What Types of Programs Are Governed by the Regulations?

Any program that specializes, in whole or in part, in providing treatment, counseling, and/or assessment and referral services for clients with substance abuse disorders must comply with the Federal confidentiality regulations (§2.12(e)). Although the Federal regulations apply only to programs that receive Federal assistance, this assistance includes indirect forms of Federal aid such as tax-exempt status or State or local government funding (in whole or in part) from the Federal government.

Coverage under the Federal regulations is not contingent upon how a program labels its services. A "prevention" program is not excused from adhering to the confidentiality rules. The kind of services, not the label, determines whether the program must comply with the Federal law.

Overview of Federal Confidentiality Laws

The Federal confidentiality laws and regulations protect any information about a client who has applied for or received any substance abuse-related assessment, treatment, or referral services from a program covered under the law. Services applied for or received can include assessment, diagnosis, individual counseling, group counseling, treatment, or referral for treatment. The restrictions on disclosure (the act of making information known to another) apply to any information that would identify the client as a substance user either directly or by implication. The general rule applies from the time the client makes an appointment, applies for services, is assessed, or begins treatment. It also applies to former clients. Furthermore, the rule applies whether or not the person making an inquiry already has the information, has other ways of getting it, has some form of official status, is authorized by State law, or comes armed with a subpoena or search warrant.

When May Confidential Information Be Shared With Others?

Information protected by the Federal confidentiality regulations may always be disclosed after the client signs a proper consent form. (For minors, however, parental consent must also be obtained in some States.) The regulations also permit disclosure without the client's consent in several situations, including during medical emergencies, in communications among program staff, when reporting is mandated as in instances of child abuse or neglect, or when there is a danger to self or others. Nevertheless, obtaining the client's consent is the most common exception to the general rule prohibiting disclosure. The regulations' requirements regarding consent are strict and somewhat unusual and must be carefully followed.

The Purpose of the Disclosure and the Information That Will Be Disclosed

These two items are closely related. All disclosures, and especially those made pursuant to a consent form, must be limited to information that is necessary to accomplish the need or purpose for the disclosure (§2.13(a)). It would be improper to disclose everything in a client's file if the recipient of the information needs only one specific piece of information.

The purpose or need for the communication of information must be specified on the consent form. Once the purpose or need has been identified, it is easier to determine how much and what kind of information will be disclosed and to tailor it to what is essential to the specified need or purpose. Thus, the amount and type of information required must be written into the consent form. (The release of any HIV-related information may require a separate consent form, depending on the requirements of State law. For a discussion of the confidentiality of HIV-related information, see the forthcoming TIP, Substance Abuse Treatment for Persons With HIV/AIDS, in press [b].)

As an illustration, if a client must have participation in treatment verified to continue receiving public assistance, the purpose of the disclosure would be to "verify treatment status to the welfare authorities," and the amount and kind of information to be disclosed would be "time and dates of appointments" or "attendance." The disclosure would then be limited to a statement that "Jane Doe (the client) is receiving counseling at the XYZ Drug Treatment Program on Tuesday afternoons at 2 p.m."

The Client's Right To Revoke Consent

The client may revoke consent at any time, and the consent form must include a statement to this effect. Revocation need not be in writing. If a program has already made a disclosure prior to the revocation, acting in reliance on the client's signed consent, it is not required to retrieve the information it has already disclosed.

The regulations also provide that "acting in reliance" includes provision of services while relying on a consent form permitting disclosures to a third-party payor. (Third-party payors are health insurance companies, Medicaid, or any party that pays the bills other than the client's family.) Thus, a program can bill the third-party payor for services provided before the consent was revoked. However, a program that continues to provide services after a client has revoked a consent authorizing disclosure to a third-party payor does so at its own financial risk.

Expiration of Consent Form

The consent form must contain a date, event, or condition on which it will expire if not previously revoked. A consent must last "no longer than reasonably necessary to serve the purpose for which it is given" (§2.31(a)(9)). Depending on the purpose of the consented disclosure, the consent form may expire in 5 days, 6 months, or longer. Sound practice calls for adjusting the expiration date in this way, rather than imposing a set time period, say 60 to 90 days. For example, providers sometimes find themselves in a situation requiring disclosure when the client's consent form has expired. This means at the least that the client must return to the agency to sign a new consent form. At worst, the client has left or is unavailable, and the agency will not be able to make the disclosure.

