NCBI Bookshelf. A service of the National Library of Medicine, National Institutes of Health.
Center for Substance Abuse Treatment. Substance Abuse Treatment and Domestic Violence. Rockville (MD): Substance Abuse and Mental Health Services Administration (US); 1997. (Treatment Improvement Protocol (TIP) Series, No. 25.)
by Margaret K. Brooks, Esq. 1
Federal law (United States Code, Title 42, §§290dd-2 [1992]) and the Federal regulations that implement it -- Title 42, Part 2, of the Code of Federal Regulations (42 C.F.R. Part 2) -- guarantee the strict confidentiality of information about all persons receiving substance abuse prevention and treatment services. 2 They are designed to protect privacy rights and thereby attract individuals into treatment. The regulations are more restrictive of communications than are those governing the doctor-client relationship or the attorney-client privilege. Violating the regulations is punishable by a fine of up to $500 for a first offense or up to $5,000 for each subsequent offense (§2.4).
While some persons may view the restrictions that Federal regulations place on communications as a hindrance, if not a barrier, to program goals, due foresight can eliminate most of the problems that arise from the regulations. Familiarity with the regulations will facilitate communication and minimize the incidence of confidentiality-related conflicts among program, client, and outside agencies.
Types of Programs Covered by the Regulations
Any program that specializes, in whole or in part, in providing treatment, counseling and assessment, and referral services, or a combination thereof, for clients with alcohol or other drug problems must comply with the Federal confidentiality regulations (§2.12(e)). It is the kind of services provided, not the label, that determines whether a program must comply with the Federal law. Calling itself a "prevention program" does not insulate a program that also offers treatment services from the need to comply with confidentiality regulations. Although the Federal regulations apply only to programs that receive Federal assistance, the word assistance is broadly interpreted and includes indirect forms of Federal aid such as tax-exempt status or State or local funding that is derived, in whole or in part, from the Federal government.
Federal Confidentiality Laws
The Federal confidentiality law and regulations protect any information about a client if the client has applied for or received any alcohol- or drug abuse-related services—including assessment, diagnosis, detoxification, counseling, group counseling, treatment, and referral for treatment -- from a covered program. 3 The restrictions on disclosure apply to any information that would identify the client as a substance abuser, either directly or by implication. The rule applies from the moment the client makes an appointment. It applies to clients who are civilly or involuntarily committed, minors, clients who are mandated into treatment by the criminal justice system, and former clients. Finally, the rule applies whether or not the person making the inquiry already has the information, has other ways of getting it, enjoys official status, is authorized by State law, or comes armed with a subpoena or search warrant. 4
Conditions Under Which Confidential Information May Be Shared
Information that is protected by the Federal confidentiality regulations may always be disclosed after the client has signed a proper consent form. If the client is a minor, parental consent must also be obtained in some States. The regulations also permit disclosure without the client's consent in several situations, including communicating information to medical personnel during a medical emergency or reporting child abuse to the authorities.
The most commonly used exception to the general rule prohibiting disclosures is for a program to obtain the client's consent. The regulations' requirements regarding consent are somewhat unusual and strict and must be carefully followed.
Items required for disclosure of information
Disclosures are permissible if a client has signed a valid consent form that has not expired or been revoked (§2.31). A proper consent form must be in writing and must contain each of the items that appear in Figure B-1.
A general medical release form, or any consent form that does not contain all of the elements listed in Figure B-1, is not acceptable. A sample consent form may be found in Figure B-2. Two of the required items in Figure B-1 merit further explanation: the purpose of the disclosure and how much and what kind of information will be disclosed. These two items are closely related. All disclosures, especially those made pursuant to a consent form, must be limited to information that is necessary to accomplish the need for or purpose of the disclosure (§2.13(a)). It would be improper to disclose everything in a client's file if the person making the request needed only one specific piece of information.
In completing a consent form, one must determine the purpose of or need for the communication of information. Once this has been identified, it is easier to determine how much and what kind of information will be disclosed and to restrict the disclosure to what is essential to accomplish the identified need or purpose. As an illustration, if a client needs to have the fact that he or she has entered a treatment program verified in order to be eligible for a benefit program, the purpose of the disclosure would be "to verify treatment status," and the amount and kind of information to be disclosed would be "enrollment in treatment." The disclosure would then be limited to a statement that "Jane Doe (the client) is receiving counseling at XYZ Program."
The client's right to revoke consent
The client may revoke consent at any time, and the consent form must include a statement to this effect. Revocation need not be in writing. If a program has made a disclosure prior to the revocation, the program has "acted in reliance" on the consent and is not required to try to retrieve the information it has already disclosed.
The regulations state that acting in reliance includes providing services in reliance on a consent form permitting disclosures to a third party payer. Thus, a program may bill the third party payer for past services to the client even after consent has been revoked. A program may not, however, make any disclosure to the third party payer in order to receive reimbursement for services provided after the client has revoked consent (§2.31(a)(8)).
