well being of the

applicant or any other individual which may be

reduced by communicating relevant facts to the

minor’s parent, guardian, or other person

authorized under State law to act in the minor’s

behalf.

§ 2.15 Incompetent and deceased patients.

(a) Incompetent patients other than minors—(1)

Adjudication of incompetence. In the case of a

patient who has been adjudicated as lacking the

capacity, for any reason other than insufficient age,

to manage his or her own affairs, any consent

which is required under these regulations may be

given by the guardian or other person authorized

under State law to act in the patient’s behalf.

(2) No adjudication of incompetency. For any

period for which the program director determines

that a patient, other than a minor or one who has

been adjudicated incompetent, suffers from a

medical condition that prevents knowing or

effective action on his or her own behalf, the

program director may exercise the right of the

patient to consent to a disclosure under subpart C

of these regulations for the sole purpose of

obtaining payment for services from a third party

payer.

(b) Deceased patients—(1) Vital statistics. These

regulations do not restrict the disclosure of patient

identifying information relating to the cause of

death of a patient under laws requiring the

collection of death or other vital statistics or

permitting inquiry into the cause of death.

(2) Consent by personal representative. Any other

disclosure of information identifying a deceased

patient as an alcohol or drug abuser is subject to

these regulations. If a written consent to the

disclosure is required, that consent may be given by

an executor, administrator, or other personal

representative appointed under applicable State

law. If there is no such appointment the consent

may be given by the patient’s spouse or, if none,

by any responsible member of the patient’s family.

§ 2.16 Security for written records.

(a) Written records which are subject to these

regulations must be maintained in a secure room,

locked file cabinet, safe or other similar container

when not in use; and

(b) Each program shall adopt in writing procedures

which regulate and control access to and use of

written records which are subject to these

regulations.
A-13

§ 2.17 Undercover agents and informants.

(a) Restrictions on placement. Except as

specifically authorized by a court order granted

under § 2.67 of these regulations, no program may

knowingly employ, or enroll as a patient, any

undercover agent or informant.

(b) Restriction on use of information. No

information obtained by an undercover agent or

informant, whether or not that undercover agent or

informant is placed in a program pursuant to an

authorizing court order, may be used to criminally

investigate or prosecute any patient.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987]

§ 2.18 Restrictions on the use of identification

cards.

 No person may require any patient to carry on his or

her person while away from the program premises any

card or other object which would identify the patient as

an alcohol or drug abuser. This section does not prohibit

a person from requiring patients to use or carry cards

or other identification objects on the premises of a

program. 

§ 2.19 Disposition of records by discontinued

programs.

(a) General. If a program discontinues operations

or is taken over or acquired by another program, it

must purge patient identifying information from its

records or destroy the records unless—

(1) The patient who is the subject of the records gives

written consent (meeting the requirements of § 2.31) to a

transfer of the records to the acquiring program or to

any other program designated in the consent (the

manner of obtaining this consent must minimize the

likelihood of a disclosure of patient identifying

information to a third party); or

 (2) There is a legal requirement that the records be

kept for a period specified by law which does not expire

until after the discontinuation or acquisition of the

program.

(b) Procedure where retention period required by

law. If paragraph (a)(2) of this section applies, the

records must be: 

(1) Sealed in envelopes or other containers labeled

as follows: ‘‘Records of [insert name of program]

required to be maintained under [insert citation to

statute, regulation, court order or other legal

authority requiring that records be kept] until a date

not later than [insert appropriate date]’’; and

(2) Held under the restrictions of these regulations

by a responsible person who must, as soon as

practicable after the end of the retention period

specified on the label, destroy the records.

§ 2.20 Relationship to State laws.

The statutes authorizing these regulations (42

U.S.C. 290ee–3 and 42 U.S.C. 290dd–3) do not

preempt the field of law which they cover to the

exclusion of all State laws in that field. If a

disclosure permitted under these regulations is

prohibited under State law, neither these regulations

nor the authorizing statutes may be construed to

authorize any violation of that State law. However,

no State law may either authorize or compel any

disclosure prohibited by these regulations.

§ 2.21 Relationship to Federal statutes protecting research subjects against compulsory

disclosure of their identity.

(a) Research privilege description. There may be

concurrent coverage of patient identifying

information by these regulations and by

administrative action taken under: Section 303(a) of

the Public Health Service Act (42 U.S.C. 242a(a)

and the implementing regulations at 42 CFR part

2a); or section 502(c) of the Controlled Substances

Act (21 U.S.C. 872(c) and the implementing

regulations at 21 CFR 1316.21). These ‘‘research

privilege’’ statutes confer on the Secretary of

Health and Human Services and on the Attorney

General, respectively, the power to authorize

researchers conducting certain types of research to

withhold from all persons not connected with the

research the names and other identifying

information concerning individuals who are the

subjects of the research.

