Conditions Under Which Confidential Information May Be Shared

Information that is protected by the Federal confidentiality regulations may always be disclosed after the client has signed a proper consent form. If the client is a minor, parental consent must also be obtained in some States. The regulations also permit disclosure without the client's consent in several situations, including communicating information to medical personnel during a medical emergency or reporting child abuse to the authorities.

The most commonly used exception to the general rule prohibiting disclosures is for a program to obtain the client's consent. The regulations' requirements regarding consent are somewhat unusual and strict and must be carefully followed.

Items required for disclosure of information

Disclosures are permissible if a client has signed a valid consent form that has not expired or been revoked (§2.31). A proper consent form must be in writing and must contain each of the items that appear in Figure B-1.

A general medical release form, or any consent form that does not contain all of the elements listed in Figure B-1, is not acceptable. A sample consent form may be found in Figure B-2. Two of the required items in Figure B-1 merit further explanation: the purpose of the disclosure and how much and what kind of information will be disclosed. These two items are closely related. All disclosures, especially those made pursuant to a consent form, must be limited to information that is necessary to accomplish the need for or purpose of the disclosure (§2.13(a)). It would be improper to disclose everything in a client's file if the person making the request needed only one specific piece of information.

Box

Figure B-1: Client Consent Form: Required Items. Name or general description of the program(s) making the disclosure Name or title of the individual or organization that will receive the disclosure Name of the client who is the subject of the disclosure (more...)

In completing a consent form, one must determine the purpose of or need for the communication of information. Once this has been identified, it is easier to determine how much and what kind of information will be disclosed and to restrict the disclosure to what is essential to accomplish the identified need or purpose. As an illustration, if a client needs to have the fact that he or she has entered a treatment program verified in order to be eligible for a benefit program, the purpose of the disclosure would be "to verify treatment status," and the amount and kind of information to be disclosed would be "enrollment in treatment." The disclosure would then be limited to a statement that "Jane Doe (the client) is receiving counseling at XYZ Program."

Decisions Concerning Disclosure

The fact that a client has signed a proper consent form authorizing the release of information does not force a program to make the proposed disclosure, unless the program has also received a subpoena or court order (§§2.3(b); 2.61(a)(b)).

The only obligation the program has is to refuse to honor a consent that is expired, deficient, or otherwise known to be revoked, false, or invalid (§2.31(c)).

In most cases, the decision whether or not to make a disclosure pursuant to a consent form is within the discretion of the program, unless State law requires or prohibits disclosure once consent is given. In general, it is best to follow this rule: Disclose only what is necessary, for only as long as is necessary, in light of the purpose of the communication.

Seeking Information From Collateral and Referral Sources

Making inquiries of parents, other relatives, health care providers, employers, schools, or criminal justice agencies might seem at first glance to pose no risk to a client's right to confidentiality, particularly if the person or entity approached for information referred the client to treatment. Nonetheless, it does.

When a program that screens, assesses, or treats a client asks a relative or parent, a doctor, an employer, or a school to verify information it has obtained from the client, it is making a "client-identifying disclosure." Client-identifying information is information that identifies someone as a substance abuser. In other words, when program staff seek information from other sources, they are letting these sources know that the client has asked for treatment services. The Federal regulations generally prohibit this kind of disclosure, unless the client consents.

How should a program go about making such requests? The easiest way is to get the client's consent to contact the relative, doctor, employer, school, or health care facility. When filling out the consent form, staff should give thought to the "purpose of the disclosure" and "how much and what kind of information is to be disclosed." For example, if a program is assessing a client for treatment and seeks records from a mental health provider, the purpose of the disclosure would be "to obtain mental health treatment records to complete the assessment." The "kind of information disclosed" would be limited to a statement that "Robert Roe (the client) is being assessed by the XYZ Program." No other information about Robert Roe would be released. If the program not only seeks records but also wishes to discuss with the mental health provider the treatment he or she provided the client, the purpose of the disclosure would be "to discuss mental health treatment provided to Robert Roe by the mental health program." If the program merely seeks information, the kind of information disclosed would, as in the example above, be limited to a statement that "Robert Roe is being assessed by the XYZ Program"; however, if the program needs to disclose information it has gained in its assessment of Robert Roe to the mental health provider in order to further the discussion or coordinate care, the kind of information disclosed would be "assessment information about Robert Roe."