Expiration of the consent form
The form must also contain a date, an event, or a condition on which it will expire, if not previously revoked. A consent must last "no longer than reasonably necessary to serve the purpose for which it is given" (§2.31(a)(9)). If the purpose of the disclosure is expected to be accomplished in 5 or 10 days, it is better to stipulate that amount of time rather than to request a longer period or have a uniform 60- or 90-day expiration date for all forms.
The consent form may specify an event or a condition for expiration, rather than a date. For example, if a client has been placed on probation on the condition that he or she attend the treatment program, the consent form should not expire until the expected time of completion of the probationary period. Alternatively, if a client is being referred by the program to a specialist for a single appointment, the consent form should say that consent will expire after he or she has seen "Dr. X," unless the client is expected to need ongoing consultation with the specialist.
Signatures of minors and parental consent
In order for a program to release information about a minor, even to his or her parent or guardian, the minor must have signed a consent form. The program must obtain the parent's signature to make a disclosure to anyone else only if it was required by State law to obtain parental permission before providing treatment to the minor (§2.14). (Parent includes parent, guardian, or other person legally responsible for the minor.) In other words, if State law does not require the program to get parental consent in order to provide services to a minor, parental consent is not required to make disclosures (§2.14(b)). If, by contrast, State law requires parental consent to provide services to minors, parental consent also is required to make any disclosures.
Required notice against redisclosing information
Once the consent form has been properly completed, one formal requirement remains. Any disclosure made with written client consent must be accompanied by a written statement that the information disclosed is protected by Federal law and that the recipient may not make any further disclosure unless permitted by the regulations (§2.32). This statement, not the consent form itself, should be delivered and explained to the recipient at the time of disclosure or earlier.
The prohibition on redisclosure is clear and strict. Those who receive the notice are prohibited from rereleasing information except as permitted by the regulations. A client may, of course, sign a consent form authorizing such a redisclosure. A sample Notice of Prohibition appears in Figure B-3.
Decisions Concerning Disclosure
The fact that a client has signed a proper consent form authorizing the release of information does not force a program to make the proposed disclosure, unless the program has also received a subpoena or court order (§§2.3(b); 2.61(a)(b)).
The only obligation the program has is to refuse to honor a consent that is expired, deficient, or otherwise known to be revoked, false, or invalid (§2.31(c)).
In most cases, the decision whether or not to make a disclosure pursuant to a consent form is within the discretion of the program, unless State law requires or prohibits disclosure once consent is given. In general, it is best to follow this rule: Disclose only what is necessary, for only as long as is necessary, in light of the purpose of the communication.
Rules Governing Communication of Information
Seeking Information From Collateral and Referral Sources
Making inquiries of parents, other relatives, health care providers, employers, schools, or criminal justice agencies might seem at first glance to pose no risk to a client's right to confidentiality, particularly if the person or entity approached for information referred the client to treatment. Nonetheless, it does.
When a program that screens, assesses, or treats a client asks a relative or parent, a doctor, an employer, or a school to verify information it has obtained from the client, it is making a "client-identifying disclosure." Client-identifying information is information that identifies someone as a substance abuser. In other words, when program staff seek information from other sources, they are letting these sources know that the client has asked for treatment services. The Federal regulations generally prohibit this kind of disclosure, unless the client consents.
How should a program go about making such requests? The easiest way is to get the client's consent to contact the relative, doctor, employer, school, or health care facility. When filling out the consent form, staff should give thought to the "purpose of the disclosure" and "how much and what kind of information is to be disclosed." For example, if a program is assessing a client for treatment and seeks records from a mental health provider, the purpose of the disclosure would be "to obtain mental health treatment records to complete the assessment." The "kind of information disclosed" would be limited to a statement that "Robert Roe (the client) is being assessed by the XYZ Program." No other information about Robert Roe would be released. If the program not only seeks records but also wishes to discuss with the mental health provider the treatment he or she provided the client, the purpose of the disclosure would be "to discuss mental health treatment provided to Robert Roe by the mental health program." If the program merely seeks information, the kind of information disclosed would, as in the example above, be limited to a statement that "Robert Roe is being assessed by the XYZ Program"; however, if the program needs to disclose information it has gained in its assessment of Robert Roe to the mental health provider in order to further the discussion or coordinate care, the kind of information disclosed would be "assessment information about Robert Roe."
A program that routinely seeks collateral information from many sources could consider asking the client to sign a consent form that permits it to make a disclosure for purposes of seeking information from collateral sources to any one of a number of entities or persons listed on the consent form. Such a form must still include "the name or title of the individual or the name of the organization" for each collateral source the program may contact.
Even when information is disclosed over the telephone, program staff are required to notify the recipient of the information of the prohibition on redisclosure. Mention should be made of this restriction during the conversation; for example, the staff member could say, "I'll be sending you a written statement that the information I gave you about Mr. Roe may not be redisclosed."