(b) Effect of concurrent coverage. These

regulations restrict the disclosure and use of

information about patients, while administrative

action taken under the research privilege statutes

and implementing regulations protects a person

engaged in applicable research from being

compelled to disclose any identifying characteristics

of the individuals who are the subjects of that

research. The issuance under subpart E of these

regulations of a court order authorizing a disclosure

of information about a patient does not affect an
A-14

exercise of authority under these research privilege

statutes. However, the research privilege granted

under 21 CFR 291.505(g) to treatment programs

using methadone for maintenance treatment does

not protect from compulsory disclosure any

information which is permitted to be disclosed

under those regulations. Thus, if a court order

entered in accordance with subpart E of these

regulations authorizes a methadone maintenance

treatment program to disclose certain information

about its patients, that program may not invoke the

research privilege under 21 CFR 291.505(g) as a

defense to a subpoena for that information.

§ 2.22 Notice to patients of Federal

confidentiality requirements.

(a) Notice required. At the time of admission or as

soon thereafter as the patient is capable of rational

communication, each program shall:

(1) Communicate to the patient that Federal law

and regulations protect the confidentiality of

alcohol and drug abuse patient records; and

(2) Give to the patient a summary in writing of the

Federal law and regulations. 

(b) Required elements of written summary. The

written summary of the Federal law and regulations

must include:

(1) A general description of the limited

circumstances under which a program may

acknowledge that an individual is present at a

facility or disclose outside the program information

identifying a patient as an alcohol or drug abuser.

(2) A statement that violation of the Federal law

and regulations by a program is a crime and that

suspected violations may be reported to appropriate

authorities in accordance with these regulations.

(3) A statement that information related to a

patient’s commission of a crime on the premises of

the program or against personnel of the program is

not protected.

(4) A statement that reports of suspected child

abuse and neglect made under State law to

appropriate State or local authorities are not

protected.

(5) A citation to the Federal law and regulations.

(c) Program options. The program may devise its

own notice or may use the sample notice in

paragraph (d) to comply with the requirement to

provide the patient with a summary in writing of

the Federal law and regulations. In addition, the

program may include in the written summary

information concerning State law and any program

policy not inconsistent with State and Federal law

on the subject of confidentiality of alcohol and drug

abuse patient records.

(d) Sample notice. 

CONFIDENTIALITY OF ALCOHOL AND DRUG

ABUSE PATIENT RECORDS

The confidentiality of

alcohol and drug abuse patient

records maintained by this

program is protected by Federal

law and regulations. Generally,

the program may not say to a

person outside the program that

a patient attends the program,

or disclose any information

identifying a patient as an

alcohol or drug abuser Unless:

(1) The patient consents in writing:

(2) The disclosure is allowed by a court order; or

(3) The disclosure is made to medical personnel

in a medical emergency or to qualified personnel for

research, audit, or program evaluation. Violation of the

Federal law and regulations by a program is a crime.

Suspected violations may be reported to appropriate

authorities in accordance with Federal regulations.

Federal law and regulations do not protect any

information about a crime committed by a patient

either at the program or against any person who works

for the program or about any threat to commit such a

crime. Federal laws and regulations do not protect any

information about suspected child abuse or neglect

from being reported under State law to appropriate

State or local authorities.

(See 42 U.S.C. 290dd–3 and 42 U.S.C. 290ee–3 for

Federal laws and 42 CFR part 2 for Federal regulations.)

(Approved by the Office of Management and Budget

under control number 0930–0099)

§ 2.23 Patient access and restrictions on use.

(a) Patient access not prohibited. These regulations do

not prohibit a program from giving a patient access to

his or her own records, including the opportunity to

inspect and copy any records that the program maintains

about the patient. The program is not required to obtain

a patient’s written consent or other authorization under

these regulations in order to provide such access to the

patient.
A-15

(b) Restriction on use of information. Information

obtained by patient access to his or her patient record is

subject to the restriction on use of his information to

initiate or substantiate any criminal charges against the

patient or to conduct any criminal investigation of the

patient as provided for under § 2.12(d)(1).

Subpart C—Disclosures With Patient’s

Consent

§ 2.31 Form of written consent.

(a) Required elements. A written consent to a disclosure

under these regulations must include:

(1) The specific name or general designation of the

program or person permitted to make the

disclosure.

(2) The name or title of the individual or the name

of the organization to which disclosure is to be

made.

(3) The name of the patient.

(4) The purpose of the disclosure.

(5) How much and what kind of information is to

be disclosed.

(6) The signature of the patient and, when required

for a patient who is a minor, the signature of a

person authorized to give consent under § 2.14; or,

when required for a patient who is incompetent or

deceased, the signature of a person authorized to

sign under § 2.15 in lieu of the patient.

(7) The date on which the consent is signed.