A program that routinely seeks collateral information from many sources could consider asking the client to sign a consent form that permits it to make a disclosure for purposes of seeking information from collateral sources to any one of a number of entities or persons listed on the consent form. Such a form must still include "the name or title of the individual or the name of the organization" for each collateral source the program may contact.

Even when information is disclosed over the telephone, program staff are required to notify the recipient of the information of the prohibition on redisclosure. Mention should be made of this restriction during the conversation; for example, the staff member could say, "I'll be sending you a written statement that the information I gave you about Mr. Roe may not be redisclosed."

Communications with employers may warrant special consideration. When a client enters treatment voluntarily, program staff should maintain an open mind about whether communications with an employer would be beneficial to the client. A client who tells program staff that his or her employer will not be sympathetic about the decision to enter treatment may well have an accurate picture of the employer's attitude. Should staff insist on communicating with the employer, the client may lose his or her job. If such communication takes place without the client's consent, the program may be faced with a lawsuit. ⁵

Communications With Insurance Carriers

Programs must obtain a client's written consent on the form required by the Federal regulations in order to communicate with any third party payer who may be responsible for funding the client's treatment. Some clients do not want their treatment reported to the insurer. Clients whose employers are self-insured may fear they will be fired, demoted, or disciplined, should their employer learn they have a substance abuse problem. Clients whose treatment is covered by health insurance may fear they will lose their benefits and be unable to obtain other coverage once their current insurer discovers they have been treated for a substance abuse problem. What should programs do in these circumstances?

The program clearly cannot make a disclosure to a third party payer without the client's consent. If the third party payer is the client's employer, the program would not only be violating the Federal regulations but also would be risking a lawsuit, should the client be fired or disciplined. If the third party payer is an insurance company, the program is taking similar risks: If the client's insurance is canceled or he or she cannot obtain coverage elsewhere, the program may face a lawsuit. ⁶

If a client does not want the insurance carrier to be notified and is unable to pay for treatment, the program may refer the client to a publicly funded program, if one is available. ⁷ Programs should consult State law to learn whether they may refuse to admit a client who is unable to pay and who will not consent to the necessary disclosures to his or her insurance carrier.

Insurance carriers, particularly managed care entities, are demanding more and more information about the clients covered by their policies and the treatment provided to those clients. Programs need to be sensitive about the amount and kind of information they disclose, because the insurer may use this information to deny benefits to the client. For example, if, in response to a request from the insurer, the program releases the client's entire chart, the insurer may learn from the intake notes that the client's substance abuse problem included both alcohol and illegal drugs. The insurer may then deny benefits, arguing that since its policy does not cover treatment for abuse of drugs other than alcohol, it will not reimburse for treatment when abuse of both alcohol and drugs is involved. As a second example, the insurer may learn that the client began drinking at age 11 and deny benefits for a "preexisting condition." Treatment notes may contain personal information about the client's family life that is extraneous for insurance company review, the sole purpose of which is to determine whether treatment should be covered and, if so, what kind.

Communication Among Agencies

Telephone Calls to Clients

If someone telephones a client at a program, the staff may not reveal that the client is at the program unless the program has a written consent form signed by the client to make a disclosure to that particular caller. Given this restriction, how should a program handle telephone calls to clients? There are at least four options:

• The program can obtain the client's written consent to accept telephone calls from particular people and consult a list of these individuals' names when the client receives a phone call.
• If the client has not consented to receive calls from a particular person, the staff member can put the caller on hold and ask the client if he or she wants to speak to the caller. If the client wants to accept the call, the client, not the staff member, is making the disclosure that he or she is at the treatment program. If the client does not want to speak to the caller, the staff member must tell the caller, "I'm sorry, but I can't tell you whether Tommy Toe is here." At no time may the program reveal, even indirectly, that the person being inquired after is a client at the program.
• The program can uniformly take messages for clients, telling all callers, "I'm sorry, but I cannot tell you if Tommy is here, but if he is I will give him this message." Again, this leaves it up to the client whether to make a disclosure about being in treatment.
• The program can set up a "client phone" that is answered only by clients. Since only clients would answer the telephone and give the phone number to others if the number were unlisted, the program would be making no disclosures. The program should caution clients to act discreetly and thoughtfully when handling calls for others.