Communications with employers may warrant special consideration. When a client enters treatment voluntarily, program staff should maintain an open mind about whether communications with an employer would be beneficial to the client. A client who tells program staff that his or her employer will not be sympathetic about the decision to enter treatment may well have an accurate picture of the employer's attitude. Should staff insist on communicating with the employer, the client may lose his or her job. If such communication takes place without the client's consent, the program may be faced with a lawsuit. 5
Communications With Insurance Carriers
Programs must obtain a client's written consent on the form required by the Federal regulations in order to communicate with any third party payer who may be responsible for funding the client's treatment. Some clients do not want their treatment reported to the insurer. Clients whose employers are self-insured may fear they will be fired, demoted, or disciplined, should their employer learn they have a substance abuse problem. Clients whose treatment is covered by health insurance may fear they will lose their benefits and be unable to obtain other coverage once their current insurer discovers they have been treated for a substance abuse problem. What should programs do in these circumstances?
The program clearly cannot make a disclosure to a third party payer without the client's consent. If the third party payer is the client's employer, the program would not only be violating the Federal regulations but also would be risking a lawsuit, should the client be fired or disciplined. If the third party payer is an insurance company, the program is taking similar risks: If the client's insurance is canceled or he or she cannot obtain coverage elsewhere, the program may face a lawsuit. 6
If a client does not want the insurance carrier to be notified and is unable to pay for treatment, the program may refer the client to a publicly funded program, if one is available. 7 Programs should consult State law to learn whether they may refuse to admit a client who is unable to pay and who will not consent to the necessary disclosures to his or her insurance carrier.
Insurance carriers, particularly managed care entities, are demanding more and more information about the clients covered by their policies and the treatment provided to those clients. Programs need to be sensitive about the amount and kind of information they disclose, because the insurer may use this information to deny benefits to the client. For example, if, in response to a request from the insurer, the program releases the client's entire chart, the insurer may learn from the intake notes that the client's substance abuse problem included both alcohol and illegal drugs. The insurer may then deny benefits, arguing that since its policy does not cover treatment for abuse of drugs other than alcohol, it will not reimburse for treatment when abuse of both alcohol and drugs is involved. As a second example, the insurer may learn that the client began drinking at age 11 and deny benefits for a "preexisting condition." Treatment notes may contain personal information about the client's family life that is extraneous for insurance company review, the sole purpose of which is to determine whether treatment should be covered and, if so, what kind.
Communication Among Agencies
Communication with other care providers
Treatment programs sometimes need to maintain ongoing communication with the referral source or with other professionals providing services to clients. The best way to proceed is to get the client's consent.
In wording the consent form, one should take care to permit the kinds of communications necessary. For example, if the program will need ongoing communication with a mental health provider, the "purpose of the disclosure" would be "coordination of care for Mildred Moe"; "how much and what kind of information to be disclosed" might be "treatment status, treatment issues, progress in treatment." If the program is treating a client who is on probation at work and whose continued employment is contingent on treatment, the "purpose of disclosure" might be "to assist the client to comply with employer's mandates" or "supply periodic reports about treatment"; "how much and what kind of information will be disclosed" might be "progress in treatment." The kinds of information that would be disclosed in the two examples are quite different. The program might well share detailed clinical information about a client with a mental health provider, if it would assist in coordinating care. Disclosure to an employer, by contrast, would generally be limited to a brief statement about the client's progress in treatment. Disclosure of clinical information to an employer generally would be inappropriate.
The program should also be careful in setting the expiration date or event on which expiration of the consent form is based. A consent form with a mental health provider might expire when treatment ends, while a form permitting disclosures to an employer might expire when the client's probationary period at work ends.
Referral for additional services
When a staff member of a treatment program refers a client to another program for services (e.g., domestic violence support or vocational rehabilitation) and makes an appointment for the client, he or she is making a disclosure covered by the Federal regulations—a disclosure that the client has sought or received substance abuse treatment services. A consent form is, therefore, required. If the substance abuse treatment program is part of a larger program to which the client is being referred, a consent form may not be necessary under the Federal rules, since there is an exception for information disclosed to staff within the same program.
Transferring clients to the hospital
Substance abuse treatment programs, particularly those with limited medical resources, may transfer clients to a hospital for intensive medical management and care. How should programs handle such transfers, since they involve a disclosure of client-identifying information?
Programs may deal with this issue in two ways. First, they may ask all clients admitted to treatment to sign a consent form permitting disclosure to the cooperating hospital, should hospitalization be required. Second, they may take advantage of a provision in the Federal regulations that permits a program to make disclosures in a "medical emergency" to medical personnel "who have a need for information about a client for the purpose of treating a condition which poses an immediate threat to the health of any individual." The regulations define "medical emergency" as "a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention" (§2.51). If a client's condition requires emergency treatment, the program may use this exception to communicate with medical personnel at a hospital. Whenever a disclosure is made to cope with a medical emergency, the program must document in the client's records the name and affiliation of the recipient of the information, the name of the individual making the disclosure, the date and time of the disclosure, and the nature of the emergency.