(8) A statement that the consent is subject to

revocation at any time except to the extent that the

program or person which is to make the disclosure

has already acted in reliance on it. Acting in

reliance includes the provision of treatment services

in reliance on a valid consent to disclose

information to a third party payer.

(9) The date, event, or condition upon which the

consent will expire if not revoked before. This

date, event, or condition must insure that the

consent will last no longer than reasonably

necessary to serve the purpose for which it is

given.

(b) Sample consent form. The following form complies

with paragraph (a) of this section, but other elements

may be added.

1. I (name of patient) 

———————————————————

Q Request Q Authorize:

2.(name or general designation of program which

is to make the disclosure)

———————————————————

3. To disclose: (kind and amount of information to

be disclosed)

———————————————————

4. To: (name or title of the person or organization

to which disclosure is to be made)

———————————————————

5. For: (purpose of the disclosure)

———————————————————

6. Date: (on which this consent is signed)

———————————————————

7. Signature of patient

———————————————————

8. Signature of parent or guardian (where required)

———————————————————

9. Signature of person authorized to sign in lieu of

the patient (where required)

———————————————————

10. This consent is subject to revocation at any time

except to the extent that the program which is to make

the disclosure has already taken action in reliance on it.

If not previously revoked, this consent will terminate

upon: (specific date, event, or condition)

———————————————————

(c) Expired, deficient, or false consent. A disclosure

may not be made on the basis of a consent which:

(1) Has expired;

(2) On its face substantially fails to conform to

any of the requirements set forth in paragraph (a) of

this section;

(3) Is known to have been revoked; or

(4) Is known, or through a reasonable effort

could be known, by the person holding the records to

be materially false.

(Approved by the Office of Management and Budget

under control number 0930–0099)

§ 2.32 Prohibition on redisclosure.

Notice to accompany disclosure. Each disclosure made with the patient’s written consent must

be accompanied by the following written statement:
A-16

This information has been disclosed to you from

records protected by Federal confidentiality rules (42

CFR part 2). The Federal rules prohibit you from making

any further disclosure of this information unless further

disclosure is expressly permitted by the written consent

of the person to whom it pertains or as otherwise

permitted by 42 CFR part 2. A general authorization for

the release of medical or other information is NOT

sufficient for this purpose. The Federal rules restrict any

use of the information to criminally investigate or

prosecute any alcohol or drug abuse patient.

[52 FR 21809, June 9, 1987; 52 FR 41997, Nov. 2,

1987]

§ 2.33 Disclosures permitted with written consent.

If a patient consents to a disclosure of his or her

records under § 2.31, a program may disclose those

records in accordance with that consent to any

individual or organization named in the consent,

except that disclosures to central registries and in

connection with criminal justice referrals must meet

the requirements of §§ 2.34 and 2.35, respectively.

§ 2.34 Disclosures to prevent multiple enrollments in detoxification and maintenance

treatment programs.

(a) Definitions. For purposes of this section:

Central registry means an organization which

obtains from two or more member programs patient

identifying information about individuals applying for

maintenance treatment or detoxification treatment for

the purpose of avoiding an individual’s concurrent

enrollment in more than one program. 

Detoxification treatment means the dispensing

of a narcotic drug in decreasing doses to an individual

in order to reduce or eliminate adverse physiological

or psychological effects incident to withdrawal from

the sustained use of a narcotic drug. 

Maintenance treatment means the

dispensing of a narcotic drug in the treatment of

an individual for dependence upon heroin or

other morphine-like drugs. 

Member program means a detoxification

treatment or maintenance treatment program

which reports patient identifying information to

a central registry and which is in the same State

as that central registry or is not more than 125

miles from any border of the State in which the

central registry is located. 

(b) Restrictions on disclosure. A program may

disclose patient records to a central registry or to any

detoxification or maintenance treatment program not

more than 200 miles away for the purpose of

preventing the multiple enrollment of a patient only if:

(1) The disclosure is made when:

(i) The patient is accepted for treatment;

(ii) The type or dosage of the drug is changed; or

(iii) The treatment is interrupted, resumed or

terminated.

 (2) The disclosure is limited to:

(i) Patient identifying information;

(ii) Type and dosage of the drug; and

(iii) Relevant dates.

(3) The disclosure is made with the patient’s written

consent meeting the requirements of §2.31, except

that:

(i) The consent must list the name and address of each

central registry and each known detoxification or

maintenance treatment program to which a disclosure

will be made; and

(ii) The consent may authorize a disclosure to any

detoxification or maintenance treatment program

established within 200 miles of the program after the

consent is given without naming any such program.

(c) Use of information limited to prevention of

multiple enrollments. A central registry and any

detoxification or maintenance treatment program to

which information is disclosed to prevent multiple

enrollments may not redisclose or use patient

identifying information for any purpose other than

the prevention of multiple enrollments unless

authorized by a court order under subpart E of these

regulations. 