Clients Mandated Into Treatment By the Criminal Justice System

Programs treating clients who are required to enter and participate in treatment as part of a criminal justice sanction must follow the Federal confidentiality rules. In addition, some special rules apply when a client is in treatment as an official condition of probation, sentence, dismissal of charges, release from detention, or other disposition of any criminal proceeding, and information is being disclosed to the mandating agency.

A consent form or court order is still required before any disclosure may be made about an offender who is mandated into assessment or treatment. However, the rules concerning the length of time that a consent remains valid are different, and a "criminal justice system consent" may not be revoked before its expiration event or date.

The regulations require that the following factors be considered in determining how long a criminal justice system consent will remain in effect:

• The anticipated duration of treatment
• The type of criminal proceeding in which the offender is involved
• The need for treatment information in dealing with the proceeding
• When the final disposition will occur
• Anything else the client, program, or criminal justice agency believes is relevant.

These rules allow programs to continue to use a traditional expiration condition for a consent form that once was the only one allowed, namely, "when there is a substantial change in the client's criminal justice system status." A substantial change in status occurs whenever the client moves from one phase of the criminal justice system to the next. For example, if a client is on probation or parole, a change in criminal justice status would occur when the probation or parole ended, either by successful completion or revocation. Thus, the program could provide treatment or periodic reports to the probation or parole officer monitoring the client and could even testify at a revocation hearing if it so desired, since no change in criminal justice status would occur until after that hearing. This formula appears to work well.

Concerning revocability of the consent (that is, the conditions under which the offender can take back his or her consent), the regulations provide that the form may state that consent may not be revoked until a specified date arrives or condition occurs. The regulations permit the criminal justice system consent form to be irrevocable, so that a client who has agreed to enter treatment in lieu of prosecution or punishment cannot later prevent the court, probation department, or other agency from monitoring his or her progress. Although a criminal justice system consent may be made irrevocable for a specified period of time, its irrevocability must end no later than the final disposition of the criminal proceeding. Thereafter, the client may freely revoke consent.

Several other considerations relating to criminal justice system referrals are important. First, any information received by one of the eligible criminal justice agencies from a treatment program may be used by that justice agency only in connection with its official duties with respect to that particular criminal proceeding. The information may not be used in other proceedings, for other purposes, or with respect to other individuals (§2.34(d)). Second, whenever possible, the judge or referring agency should require that a proper criminal justice system consent form be signed by the client at the time he or she is referred to the treatment program. If this is not possible, the treatment program should have the client sign a criminal justice system consent form at his or her first appointment. With a properly signed criminal justice consent form, the treatment program can communicate with the referring criminal justice agency, even if the client appears for assessment or treatment only once. This avoids the problems that may arise if a client mandated into treatment does not sign a proper consent form and leaves before the assessment or treatment has been completed.

If a program fails to have the client sign a criminal justice system form and the client fails to complete the assessment or treatment, the program has few options when faced with a request for information from the referring criminal justice agency. The program could attempt to locate the client and ask him or her to sign a consent form. The client is, however, unlikely to do so. It is uncertain whether a court can issue an order to authorize the program to release information about a referred client who has left the program in this type of case, because the regulations allow a court to order disclosure of treatment information for the purpose of investigating or prosecuting a client for a crime only when the crime was "extremely serious." A parole or probation violation generally will not meet that criterion.

Therefore, unless the judge, criminal justice agency, or program obtains consent at the beginning of the assessment or treatment process, the program may be prevented from providing any information to the referring criminal justice agency.

If a client referred by a criminal justice agency never applies for or receives services from the program, that fact may be communicated to the referring agency without client consent (§2.13(c)(2)). As soon as a client has made an appointment to visit the program, a signed consent form or a court order is needed for any disclosures.

Driving While Impaired

Suppose that an intoxicated client arrives at a treatment program but decides not to enter treatment. If the client is not in condition to drive home, what should the program do? First, it can offer the client a ride home or taxi fare for a ride home. Second, it can maintain a room where such a person can "sleep it off." (The program would be wise to obtain the person's consent to alert his or her family.) This strategy can also be used by programs that do not admit clients who are inebriated.