Mandatory reporting to public health authorities
All States require that new cases of acquired immunodeficiency syndrome (AIDS) be reported to public health authorities, which submit this information to the Federal Centers for Disease Control and Prevention. In some cases, they also use it for other purposes. Some States also require the reporting of new cases of human immunodeficiency virus (HIV) infection. States also require reporting of certain infectious diseases, such as tuberculosis and sexually transmitted diseases. The public health authority often uses reports of infectious diseases to engage in "contact tracing," that is, finding others to whom an infected person may have spread the disease.
The types of information that must be reported and for which diseases, who must report, and the purposes to which the information is put vary from State to State. Therefore, program directors must examine their State laws to discover (1) whether they or any member of their staff is a mandated reporter, (2) when reporting is required, (3) what information must be reported and whether it includes client-identifying information, and (4) what will be done with the information reported. 8
If State law permits the use of a code rather than a client's name, the program may make the report without the client's consent since no client-identifying information is being revealed.
If client-identifying information must be reported, there are a number of ways programs can comply with State mandatory reporting laws without violating the Federal confidentiality regulations. They include the following:
- Obtaining consent. The easiest way to comply with a State law that mandates reporting of client-identifying information to a public health authority is to obtain the client's consent. The information reported by the program may not be redisclosed by the public health authority unless the consent form is drafted to permit redisclosure.
- Reporting without making a client-identifying disclosure. If the program is part of another health care facility (for example, a general hospital or mental health program), it can include the client's name in reports if it does so under the name of the parent agency, as long as no information is released that would link the client with substance abuse treatment.
- Using a Qualified Service Organization Agreement (QSOA). A treatment program that is required to report clients' names to a public health department also may enter into a QSOA with a general medical care facility or a laboratory that conducts testing or other services for the program. The QSOA, which is explained in detail later in this appendix, permits the program to report the names of clients to the medical care facility or laboratory, which may then report the information, including client names, to the public heath department. However, no information is provided that would link those names with substance abuse treatment.
- Reporting under the audit and evaluation exception. One of the exceptions to the general rule prohibiting disclosure without client consent is found in §2.53, which permits programs, under certain conditions, to disclose information to auditors and evaluators. The U.S. Department of Health and Human Services (DHHS) has written two opinion letters that approve the use of the audit and evaluation exception to report HIV-related information to public health authorities. 9 Read together, these two letters suggest that substance abuse programs may report client-identifying information even if that information will be used by the public health department to conduct contact tracing, as long as the health department does not disclose the name of the client to the "contacts" it approaches. The letters also suggest that the public health authorities could use the information to contact the infected client directly. Section 2.53 is intended to permit an outside entity, such as a peer review organization or an accounting firm, to examine or copy a program's records in order to determine whether it is operating in accordance with regulations. It was not intended to permit an outside entity to gain information to perform other tasks or accomplish other social ends. The legal validity of these two letters may, therefore, be considered debatable.
Telephone Calls to Clients
If someone telephones a client at a program, the staff may not reveal that the client is at the program unless the program has a written consent form signed by the client to make a disclosure to that particular caller. Given this restriction, how should a program handle telephone calls to clients? There are at least four options:
- The program can obtain the client's written consent to accept telephone calls from particular people and consult a list of these individuals' names when the client receives a phone call.
- If the client has not consented to receive calls from a particular person, the staff member can put the caller on hold and ask the client if he or she wants to speak to the caller. If the client wants to accept the call, the client, not the staff member, is making the disclosure that he or she is at the treatment program. If the client does not want to speak to the caller, the staff member must tell the caller, "I'm sorry, but I can't tell you whether Tommy Toe is here." At no time may the program reveal, even indirectly, that the person being inquired after is a client at the program.
- The program can uniformly take messages for clients, telling all callers, "I'm sorry, but I cannot tell you if Tommy is here, but if he is I will give him this message." Again, this leaves it up to the client whether to make a disclosure about being in treatment.
- The program can set up a "client phone" that is answered only by clients. Since only clients would answer the telephone and give the phone number to others if the number were unlisted, the program would be making no disclosures. The program should caution clients to act discreetly and thoughtfully when handling calls for others.
Clients Mandated Into Treatment By the Criminal Justice System
Programs treating clients who are required to enter and participate in treatment as part of a criminal justice sanction must follow the Federal confidentiality rules. In addition, some special rules apply when a client is in treatment as an official condition of probation, sentence, dismissal of charges, release from detention, or other disposition of any criminal proceeding, and information is being disclosed to the mandating agency.
A consent form or court order is still required before any disclosure may be made about an offender who is mandated into assessment or treatment. However, the rules concerning the length of time that a consent remains valid are different, and a "criminal justice system consent" may not be revoked before its expiration event or date.