(d) Permitted disclosure by a central registry to

prevent a multiple enrollment. When a member

program asks a central registry if an identified patient

is enrolled in another member program and the

registry determines that the patient is so enrolled, the

registry may disclose—

(1) The name, address, and telephone number of the

member program(s) in which the patient is already

enrolled to the inquiring member program; and 

(2) The name, address, and telephone number of the

inquiring member program to the member program(s) in

which the patient is already enrolled. The member

programs may communicate as necessary to verify that

no error has been made and to prevent or eliminate any

multiple enrollment.
A-17

(e) Permitted disclosure by a detoxification or

maintenance treatment program to prevent a

multiple enrollment. A detoxification or maintenance

treatment program which has received a disclosure

under this section and has determined that the patient

is already enrolled may communicate as necessary

with the program making the disclosure to verify that

no error has been made and to prevent or eliminate

any multiple enrollment.

§ 2.35 Disclosures to elements of the criminal

justice system which have referred patients.

(a) A program may disclose information about a

patient to those persons within the criminal justice

system which have made participation in the program

a condition of the disposition of any criminal

proceedings against the patient or of the patient’s

parole or other release from custody if:

(1) The disclosure is made only to those individuals

within the criminal justice system who have a need for

the information in connection with their duty to

monitor the patient’s progress (e.g., a prosecuting

attorney who is withholding charges against the

patient, a court granting pretrial or posttrial release,

probation or parole officers responsible for supervision

of the patient); and (2) The patient has signed a

written consent meeting the requirements of § 2.31

(except paragraph (a)(8) which is inconsistent with the

revocation provisions of paragraph (c) of this section)

and the requirements of paragraphs (b) and (c) of this

section.

(b) Duration of consent. The written consent must

state the period during which it remains in effect.

This period must be reasonable, taking into account:

(1) The anticipated length of the treatment;

(2) The type of criminal proceeding involved, the

need for the information in connection with the final

disposition of that proceeding, and when the final

disposition will occur; and

(3) Such other factors as the program, the patient,

and the person(s) who will receive the disclosure

consider pertinent.

(c) Revocation of consent. The written consent must

state that it is revocable upon the passage of a

specified amount of time or the occurrence of a

specified, ascertainable event. The time or

occurrence upon which consent becomes revocable

may be no later than the final disposition of the

conditional release or other action in connection with

which consent was given.

(d) Restrictions on redisclosure and use. A person

who receives patient information under this section

may redisclose and use it only to carry out that

person’s official duties with regard to the patient’s

conditional release or other action in connection with

which the consent was given.

Subpart D—Disclosures Without Patient

Consent

§ 2.51 Medical emergencies.

(a) General Rule. Under the procedures required

by paragraph (c) of this section, patient identifying

information may be disclosed to medical personnel

who have a need for information about a patient

for the purpose of treating a condition which poses

an immediate threat to the health of any individual

and which requires immediate medical intervention.

(b) Special Rule. Patient identifying information

may be disclosed to medical personnel of the Food

and Drug Administration (FDA) who assert a

reason to believe that the health of any individual

may be threatened by an error in the manufacture,

labeling, or sale of a product under FDA

jurisdiction, and that the information will be used

for the exclusive purpose of notifying patients or

their physicians of potential dangers.

(c) Procedures. Immediately following disclosure, the

program shall document the disclosure in the

patient’s records, setting forth in writing:

(1) The name of the medical personnel to whom

disclosure was made and their affiliation with any

health care facility;

(2) The name of the individual making the disclosure;

(3) The date and time of the disclosure; and

(4) The nature of the emergency (or error, if the

report was to FDA).

(Approved by the Office of Management and Budget

 under control number 0930–0099)
A-18

§ 2.52 Research activities.

(a) Patient identifying information may be disclosed

for the purpose of conducting scientific research if

the program director makes a determination that the

recipient of the patient identifying information:

(1) Is qualified to conduct the research;

(2) Has a research protocol under which the patient

identifying information:

(i) Will be maintained in accordance with the security

requirements of § 2.16 of these regulations (or more

stringent requirements); and

(ii) Will not be redisclosed except as permitted under

paragraph (b) of this section; and

(3) Has provided a satisfactory written statement

that a group of three or more individuals who are

independent of the research project has reviewed

the protocol and determined that:

(i) The rights and welfare of patients will be

adequately protected; and

(ii) The risks in disclosing patient identifying

information are outweighed by the potential benefits

of the research.

(b) A person conducting research may disclose

patient identifying information obtained under

paragraph (a) of this section only back to the

program from which that information was obtained

and may not identify any individual patient in any

report of that research or otherwise disclose patient

identities.

[52 FR 21809, June 9, 1987, as amended at 52 FR

41997, Nov. 2, 1987]

§ 2.53 Audit and evaluation activities.