What if the client refuses both offers and leaves the premises, intending to drive home? Does the program have a duty to call the police to prevent an accident? Does it risk a lawsuit if it fails to do so? This is a question of State law.

In most States, it is unlikely that the program would be liable, particularly if it had made an effort to stop the client from driving. As noted in Chapter 5, in States that follow the Tarasoff doctrine, liability has generally been limited to those situations where a client threatens to harm a specific person. Liability has generally not been imposed in situations where a client poses a threat to the community in general.

Liability concerns aside, the program may nonetheless believe it is obligated to call the police if its attempts to prevent the client from driving fail. In doing so, it must take care not to violate the client's confidentiality. For example, the program can call the police and tell them that the driver of a 1991 tan Nissan with a license number "XYZ 123," who is heading downtown from the intersection of Maple and Third streets, is not in a condition to operate a vehicle. The program should ask the police to respond immediately. The program may not tell the police that the client has a substance abuse problem. This means it may not tell the police that the client is impaired by alcohol or drugs and cannot reveal the program's name, since to do so would tell the police that the client has a substance abuse problem.

In order to get the client's license number and a description of his or her car, it may be necessary to detain the client. If it does so, the program should avoid using force, since the client could sue the program for battery or false imprisonment.

Conducting Research

Research about and evaluation of the efficacy of different methods of treatment are essential to advances in the field. But can programs share client-identifying information with researchers and program evaluators? The confidentiality regulations do permit programs to disclose client-identifying information to researchers, auditors, and evaluators without client consent, provided certain safeguards are met (§§2.52, 2.53).

Communications That Do Not Disclose Client-Identifying Information

The Federal regulations permit programs to disclose information about a client if the program reveals no client-identifying information. Thus, a program may disclose information about a client if that information does not identify the client as a substance abuser or does not verify anyone else's identification of the client as a substance abuser.

A program may make a disclosure that does not identify a client in two ways. First, it may report aggregate data that give an overview of the clients served in the program or some portion of its population. For example, a program could tell the newspaper that in the last 6 months it had 43 clients, 10 female and 33 male. Second, a program may communicate information about a client in a way that does not reveal the client's status as a drug or alcohol abuse client (§2.12(a)(i)). For example, a program that provides services to clients with other problems or illnesses as well as alcohol or drug addiction may disclose information about a particular client as long as the fact that the client has a substance abuse problem is not revealed. To cite a more specific example, a counselor from a program that is part of a general hospital could call the police about a threat a client made, as long as he or she does not disclose that the client has an alcohol or drug abuse problem or is a client of the treatment program.

Programs that provide only alcohol or drug services or that provide a full range of services but are identified by the general public as drug or alcohol programs cannot disclose information that identifies a client under this exception, since letting someone know a counselor is calling from the "XYZ Program" will automatically identify the client as someone who got services from the program. However, a freestanding program may sometimes make "anonymous" disclosures, that is, disclosures that do not mention the name of the program or otherwise reveal the client's status as an alcohol or drug abuser.

Court-Ordered Disclosures

A State or Federal court may issue an authorizing order that will permit a program to make a disclosure about a client that would otherwise be forbidden. A court may issue one of these orders, however, only after it follows certain special procedures and makes particular determinations required by the regulations. A subpoena, search warrant, or arrest warrant, even when signed by a judge, is not sufficient standing alone to require, or even to permit, a program to disclose information (§2.61). ¹²

Before a court can issue an authorizing order, the program and any client whose records are sought must be given notice of the application for the order and some opportunity to make an oral or a written statement to the court. ¹³ Generally, the application and any court order must use fictitious names for any known client. All court proceedings in connection with the application must remain confidential, unless the client requests otherwise (§§2.64(a), (b), 2.65, 2.66).

Before issuing an authorizing order, the court must find that there is "good cause" for the disclosure. A court may find "good cause" only if it determines that the public interest and the need for disclosure outweigh any adverse effect that the disclosure will have on the client, the doctor-client or counselor-client relationship, and the effectiveness of the program's treatment services. Before it may issue an order, the court also must find that other ways of obtaining the information are unavailable or would be ineffective (§2.64(d)). ¹⁴ The judge may examine the records before making a decision (§2.64(c)).