The regulations require that the following factors be considered in determining how long a criminal justice system consent will remain in effect:
- The anticipated duration of treatment
- The type of criminal proceeding in which the offender is involved
- The need for treatment information in dealing with the proceeding
- When the final disposition will occur
- Anything else the client, program, or criminal justice agency believes is relevant.
These rules allow programs to continue to use a traditional expiration condition for a consent form that once was the only one allowed, namely, "when there is a substantial change in the client's criminal justice system status." A substantial change in status occurs whenever the client moves from one phase of the criminal justice system to the next. For example, if a client is on probation or parole, a change in criminal justice status would occur when the probation or parole ended, either by successful completion or revocation. Thus, the program could provide treatment or periodic reports to the probation or parole officer monitoring the client and could even testify at a revocation hearing if it so desired, since no change in criminal justice status would occur until after that hearing. This formula appears to work well.
Concerning revocability of the consent (that is, the conditions under which the offender can take back his or her consent), the regulations provide that the form may state that consent may not be revoked until a specified date arrives or condition occurs. The regulations permit the criminal justice system consent form to be irrevocable, so that a client who has agreed to enter treatment in lieu of prosecution or punishment cannot later prevent the court, probation department, or other agency from monitoring his or her progress. Although a criminal justice system consent may be made irrevocable for a specified period of time, its irrevocability must end no later than the final disposition of the criminal proceeding. Thereafter, the client may freely revoke consent.
Several other considerations relating to criminal justice system referrals are important. First, any information received by one of the eligible criminal justice agencies from a treatment program may be used by that justice agency only in connection with its official duties with respect to that particular criminal proceeding. The information may not be used in other proceedings, for other purposes, or with respect to other individuals (§2.34(d)). Second, whenever possible, the judge or referring agency should require that a proper criminal justice system consent form be signed by the client at the time he or she is referred to the treatment program. If this is not possible, the treatment program should have the client sign a criminal justice system consent form at his or her first appointment. With a properly signed criminal justice consent form, the treatment program can communicate with the referring criminal justice agency, even if the client appears for assessment or treatment only once. This avoids the problems that may arise if a client mandated into treatment does not sign a proper consent form and leaves before the assessment or treatment has been completed.
If a program fails to have the client sign a criminal justice system form and the client fails to complete the assessment or treatment, the program has few options when faced with a request for information from the referring criminal justice agency. The program could attempt to locate the client and ask him or her to sign a consent form. The client is, however, unlikely to do so. It is uncertain whether a court can issue an order to authorize the program to release information about a referred client who has left the program in this type of case, because the regulations allow a court to order disclosure of treatment information for the purpose of investigating or prosecuting a client for a crime only when the crime was "extremely serious." A parole or probation violation generally will not meet that criterion.
Therefore, unless the judge, criminal justice agency, or program obtains consent at the beginning of the assessment or treatment process, the program may be prevented from providing any information to the referring criminal justice agency.
If a client referred by a criminal justice agency never applies for or receives services from the program, that fact may be communicated to the referring agency without client consent (§2.13(c)(2)). As soon as a client has made an appointment to visit the program, a signed consent form or a court order is needed for any disclosures.
Driving While Impaired
Suppose that an intoxicated client arrives at a treatment program but decides not to enter treatment. If the client is not in condition to drive home, what should the program do? First, it can offer the client a ride home or taxi fare for a ride home. Second, it can maintain a room where such a person can "sleep it off." (The program would be wise to obtain the person's consent to alert his or her family.) This strategy can also be used by programs that do not admit clients who are inebriated.
What if the client refuses both offers and leaves the premises, intending to drive home? Does the program have a duty to call the police to prevent an accident? Does it risk a lawsuit if it fails to do so? This is a question of State law.
In most States, it is unlikely that the program would be liable, particularly if it had made an effort to stop the client from driving. As noted in Chapter 5, in States that follow the Tarasoff doctrine, liability has generally been limited to those situations where a client threatens to harm a specific person. Liability has generally not been imposed in situations where a client poses a threat to the community in general.
Liability concerns aside, the program may nonetheless believe it is obligated to call the police if its attempts to prevent the client from driving fail. In doing so, it must take care not to violate the client's confidentiality. For example, the program can call the police and tell them that the driver of a 1991 tan Nissan with a license number "XYZ 123," who is heading downtown from the intersection of Maple and Third streets, is not in a condition to operate a vehicle. The program should ask the police to respond immediately. The program may not tell the police that the client has a substance abuse problem. This means it may not tell the police that the client is impaired by alcohol or drugs and cannot reveal the program's name, since to do so would tell the police that the client has a substance abuse problem.
In order to get the client's license number and a description of his or her car, it may be necessary to detain the client. If it does so, the program should avoid using force, since the client could sue the program for battery or false imprisonment.