The consent form need not contain a specific expiration date but may instead specify an event or condition. For example, if a client is in treatment as part of a service plan drawn up by the child protective services (CPS) agency, the consent form can be drafted to expire at the completion of the case with the CPS agency. Or if a client is being referred to a specialist for a single appointment, the consent form should stipulate that consent will expire after this appointment.

Required Notice Against Redisclosing Information

Once the consent form is properly completed, one formal requirement remains. Any disclosure made with the client's consent must be accompanied by a written statement that the information disclosed is protected by Federal law and that the recipient cannot further disclose or release such information unless permitted by the regulations (§2.32). This statement, not the consent form itself, should be delivered and explained to the recipient of the information at the time of disclosure or earlier. (Of course, a client may sign a consent form authorizing redisclosure.)

Note on Agency Use of Consent Forms

The fact that a client has signed a proper consent form authorizing release of information does not compel a program to make the proposed disclosure, unless the program has also received a subpoena or court order (§§2.3(b)(1), 2.61(a)(b)). In most cases, the decision whether to make a disclosure authorized by a client's signed consent is up to the program, unless State law requires or prohibits a particular disclosure even if consent is given. The program's only obligation under the Federal regulations is to refuse to honor a consent that is expired, deficient, or otherwise known to be revoked, false, or incorrect (§2.31(c)).

In general, it is best to follow this rule: disclose only what is necessary and only as long as necessary, keeping in mind the purpose of disclosing the information.

Communicating With CPS Agencies, Coordinating Care, and Making Referrals

Programs treating parents involved with CPS agencies may be called on to provide information to CPS or to confer on an ongoing basis with other agencies, such as mental health or child welfare programs. The best way to proceed is to obtain the client's consent. Care should be taken in wording the consent form to permit the kinds of communications necessary.

For example, if the program is treating a client who has been referred to treatment and whose parental rights are at risk, the purpose of disclosure might be to "assist the client to comply with the CPS system's requirements, goals, and timetables," or to "supply periodic reports about attendance," and "how much and what kind of information will be disclosed" might be "attendance" or "progress in treatment."

On the other hand, if the program needs ongoing communications with a mental health provider, the purpose of the disclosure would be "coordination of care for John Doe," and "how much and what kind of information will be disclosed" might be "treatment status, treatment issues, and progress in treatment."

Note that the kinds of information disclosed in these two examples are quite different. The program might well share detailed clinical information about a client with a mental health provider if sharing would assist in coordinating care. Disclosure to CPS agencies should be limited to a brief statement about the client's attendance or progress in treatment. Disclosure of detailed clinical information to CPS agencies could, in many circumstances, be inappropriate.

The program should also give considerable thought to the date or event that will end the period of consent. For coordinating care with a mental health program, it might be appropriate to have the consent form expire when treatment by either agency ends. A consent form permitting disclosures to CPS agencies might expire when the client's CPS case is closed.

Making Referrals

Programs treating clients often refer them to other health care or social service agencies. Giving a client the name and telephone number of an outside gynecologist, tutoring service, or training program might not be effective unless the client's treatment counselor calls to set up the appointment for the client. However, such a call is a disclosure of confidential information that the client has a substance abuse problem, and thus the counselor is required to obtain the client's consent in writing (as well as parental consent in States requiring it).

Special Consent Rules for Clients Involved in the Justice System

Programs assessing or treating clients who are involved in the criminal justice system (CJS) must still follow the Federal confidentiality rules. However, special rules apply when a client comes for assessment or treatment as an official condition of probation, sentence, dismissal of charges, release from detention, or other disposition of a criminal justice proceeding. (Note that these rules do not apply to clients referred by the CPS system or "mandated" into treatment by CPS. They apply only to clients mandated into treatment as a condition of the disposition of a criminal case.)

A consent form (or court order) is required before a program can disclose information about a client who is the subject of CJS referral. However, the rules are different concerning the length of time a consent is valid and the process for revoking it (§2.35). Specifically, the regulations require that the following factors be considered in determining how long a criminal justice consent will remain in effect:

• Anticipated duration of treatment
• Type of criminal proceeding
• Need for treatment information in dealing with the proceeding
• Time of the final disposition
• Anything else the client, program, or justice agency believes is relevant

These rules allow programs to draft the consent form to expire "when there is a substantial change in the client's justice system status." A substantial change in justice system status occurs whenever the client moves from one phase of the CJS to the next. For example, for a client on probation, a change in CJS status would occur when the probation ends, either by successful completion or revocation. Thus, the program could provide an assessment and periodic reports to the client's probation officer and could even testify at a probation revocation hearing if it so desired, because no change in status would occur until after that hearing.