There are also limits on the scope of disclosure that a court may authorize, even when it finds good cause. The disclosure must be limited to information essential to fulfill the purpose of the order and restricted to those persons who need the information for that purpose. The court also should take any other steps that are necessary to protect the client's confidentiality, including sealing court records from public scrutiny (§2.64(e)).

The court may order disclosure of "confidential communications" by a client to the program only if the disclosure is necessary to protect against a threat to life or of serious bodily injury or to investigate or prosecute an extremely serious crime (including child abuse), or is in connection with a proceeding at which the client has already presented evidence concerning confidential communications (§2.63).

Medical Emergencies

A program may make disclosures to public or private medical personnel "who have a need for information about a client for the purpose of treating a condition which poses an immediate threat to the health of any individual." The regulations define medical emergency as a situation that poses an immediate threat to health and requires immediate medical intervention (§2.51).

The medical emergency exception permits disclosure only to medical personnel. It cannot be used as the basis for a disclosure to the police or other nonmedical personnel, including parents. Under this exception, however, a program could notify a private physician about a suicidal client so that medical intervention could be arranged. The physician, in turn, could notify a client's parents or other relatives, as long as no mention were made of the client's substance abuse problem. Whenever a disclosure is made to cope with a medical emergency, the program must document in the client's records the name and affiliation of the recipient of the information, the name of the individual making the disclosure, the date and time of the disclosure, and the nature of the emergency.

Qualified Service Organization Agreements

If a program routinely needs to share certain information with an outside agency that provides services to the program, it can enter into a QSOA. A QSOA (Figure B-4) is a written agreement between a program and a person providing services to the program in which that person (1) acknowledges that in receiving, storing, processing, or otherwise dealing with any client records from the program, he or she is fully bound by [the Federal confidentiality] regulations; and (2) promises that, if necessary, he or she will resist in judicial proceedings any efforts to obtain access to client records except as permitted by these regulations (§§2.11, 2.12(c)(4)).

Box

Figure B-4: Qualified Service Organization Agreement. XYZ Service Center ("the Center") and the ____________________________________________ __________________________________________________________________________________

A QSOA should be used only when an agency or official outside of the program, for example, a clinical laboratory or data-processing agency, is providing a service to the program itself. An example is when laboratory analysis or data processing is performed for the program by an outside agency. A QSOA is not a substitute for individual consent in other situations. Disclosures under a QSOA must be limited to information that is needed by others so that the program can function effectively. QSOAs may not be used between programs providing alcohol and drug services.

Internal Program Communications

The Federal regulations permit some information to be disclosed to individuals within the same program:

The restrictions on disclosure in these regulations do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of alcohol or drug abuse if the communications are (i) within a program or (ii) between a program and an entity that has direct administrative control over that program. (§2.12(c)(3))

In other words, staff (including full- or part-time employees and unpaid volunteers) who have access to client records because they work for or administratively direct the program may consult among themselves or otherwise share information if their substance abuse work so requires.

Does this exception allow a treatment program that is part of a larger entity, such as a hospital, to share confidential information with others that are not part of the treatment unit? The answer to this question is quite complicated. In brief, there are circumstances under which the treatment unit may share information with other units that are part of the greater entity to which it belongs. Before such an internal communication system is set up within a large institution, however, it is essential that an expert in the area be consulted.

Client Notice and Access to Records

The Federal confidentiality regulations require programs to notify clients of their right to confidentiality and to give them a written summary of the regulations' requirements. The notice and summary should be handed to clients when they enter the program or shortly thereafter (§2.22(a)). The regulations contain a sample notice that may be used for this purpose.

Unless State law grants the right of client access to records, programs have the right to decide when to permit clients to view or obtain copies of their records. The Federal regulations do not require programs to obtain written consent from clients before permitting them to see their own records.

Security of Records

The Federal regulations require programs to keep written records in a secure room, locked file cabinet, safe, or other similar container. The program should establish written procedures that regulate access to and use of client records. The program director or a single staff person should be designated to process inquiries and requests for information (§2.16).