Conducting Research
Research about and evaluation of the efficacy of different methods of treatment are essential to advances in the field. But can programs share client-identifying information with researchers and program evaluators? The confidentiality regulations do permit programs to disclose client-identifying information to researchers, auditors, and evaluators without client consent, provided certain safeguards are met (§§2.52, 2.53).
Research
Treatment programs may disclose client-identifying information to persons conducting "scientific research" if the program director determines that the researcher (1) is qualified to conduct the research, (2) has a protocol under which client-identifying information will be kept in accordance with the regulations' security provisions (see §2.16, as described below), and (3) has provided a written statement from a group of three or more independent individuals who have reviewed the protocol and determined that it protects clients' rights. Researchers are prohibited from identifying an individual client in any report or from otherwise disclosing any client identities, except back to the program. 10
Audit and evaluation
Federal, State, and local government agencies that fund or are authorized to regulate a program, private entities that fund or provide third party payments to a program, and peer review entities performing a utilization or quality control review may review client records on the program premises in order to conduct an audit or evaluation. 11 Any person or entity that reviews client records to perform an audit or conduct an evaluation must agree in writing that it will use the information only to carry out the audit or evaluation and that it will redisclose client information only (1) back to the program, (2) in accordance with a court order to investigate or prosecute the program (§2.66), or (3) to a government agency overseeing a Medicare or Medicaid audit or evaluation (§2.53(a), (c), (d)). Any other person or entity that is determined by the program director to be qualified to conduct an audit or evaluation and that agrees in writing to abide by the restrictions on redisclosure also may review client records.
Followup research
Research that follows clients for any period of time after they leave treatment presents a special challenge under the Federal regulations. The treatment program, researcher, or evaluator who seeks to contact former clients to gain information about how they are faring after leaving treatment must do so without disclosing to others any information about their connection to the treatment program. If followup contact is attempted by telephone, the caller must make sure he or she is talking to the client before identifying himself or herself or mentioning a connection to the treatment program. For example, asking for "William Woe," when his wife or child has answered the phone, and announcing that one is calling from the "ABC Treatment Program" (or the "Drug Research Corporation") violates the regulations. The program or research agency may form another entity, without a hint of drug or alcohol treatment in its name (for example, Health Research, Inc.) that can contact former clients without worrying about disclosing information simply by giving its name. When a representative of such an entity calls former clients, however, care must be taken that the client is actually on the line before revealing any connection with the treatment program.
If followup is done by mail, the return address should not disclose any information that could lead someone seeing the envelope to conclude that the addressee had been in treatment.
Five Other Exceptions To the General Confidentiality Rule
Reference has been made to other exceptions the Federal confidentiality rules make to the general rule prohibiting disclosure. Presented below are five additional categories of exceptions to the general rule.
Communications That Do Not Disclose Client-Identifying Information
The Federal regulations permit programs to disclose information about a client if the program reveals no client-identifying information. Thus, a program may disclose information about a client if that information does not identify the client as a substance abuser or does not verify anyone else's identification of the client as a substance abuser.
A program may make a disclosure that does not identify a client in two ways. First, it may report aggregate data that give an overview of the clients served in the program or some portion of its population. For example, a program could tell the newspaper that in the last 6 months it had 43 clients, 10 female and 33 male. Second, a program may communicate information about a client in a way that does not reveal the client's status as a drug or alcohol abuse client (§2.12(a)(i)). For example, a program that provides services to clients with other problems or illnesses as well as alcohol or drug addiction may disclose information about a particular client as long as the fact that the client has a substance abuse problem is not revealed. To cite a more specific example, a counselor from a program that is part of a general hospital could call the police about a threat a client made, as long as he or she does not disclose that the client has an alcohol or drug abuse problem or is a client of the treatment program.
Programs that provide only alcohol or drug services or that provide a full range of services but are identified by the general public as drug or alcohol programs cannot disclose information that identifies a client under this exception, since letting someone know a counselor is calling from the "XYZ Program" will automatically identify the client as someone who got services from the program. However, a freestanding program may sometimes make "anonymous" disclosures, that is, disclosures that do not mention the name of the program or otherwise reveal the client's status as an alcohol or drug abuser.
Court-Ordered Disclosures
A State or Federal court may issue an authorizing order that will permit a program to make a disclosure about a client that would otherwise be forbidden. A court may issue one of these orders, however, only after it follows certain special procedures and makes particular determinations required by the regulations. A subpoena, search warrant, or arrest warrant, even when signed by a judge, is not sufficient standing alone to require, or even to permit, a program to disclose information (§2.61). 12
Before a court can issue an authorizing order, the program and any client whose records are sought must be given notice of the application for the order and some opportunity to make an oral or a written statement to the court. 13 Generally, the application and any court order must use fictitious names for any known client. All court proceedings in connection with the application must remain confidential, unless the client requests otherwise (§§2.64(a), (b), 2.65, 2.66).