(a) Records not copied or removed. If patient

records are not copied or removed, patient identifying

information may be disclosed in the course of a

review of records on program premises to any person

who agrees in writing to comply with the limitations

on redisclosure and use in paragraph (d) of this

section and who:

(1) Performs the audit or evaluation activity on behalf

of:

(i) Any Federal, State, or local governmental agency

which provides financial assistance to the program or is

authorized by law to regulate its activities; or

(ii) Any private person which provides financial

assistance to the program, which is a third party payer

covering patients in the program, or which is a peer

review organization performing a utilization or quality

control review; or

(2) Is determined by the program director to be

qualified to conduct the audit or evaluation activities.

(b) Copying or removal of records. Records

containing patient identifying information may be

copied or removed from program premises by any

person who:

(1) Agrees in writing to:

(i) Maintain the patient identifying information in

accordance with the security requirements provided in

§ 2.16 of these regulations (or more stringent requirements);

(ii) Destroy all the patient identifying information upon

completion of the audit or evaluation; and

(iii) Comply with the limitations on disclosure and use in

paragraph (d) of this section; and

(2) Performs the audit or evaluation activity on behalf

of:

(i) Any Federal, State, or local governmental agency

which provides financial assistance to the program or is

authorized by law to regulate its activities; or

(ii) Any private person which provides financial

assistance to the program, which is a third part payer

covering patients in the program, or which is a peer

review organization performing a utilization or quality

control review.

(c) Medicare or Medicaid audit or evaluation. (1)

For purposes of Medicare or Medicaid audit or

evaluation under this section, audit or evaluation

includes a civil or administrative investigation of the

program by any Federal, State, or local agency

responsible for oversight of the Medicare or Medicaid

program and includes administrative enforcement,

against the program by the agency, of any remedy

authorized by law to be imposed as a result of the

findings of the investigation.

(2) Consistent with the definition of program in § 2.11,

program includes an employee of, or provider of medical

services under, the program when the employee or

provider is the subject of a civil investigation or

administrative remedy, as those terms are used in

paragraph (c)(1) of this section.

(3) If a disclosure to a person is authorized under this

section for a Medicare or Medicaid audit or evaluation,

including a civil investigation or administrative remedy,

as those terms are used in paragraph (c)(1) of this

section, then a peer review organization which obtains

the information under paragraph (a) or (b) may disclose

the information to that person but only for purposes of

Medicare or Medicaid audit or evaluation.

(4) The provisions of this paragraph do not authorize

the agency, the program, or any other person to

disclose or use patient identifying information obtained

during the audit or evaluation for any purposes other than

those necessary to complete the Medicare or Medicaid audit or

evaluation activity as specified in this paragraph.

(d) Limitations on disclosure and use. Except as

provided in paragraph (c) of this section, patient

identifying information disclosed under this section
A-19

may be disclosed only back to the program from

which it was obtained and used only to carry out an

audit or evaluation purpose or to investigate or

prosecute criminal or other activities, as authorized

by a court order entered under § 2.66 of these

regulations.

Subpart E—Court Orders

Authorizing Disclosure and Use

§ 2.61 Legal effect of order.

(a) Effect. An order of a court of competent

jurisdiction entered under this subpart is a unique

kind of court order. Its only purpose is to authorize

a disclosure or use of patient information which

would otherwise be prohibited by 42 U.S.C.

290ee–3, 42 U.S.C. 290dd–3 and these regulations.

Such an order does not compel disclosure. A

subpoena or a similar legal mandate must be issued

in order to compel disclosure. This mandate may be

entered at the same time as and accompany an

authorizing court order entered under these

regulations.

(b) Examples. (1) A person holding records subject

to these regulations receives a subpoena for those

records: a response to the subpoena is not permitted

under the regulations unless an authorizing court

order is entered. The person may not disclose the

records in response to the subpoena unless a court of

competent jurisdiction enters an authorizing order

under these regulations.

(2) An authorizing court order is entered under

these regulations, but the person authorized does

not want to make the disclosure. If there is no

subpoena or other compulsory process or a

subpoena for the records has expired or been

quashed, that person may refuse to make the

disclosure. Upon the entry of a valid subpoena or

other compulsory process the person authorized to

disclose must disclose, unless there is a valid legal

defense to the process other than the confidentiality restrictions of these regulations.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987]

§ 2.62 Order not applicable to records disclosed

without consent to researchers, auditors and

evaluators.

A court order under these regulations may not

authorize qualified personnel, who have received

patient identifying information without consent for

the purpose of conducting research, audit or

evaluation, to disclose that information or use it to

conduct any criminal investigation or prosecution of

a patient. However, a court order under § 2.66 may

authorize disclosure and use of records to

investigate or prosecute qualified personnel holding

the records.

§ 2.63 Confidential communications.