An important difference between the regular consent form and the CJS consent form is that the Federal regulations permit the program to draft the CJS consent form so that it cannot be revoked until a specified date or condition occurs. The regulations permit the CJS consent form to be irrevocable so that a client who has agreed to enter treatment in lieu of prosecution or punishment cannot then prevent the court, probation department, or other agency from monitoring her progress. Note that although a CJS consent may be made irrevocable for a specified period of time, that period must end no later than the time of the final disposition of the juvenile or criminal justice proceeding. Thereafter, the client may freely revoke consent. A sample CJS consent form appears in Figure B-2 .

Table

Figure B-2: Consent Form: Criminal Justice System Referral.

Disclosures That Do Not Reveal "Client-Identifying" Information

Federal regulations permit treatment programs to disclose information about a client if the program reveals no client-identifying information. "Client-identifying" information is information that identifies an individual as a substance user. Thus, a program may disclose information about a client if that information does not identify him as a substance user or support anyone else's identification of the client as a substance user. For example, a counselor in a program that provides services to clients with other problems or illnesses as well as substance abuse disorders may disclose information about an identified client to a peer in another treatment program or to a lawyer at a legal services program (to obtain advice, for example) as long as the counselor does not reveal the fact that the client has a substance abuse disorder or is receiving treatment (§2.12(a)(i)). Similarly, a counselor employed by a program that is part of a general hospital could make such a disclosure, if no mention is made of the client's substance abuse or participation in a treatment program. Of course, if information the counselor must discuss with the colleague or lawyer involves substance abuse, this exception will not work.

Programs that provide only substance abuse services cannot disclose information that identifies a client under this exception, because telling a colleague or a lawyer that the call is being made from the "XYZ Drug Treatment Program" automatically identifies the client as a participant in the program. However, a free-standing program can sometimes make "anonymous" disclosures; that is, disclosures that do not mention the name of the program or otherwise reveal the client's status as a substance user. In other words, a counselor could call a colleague or a lawyer and ask for advice, yet not be obliged to identify the program by name.

Court-Ordered Disclosures

A State or Federal court may issue an order permitting a program to make a disclosure about a client that would otherwise be forbidden. However, a court may issue one of these authorizing orders only after it follows special procedures and makes particular determinations required by the regulations. A subpoena, search warrant, or arrest warrant, even when signed by a judge, is not sufficient, standing alone, to require or even to permit a program to disclose information (§2.61). Additional information about dealing with subpoenas appears in Confidentiality: A Guide to the Federal Laws and Regulations (Legal Action Center, 1995). Before a court can issue an order authorizing a disclosure about a client that is otherwise forbidden, the program and the client whose records are sought must be given notice of the application for the order, as well as an opportunity to make an oral or written statement to the court. (If the information is being sought to investigate or prosecute a client for a crime, however, only the program need be notified (§2.65). If the information is sought to investigate or prosecute the program, no prior notice at all is required (§2.66).)

Generally, the application and any court order must use a fictitious (made-up) name for any known client, not the real name. All court proceedings in connection with the application must remain confidential unless the client requests otherwise (§§2.64(a), (b), 2.65, 2.66).

Before issuing an authorizing order, the court must find that there is "good cause" for the disclosure. A court can find "good cause" only if it determines that the public interest and the need for disclosure outweigh any negative effect the disclosure will have on the client or the doctor-patient or counselor-client relationship and on the effectiveness of the program's treatment services. Before it may issue an order, the court also must find that other ways of obtaining the information are not available or would be ineffective (§2.64(d)). The judge may examine the records before making a decision (§2.64(c).

The scope of the disclosure a court may authorize is limited as well, even when the court finds good cause. The disclosure must be limited to information essential to fulfill the purpose of the order, and it must be restricted to those persons who need the information for that purpose. The court also should take any other steps necessary to protect the client's confidentiality, including sealing court records from public scrutiny (§2.64(e)). The court may order disclosure of "confidential communications" by a client to the program only if the disclosure is:

• Necessary to protect against a threat to life or of serious bodily injury
• Necessary to investigate or prosecute an extremely serious crime (including child abuse)
• Connected with a proceeding at which the client has already presented evidence concerning confidential communications (for example, "I told my counselor...") (§2.63)

These standards govern any effort by CPS agencies to obtain information from a program. However, if the information is sought not by CPS, but by law enforcement authorities to investigate or prosecute a client for a crime, the court must make these additional findings:

• The crime involved is extremely serious, such as an act causing or threatening to cause death or serious injury (including child abuse and neglect)
• The records sought are likely to contain information of significance to the investigation or prosecution
• There is no other practical way to obtain the information
• The public interest in disclosure outweighs any actual or potential harm to the client, the doctor-patient relationship, and the ability of the program to provide services to other clients

When law enforcement personnel seek the order, the court also must find that the program had an opportunity to be represented by independent counsel. If the program is a government entity, it must be represented by counsel (§2.65(d)).