Before issuing an authorizing order, the court must find that there is "good cause" for the disclosure. A court may find "good cause" only if it determines that the public interest and the need for disclosure outweigh any adverse effect that the disclosure will have on the client, the doctor-client or counselor-client relationship, and the effectiveness of the program's treatment services. Before it may issue an order, the court also must find that other ways of obtaining the information are unavailable or would be ineffective (§2.64(d)). 14 The judge may examine the records before making a decision (§2.64(c)).
There are also limits on the scope of disclosure that a court may authorize, even when it finds good cause. The disclosure must be limited to information essential to fulfill the purpose of the order and restricted to those persons who need the information for that purpose. The court also should take any other steps that are necessary to protect the client's confidentiality, including sealing court records from public scrutiny (§2.64(e)).
The court may order disclosure of "confidential communications" by a client to the program only if the disclosure is necessary to protect against a threat to life or of serious bodily injury or to investigate or prosecute an extremely serious crime (including child abuse), or is in connection with a proceeding at which the client has already presented evidence concerning confidential communications (§2.63).
Medical Emergencies
A program may make disclosures to public or private medical personnel "who have a need for information about a client for the purpose of treating a condition which poses an immediate threat to the health of any individual." The regulations define medical emergency as a situation that poses an immediate threat to health and requires immediate medical intervention (§2.51).
The medical emergency exception permits disclosure only to medical personnel. It cannot be used as the basis for a disclosure to the police or other nonmedical personnel, including parents. Under this exception, however, a program could notify a private physician about a suicidal client so that medical intervention could be arranged. The physician, in turn, could notify a client's parents or other relatives, as long as no mention were made of the client's substance abuse problem. Whenever a disclosure is made to cope with a medical emergency, the program must document in the client's records the name and affiliation of the recipient of the information, the name of the individual making the disclosure, the date and time of the disclosure, and the nature of the emergency.
Qualified Service Organization Agreements
If a program routinely needs to share certain information with an outside agency that provides services to the program, it can enter into a QSOA. A QSOA (Figure B-4) is a written agreement between a program and a person providing services to the program in which that person (1) acknowledges that in receiving, storing, processing, or otherwise dealing with any client records from the program, he or she is fully bound by [the Federal confidentiality] regulations; and (2) promises that, if necessary, he or she will resist in judicial proceedings any efforts to obtain access to client records except as permitted by these regulations (§§2.11, 2.12(c)(4)).
Box
Figure B-4: Qualified Service Organization Agreement. XYZ Service Center ("the Center") and the ____________________________________________ __________________________________________________________________________________
A QSOA should be used only when an agency or official outside of the program, for example, a clinical laboratory or data-processing agency, is providing a service to the program itself. An example is when laboratory analysis or data processing is performed for the program by an outside agency. A QSOA is not a substitute for individual consent in other situations. Disclosures under a QSOA must be limited to information that is needed by others so that the program can function effectively. QSOAs may not be used between programs providing alcohol and drug services.
Internal Program Communications
The Federal regulations permit some information to be disclosed to individuals within the same program:
The restrictions on disclosure in these regulations do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of alcohol or drug abuse if the communications are (i) within a program or (ii) between a program and an entity that has direct administrative control over that program. (§2.12(c)(3))
In other words, staff (including full- or part-time employees and unpaid volunteers) who have access to client records because they work for or administratively direct the program may consult among themselves or otherwise share information if their substance abuse work so requires.
Does this exception allow a treatment program that is part of a larger entity, such as a hospital, to share confidential information with others that are not part of the treatment unit? The answer to this question is quite complicated. In brief, there are circumstances under which the treatment unit may share information with other units that are part of the greater entity to which it belongs. Before such an internal communication system is set up within a large institution, however, it is essential that an expert in the area be consulted.
Other Requirements
Client Notice and Access to Records
The Federal confidentiality regulations require programs to notify clients of their right to confidentiality and to give them a written summary of the regulations' requirements. The notice and summary should be handed to clients when they enter the program or shortly thereafter (§2.22(a)). The regulations contain a sample notice that may be used for this purpose.
Unless State law grants the right of client access to records, programs have the right to decide when to permit clients to view or obtain copies of their records. The Federal regulations do not require programs to obtain written consent from clients before permitting them to see their own records.
Security of Records
The Federal regulations require programs to keep written records in a secure room, locked file cabinet, safe, or other similar container. The program should establish written procedures that regulate access to and use of client records. The program director or a single staff person should be designated to process inquiries and requests for information (§2.16).
Conclusion
Administrators and staff members of substance abuse treatment programs should become thoroughly familiar with the many legal issues affecting their work. Such knowledge can prevent costly mistakes. Because legal requirements often vary by State and change over time, it is also essential that programs find a reliable source to whom they may turn for up-to-date information, advice, and training.
Footnotes
- 1.