(a) A court order under these regulations may

authorize disclosure of confidential communications

made by a patient to a program in the course of

diagnosis, treatment, or referral for treatment only

if:

(1) The disclosure is necessary to protect against

an existing threat to life or of serious bodily

injury, including circumstances which constitute

suspected child abuse and neglect and verbal

threats against third parties;

(2) The disclosure is necessary in connection

with investigation or prosecution of an extremely

serious crime, such as one which directly

threatens loss of life or serious bodily injury,

including homicide, rape, kidnaping, armed

robbery, assault with a deadly weapon, or child

abuse and neglect; or

(3) The disclosure is in connection with litigation

or an administrative proceeding in which the

patient offers testimony or other evidence

pertaining to the content of the confidential

communications.

(b) [Reserved]

§ 2.64 Procedures and criteria for orders

authorizing disclosures for noncriminal

purposes.

(a) Application. An order authorizing the disclosure

of patient records for purposes other than criminal

investigation or prosecution may be applied for by

any person having a legally recognized interest in

the disclosure which is sought. The application may

be filed separately or as part of a pending civil

action in which it appears that the patient records

are needed to provide evidence. An application

must use a fictitious name, such as John Doe, to

refer to any patient and may not contain or

otherwise disclose any patient identifying

information unless the patient is the applicant or
A-20

has given a written consent (meeting the

requirements of these regulations) to disclosure or

the court has ordered the record of the proceeding

sealed from public scrutiny.

(b) Notice. The patient and the person holding the

records from whom disclosure is sought must be

given:

(1) Adequate notice in a manner which will not

disclose patient identifying information to other

persons; and

(2) An opportunity to file a written response to

the application, or to appear in person, for the

limited purpose of providing evidence on the

statutory and regulatory criteria for the issuance

of the court order.

(c) Review of evidence: Conduct of hearing. Any

oral argument, review of evidence, or hearing on

the application must be held in the judge’s

chambers or in some manner which ensures that

patient identifying information is not disclosed to

anyone other than a party to the proceeding, the

patient, or the person holding the record, unless the

patient requests an open hearing in a manner which

meets the written consent requirements of these

regulations. The proceeding may include an

examination by the judge of the patient records

referred to in the application.

(d) Criteria for entry of order. An order under this

section may be entered only if the court determines

that good cause exists. To make this determination

the court must find that:

(1) Other ways of obtaining the information are

not available or would not be effective; and

(2) The public interest and need for the

disclosure outweigh the potential injury to the

patient, the physician-patient relationship and

the treatment services.

(e) Content of order. An order authorizing a

disclosure must:

(1) Limit disclosure to those parts of the patient’s

record which are essential to fulfill the objective

of the order;

(2) Limit disclosure to those persons whose need

for information is the basis for the order; and

(3) Include such other measures as are necessary

to limit disclosure for the protection of the

patient, the physician patient relationship and the

treatment services; for example, sealing

from public scrutiny the record of any proceeding

for which disclosure of a patient’s record has been

ordered.

§ 2.65 Procedures and criteria for orders

authorizing disclosure and use of records to

criminally investigate or prosecute patients.

(a) Application. An order authorizing the disclosure

or use of patient records to criminally investigate or

prosecute a patient may be applied for by the

person holding the records or by any person

conducting investigative or prosecutorial activities

with respect to the enforcement of criminal laws.

The application may be filed separately, as part of

an application for a subpoena or other compulsory

process, or in a pending criminal action. An

application must use a fictitious name such as John

Doe, to refer to any patient and may not contain or

otherwise disclose patient identifying information
A-21

unless the court has ordered the record of the

proceeding sealed from public scrutiny.

(b) Notice and hearing. Unless an order under §

2.66 is sought with an order under this section, the

person holding the records must be given:

(1) Adequate notice (in a manner which will not

disclose patient identifying information to third

parties) of an application by a person performing

a law enforcement function;

(2) An opportunity to appear and be heard for the

limited purpose of providing evidence on the

statutory and regulatory criteria for the issuance

of the court order; and

(3) An opportunity to be represented by counsel

independent of counsel for an applicant who is a

person performing a law enforcement function.

(c) Review of evidence: Conduct of hearings. Any

oral argument, review of evidence, or hearing on

the application shall be held in the judge’s

chambers or in some other manner which ensures

that patient identifying information is not disclosed

to anyone other than a party to the proceedings,

the patient, or the person holding the records. The

proceeding may include an examination by the

judge of the patient records referred to in the

application.

(d) Criteria. A court may authorize the disclosure

and use of patient records for the purpose of

conducting a criminal investigation or prosecution

of a patient only if the court finds that all of the

following criteria are met:

(1) The crime involved is extremely serious, such

as one which causes or directly threatens loss of

life or serious bodily injury including homicide,

rape, kidnaping, armed robbery, assault with a

deadly weapon, and child abuse and neglect.

(2) There is a reasonable likelihood that the

records will disclose information of substantial

value in the investigation or prosecution.