Sharing Information With an Outside Service Agency

If a program routinely must share certain information with an outside agency that provides services to the program, a qualified service organization agreement (QSOA) can be made. A QSOA is a written agreement between a program and a person (or agency) providing services to the program, in which that person (or agency):

• Acknowledges that in receiving, storing, processing, or otherwise dealing with any client records from the program, he is fully bound by Federal confidentiality regulations
• Promises that, if necessary, he will resist in judicial proceedings any efforts to obtain access to client records except as permitted by these regulations (§§2.11, 2.12(c)(4)).

A sample QSOA is provided in Figure B-3 .

Table

Figure B-3: Qualified Service Organization Agreement.

A QSOA should be used only when an agency or official outside the program is providing a service to the program itself. One example of a QSOA is an agreement with an attorney who advises and represents the program. This kind of agreement is helpful if a program has a question about making a report to the CPS system, or receives a subpoena or a notice that someone is seeking a court order authorizing the program to disclose records. The attorney is providing a service to the program by advising on whether a child abuse report must be made or how to handle a subpoena. If a QSOA is made with an attorney, the program can disclose the information the attorney needs to provide the advice. In return, the attorney guarantees that he is bound by the Federal regulations and will not disclose information learned from the program unless the disclosure is permitted by the Federal regulations. Without a QSOA, the program might not be able to communicate with an attorney in order to get assistance--unless the client(s) whose records are sought consents. It is not always possible to obtain a client's consent; for example, she might be incarcerated. Of course, the attorney cannot redisclose the information when redisclosure would violate the regulations.

A QSOA is not a substitute for individual consent in other situations. Disclosures under a QSOA must be limited to information needed by others so that the program can function effectively. A QSOA may not be used between different programs providing substance abuse treatment and other services.

Other Exceptions

Several other exceptions deserve brief mention:

• Communications among program staff
• Medical emergency
• Research, audit, and evaluation

Client Notice and Access to Records

The Federal confidentiality regulations require programs to notify clients of their right to confidentiality and to give them a written summary of the regulations' requirements. The notice and summary should be handed to clients when they begin participating in the program or soon thereafter (§22(a)). The regulations contain a sample notice. Programs can use their own judgment about when to permit clients to view or obtain copies of their records, unless State law allows clients the right of access to records. The Federal regulations do not require programs to obtain written consent from clients before permitting them to see their own records.

Security of Records

The Federal regulations require programs to keep written records in a secure room, locked file cabinet, safe, or other similar container. Programs should establish written procedures that regulate access to and use of clients' records. Either the program director or a single staff person should be designated to process inquiries and requests for information (§2.16). Computerization of records greatly complicates efforts to ensure security. (For a brief discussion of some of the issues computerization raises, see TIP 23, Treatment Drug Courts: Integrating Substance Abuse Treatment With Legal Case Processing [CSAT, 1996].)

State Confidentiality Laws

States also have laws limiting what information about clients may be disclosed and how disclosure must be handled. For example, most States have laws that offer some protection to patients' medical information. Clients think of these laws as the "doctor-patient privilege."

Strictly speaking, the doctor-patient privilege is a rule of evidence that governs whether a clinician can be asked or compelled to testify in a court case about a client. In many States, however, laws offer wider protection. Some States have special confidentiality laws that explicitly prohibit certain types of providers from divulging information about clients without consent. States often include such prohibitions in professional licensing laws, which generally prohibit licensed professionals from divulging information about clients and make unauthorized disclosures grounds for disciplinary action, including license revocation.

Each State has its own set of rules, which means that the scope of protection offered by State law varies widely. Whether a communication (or laboratory test result) is "privileged" or "protected" may depend on a number of factors:

• The type of professional holding the information and whether he is licensed or certified by the State
• The context in which the information was communicated to or obtained by the professional
• The context in which the information will be or was disclosed
• Exceptions to any general rule protecting information
• How the protection is enforced