Margaret K. Brooks is an independent consultant in Montclair, New Jersey.
- 2.
Citations throughout this appendix in the form "§2..." refer to specific sections of 42 C.F.R., Part 2, Implementing the Substance Abuse and Mental Health Services Administration (42 U.S.C. §290dd-2).
- 3.
Only clients who have "applied for or received" services from a program are protected. If a client has not personally sought help from the program or has not yet been evaluated or counseled by a program, the program is free to discuss the client's drug or alcohol problems with others. The Federal regulations govern from the moment the client applies for services or the program first conducts an evaluation or begins counseling.
- 4.
Subpoenas and search and arrest warrants are discussed in Chapter 5.
- 5.
Although Federal and, in some cases, State laws may prohibit the employer from firing employees or taking other action simply because they have entered treatment, discriminatory practices against recovering people continue.
- 6.
Some States prohibit insurance companies from discriminating against individuals who have received substance abuse treatment; however, discriminatory practices continue. Insurance companies routinely share information about policy holders. Although the Federal regulations prohibit insurance companies from sharing information from a treatment program with other carriers, that prohibition is no guarantee that such redisclosure will not take place.
- 7.
If a client who has signed a consent form permitting the program to make disclosures to a third party payer later revokes his or her consent, the program can bill the third party payer for services provided before consent was revoked. A program cannot, however, make any disclosures to the third party payer in order to receive reimbursement for services rendered after the client revoked consent (§2.31(a)(8)).
- 8.
If the State's reporting law is intended only to gather information for research purposes, treatment programs can include clients' names in their reports, if the public health department complies with §2.52 of the Federal regulations. That section permits release of client-identifying information to researchers when (1) they are qualified to conduct the research; (2) they have a research protocol to protect client-identifying information, and a group of three or more individuals independent of the research project have reviewed the protocol and found it adequate; and (3) they agree not to redisclose clients' names or identifying information except back to the program and not to identify any client in a report. In most cases, a department of public health will easily satisfy the first requirement. The U.S. Department of Health and Human Services (DHSS) has suggested in opinion letters that the second requirement may not apply when the research is intended to track the incidence and causation of diseases. Thus, if the State is gathering information only for research purposes, the program can probably make reports including clients' names, if the department agrees not to redisclose clients' names or identifying information except back to the program and not to identify any client in a report.
- 9.
See Letter to Oklahoma State Department of Health from the Legal Adviser to the U.S. Alcohol, Drug Abuse, and Mental Health Administration, dated September 2, 1988, and Letter to the New York State Department of Health from the Acting General Counsel to the U.S. DHHS, dated May 17, 1989.
- 10.
Two statutes (42 U.S.C. §241[d] and 21 U.S.C. §872[c]), both of which cover research into drug use, permit the Secretary of DHHS and the U.S. Attorney General, respectively, to authorize researchers to withhold the names and identities of research subjects. The statutes both state that the researcher "may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding" to identify the subjects of research for which such authorization was obtained. Such authorization is commonly called a "certificate of confidentiality." Whether or not research investigators have obtained an authorization from the Attorney General or the Secretary of DHHS, however, they must comply with the prohibitions on redisclosure discussed in this section of the chapter if they have been given access to clients' records in a federally assisted treatment program.
- 11.
These particular entities also may copy or remove records, but only if they agree in writing to maintain client-identifying information in accordance with the regulations' security requirements (see §2.16), to destroy all client-identifying information when the audit or evaluation is completed, and to redisclose client information only (1) back to the program, (2) in accordance with a court order to investigate or prosecute the program (§2.66), or (3) to a government agency overseeing a Medicare or Medicaid audit or evaluation (§2.53(b)).
- 12.
For information on how to deal with subpoenas, see Chapter 5 and Confidentiality: A Guide to the Federal Law and Regulations, New York: Legal Action Center, 1995.
- 13.
If the information is being sought to investigate or prosecute a client, only the program need be notified (§2.65). If the information is sought to investigate or prosecute the program, no prior notice is required (§2.66).
- 14.
If the purpose of seeking the court order is to obtain authorization to disclose information in order to investigate or prosecute a client for a crime, the court also must find that (1) the crime involved was extremely serious, such as an act causing or threatening to cause death or serious injury; (2) the records sought are likely to contain information of significance to the investigation or prosecution; (3) there is no other practical way to obtain the information; and (4) the public interest in disclosure outweighs any actual or potential harm to the client, the doctor-client relationship, and the ability of the program to provide services to other clients. When law enforcement personnel seek the order, the court also must find that the program had an opportunity to be represented by independent counsel. If the program is a government entity, it must be represented by independent counsel, §2.65(d).
- Appendix B—Federal Confidentiality Regulations - Substance Abuse Treatment and D...Appendix B—Federal Confidentiality Regulations - Substance Abuse Treatment and Domestic Violence
Your browsing activity is empty.
Activity recording is turned off.
See more...