(3) Other ways of obtaining the information are

not available or would not be effective.

(4) The potential injury to the patient, to the

physician-patient relationship and to the

ability of the program to provide services to

other patients is outweighed by the public

interest and the need for the disclosure.

(5) If the applicant is a person performing a law

enforcement function that:

(i) The person holding the records has been

afforded the opportunity to be represented by

independent counsel; and

(ii) Any person holding the records which is an

entity within Federal, State, or local government

has in fact been represented by counsel

independent of the applicant.

(e) Content of order. Any order authorizing a

disclosure or use of patient records under this

section must:

(1) Limit disclosure and use to those parts of the

patient’s record which are essential to fulfill the

objective of the order;

(2) Limit disclosure to those law enforcement and

prosecutorial officials who are responsible for, or

are conducting, the investigation or prosecution,

and limit their use of the records to investigation

and prosecution of extremely serious crime or

suspected crime specified in the application; and

(3) Include such other measures as are necessary

to limit disclosure and use to the fulfillment of

only that public interest and need found by the

court.

[52 FR 21809, June 9, 1987; 52 FR 42061, Nov. 2,

1987]

§ 2.66 Procedures and criteria for orders

authorizing disclosure and use of records to

investigate or prosecute a program or the

person holding the records.

(a) Application. (1) An order authorizing the

disclosure or use of patient records to criminally or

administratively investigate or prosecute a program

or the person holding the records (or employees or

agents of that program or person) may be applied

for by any administrative, regulatory, supervisory,

investigative, law enforcement, or prosecutorial

agency having jurisdiction over the program’s or

person’s activities.

(2) The application may be filed separately or as

part of a pending civil or criminal action against a

program or the person holding the records (or
A-22

agents or employees of the program or person) in

which it appears that the patient records are

needed to provide material evidence. The

application must use a fictitious name, such as

John Doe, to refer to any patient and may not

contain or otherwise disclose any patient

identifying information unless the court has

ordered the record of the proceeding sealed from

public scrutiny or the patient has given a written

consent (meeting the requirements of § 2.31 of

these regulations) to that disclosure.

(b) Notice not required. An application under this

section may, in the discretion of the court, be

granted without notice. Although no express notice

is required to the program, to the person holding

the records, or to any patient whose records are to

be disclosed, upon implementation of an order so

granted any of the above persons must be afforded

an opportunity to seek revocation or amendment of

that order, limited to the presentation of evidence

on the statutory and regulatory criteria for the

issuance of the court order.

(c) Requirements for order. An order under this

section must be entered in accordance with, and

comply with the requirements of, paragraphs (d)

and (e) of § 2.64 of these regulations.

(d) Limitations on disclosure and use of patient

identifying information:

(1) An order entered under this section must

require the deletion of patient identifying

information from any documents made available

to the public.

(2) No information obtained under this section

may be used to conduct any investigation or

prosecution of a patient, or be used as the basis

for an application for an order under § 2.65 of

these regulations.

§ 2.67 Orders authorizing the use of undercover

agents and informants to criminally investigate

employees or agents of a program.

(a) Application. A court order authorizing the

placement of an undercover agent or informant in a

program as an employee or patient may be applied

for by any law enforcement or prosecutorial

agency which has reason to believe that employees

or agents of the program are engaged in criminal

misconduct.

(b) Notice. The program director must be given

adequate notice of the application and an

opportunity to appear and be heard (for the limited

purpose of providing evidence on the statutory and

regulatory criteria for the issuance of the court

order), unless the application asserts a belief that:

(1) The program director is involved in the

criminal activities to be investigated by the

undercover agent or informant; or

(2) The program director will intentionally or

unintentionally disclose the proposed placement

of an undercover agent or informant to the

employees or agents who are suspected of

criminal activities.

(c) Criteria. An order under this section may be

entered only if the court determines that good

cause exists. To make this determination the court

must find:

(1) There is reason to believe that an employee

or agent of the program is engaged in criminal

activity;

(2) Other ways of obtaining evidence of this

criminal activity are not available or would not be

effective; and

(3) The public interest and need for the

placement of an undercover agent or informant in

the program outweigh the potential injury to

patients of the program, physician-patient

relationships and the treatment services.

(d) Content of order. An order authorizing the

placement of an undercover agent or informant in a

program must:

(1) Specifically authorize the placement of an

undercover agent or an informant;

(2) Limit the total period of the placement to six

months;

(3) Prohibit the undercover agent or informant

from disclosing any patient identifying

information obtained from the placement except

as necessary to criminally investigate or

prosecute employees or agents of the program;

and
A-23

(4) Include any other measures which are

appropriate to limit any potential disruption of

the program by the placement and any potential

for a real or apparent breach of patient

confidentiality; for example, sealing from public

scrutiny the record of any proceeding for which

disclosure of a patient’s record has been ordered.

(e) Limitation on use of information. No

information obtained by an undercover agent or

informant placed under this section may be used to

criminally investigate or prosecute any patient or as

the basis for an application for an order under §

2.65 of these regulations.
A-23

Appendix B—Sample Forms 

and Agreements To Facilitate Collaborative

Efforts Between the Substance Abuse 

Treatment and Welfare Systems 
B-2

Sample Form #1:

Patient Consent for the Release of Confidential Information

Patient Consent for the Release of Confidential Information

I, Jane Doe ,

authorize

(NAME OF PATIENT)

 ABC Treatment Program _______________________________

(NAME OR GENERAL DESIGNATION OF PROGRAM MAKING DISCLOSURE)

to disclose to Mary Roe or another TANIFF counselor 

(NAME OF PERSON OR ORGANIZATION TO WHICH 

DISCLOSURE IS TO BE MADE)

the following information: my attendance and compliance in substance abuse

treatment 

 

(NATURE OF THE INFORMATION, AS LIMITED AS POSSIBLE)

The purpose of the disclosure authorized herein is to: Assist the Hill Co. Dept of

Welfare to determine my eligibility for benefits and/or to evaluate my

readiness/ability to participate in a training program.

(PURPOSE OF DISCLOSURE, AS SPECIFIC AS POSSIBLE)

I understand that my records are protected under the Federal regulations governing Confidentiality

of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2, and cannot be disclosed without my

written consent unless otherwise provided for in the regulations. I also understand that I may revoke

this consent at any time except to the extent that action has been taken in reliance on it, and that in

any event this consent expires automatically as follows:

 

 

(SPECIFICATION OF THE DATE, EVENT, OR CONDITION UPON WHICH THIS CONSENT

EXPIRES)

Dated: 

 

(Signature of Participant)

 

(Signature of Parent,

Guardian or Authorized

Representative, When

Required)
B-3

Sample Form #2:

Multiparty Consent Form 

Multiparty Consent Form

 

I, , authorize

 (NAME OF PATIENT)

 

 (NAME OR GENERAL DESIGNATION OF PROGRAM MAKING DISCLOSURE)

to disclose to: (the following persons or organizations)

1. 

2. 

 3.

The purpose of the disclosure authorized herein is to: permit the participants of a

case conference concerning my case to exchange information with one another.

I understand that my records are protected under the Federal regulations governing Confidentiality of

Alcohol and Drug Abuse Patient Records, 42 CFR Part 2, and cannot be disclosed without my written

consent unless otherwise provided for in the regulations. I also understand that I may revoke this consent

at any time except to the extent that action has been taken in reliance on it, and that in any event this

consent expires automatically as follows:

 

(SPECIFICATION OF THE DATE, EVENT, OR CONDITION UPON WHICH THIS CONSENT EXPIRES)

 

(DATE) (SIGNATURE OF PARTICIPANT)

 

(SIGNATURE OF PARENT, GUARDIAN OR

AUTHORIZED REPRESENTATIVE IF REQUIRED)
B-4

Sample Form #3:

Prohibition on Redisclosure of Information Concerning Client

in Alcohol or Drug Abuse Treatment

The following notice accompanies a disclosure of information concerning a

client in alcohol/drug abuse treatment, made to you with the consent of such

client.

Prohibition on Redisclosure of Information

 Concerning Client in Alcohol or Drug Abuse Treatment

This information has been disclosed to you from records protected by Federal

confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from

making any further disclosure of this information unless further disclosure is

expressly permitted by the written consent of the person to whom it pertains

or as otherwise permitted by 42 CFR Part 2. A general authorization for the

release of medical or other information is NOT sufficient for this purpose. The

Federal rules restrict any use of the information to criminally investigate or

prosecute any alcohol or drug abuse patient.
B-5

Sample Form #4:

Qualified Service Organization Agreement

Qualified Service Organization Agreement

XYZ Service Center ("the Center") and 

______________________________________________________________________

(NAME OF THE PROGRAM)

("the Program") hereby enter into a qualified service organization agreement, 

whereby the Center agrees to provide

_____________________________________________________________________

(NATURE OF SERVICES TO BE PROVIDED)

Furthermore, the Center:

 (1) acknowledges that in receiving, storing, processing, or otherwise dealing with any

information from the Program about the patients in the Program, it is fully bound by the

provisions of the Federal regulations governing Confidentiality of Alcohol and Drug Abuse

Patient Records, 42 CFR Part 2; and

 (2) undertakes to resist in judicial proceedings any effort to obtain access to information

pertaining to patients otherwise than as expressly provided for in the Federal confidentiality

regulations, 42 CFR Part 2.

Executed this _________ day of _________, 199 ___.

_________________________ _________________________

President Program Director

XYZ Service Center [Name of the Program]

[address] [address]
B-5