Fito reguladores

The privacy of persons receiving alcohol and drug abuse prevention and treatment services is protected by federal laws. The legal citation for these laws is 42 U.S.C. §§290ddB3 and eeB3. The regulations directing the implementation of these statutes were issued in 1975 and revised in 1987. They are found in the Code of Federal Regulations: 42 C.F.R. Part 2. A copy of these regulations begins on page 129 of this chapter.

Many States also have confidentiality laws that apply to substance abuse treatment. These may afford individuals even greater privacy than the federal law. However, State laws may not be less stringent than federal laws. If they are, the federal law (or the more rigorous one) prevails. Violation of the regulations may result in fines up to $500 for a first offense and up to $5,000 for subsequent offenses. The federal confidentiality law applies to all programs providing alcohol or drug abuse diagnosis, treatment, or referral for treatment that are federally assisted. Included are the following:

programs receiving any type of federal funding;

programs receiving tax exemption status through the Internal Revenue Service; programs authorized to conduct business by the federal government, such as those licensed to provide methadone or those certified as Medicare providers; and

programs conducted directly by the federal government or State or local governments that receive federal funds.

The primary intent of the confidentiality law is to prevent disclosure of information–both written records and verbal information–that would identify a person as a patient receiving alcohol or drug treatment. This protection is even extended to those who have applied, but were not admitted to the program for treatment, and to former patients and deceased patients. Not only are programs

prohibited from disclosing information, except under certain conditions to be discussed later, but they also are not allowed to verify information that is already known by the person making an inquiry. Patients are entitled to notification of the federal confidentiality laws and regulations. Programs should provide a written summary of these provisions upon admission. The written summary should include:

information about the circumstances in which disclosure can be made without the patient's consent;

a statement that violations of the regulations may be reported as a crime; a warning that committing or threatening a crime on the program's premises or against program staff can result in release of information;

notification that the program must report suspected child abuse or neglect; and reference to the federal law and regulations.

Programs must keep patient records in a secure room, a locked file cabinet or other similarly protected places. There should be written procedures concerning who has access to patient records. A single staff member, often the director, should be designated to handle inquiries and requests for information about patients.

Exceptions to the General Confidentiality Conditions

Under certain conditions, programs may disclose information about persons receiving or applying for substance abuse treatment. These are described in the following sections.

Patient Consent

Patients may sign a consent form allowing for the release of information. However, consent forms must contain specific information, including the following:

program name;

person or individual to receive the information; patient's name;

purpose or need for the disclosure;

the specific amount and kind of information to be released;

a statement that the patient may revoke the consent at any time; date, event, or condition upon which the consent will expire; signature of the patient; and

date upon which the consent is signed.

Only information that is necessary to accomplish the purpose stated in the form may be released. Even if a properlysigned consent form is in force, programs are allowed discretion about disclosing information, unless the form is accompanied by a subpoena or court order. It is usually necessary for patients to sign separate consent forms for each type of disclosure and for each person or organization to whom information is to be released. However, if similar information will be released to the same person/organization during the period the consent form is valid, signing a form for each release is not required. This might occur with funding sources requiring verification of treatment provided over the course of a person's enrollment in a treatment program. On the other hand, if a different type of information is requested by the same person/organization, a new consent form would be required.

Patients may revoke their consent at any time, either verbally or in writing. This does not require the program to retrieve information disclosed when the consent form was valid. If a patient revokes a consent form permitting disclosure of information to a third party payer, the program still may bill the payer for any services provided during the time the consent form was valid. However, after revocation of consent, the program may not release information to thirdparty payment sources. If services continue to be provided, the program risks not receiving reimbursement.

The expiration date of consent forms should be at a time that is reasonably necessary to achieve the purpose for which they are signed. Rather than a specific date, consent forms may expire when a certain event or condition occurs. For example, if information is released to a physician the patient will see one time, the consent form may indicate that it is valid until the patient's appointment with the doctor. On the other hand, a consent form to provide verification of enrollment in the treatment program for an employer, who has placed the person on probation pending treatment, may be in effect until the end of the probationary period.

State laws are relied upon to determine the definition of minors and whether or not the consent of a parent (or guardian or other person legally responsible for the minor) is required for them to obtain substance abuse treatment. The regulations concerning consent for release of information follow State laws: If State law requires parental consent for treatment, then consent of both the minor patient and the parent (or guardian) must be obtained to disclose information. However, regardless of the

requirement for parental consent, programs must always obtain the minor's consent for disclosure. The parent's signature alone is not sufficient.

In States requiring parental approval for the treatment of minors, programs must obtain the minor's consent before contacting a parent/guardian to obtain his or her permission for treatment. However, if the program director determines that certain conditions exist, s/he may contact the parent/ guardian without the minor's consent. In such cases, all of the following conditions must be present:

the minor is not capable of making a rational choice because of extreme youth or mental or physical impairment;

the situation presents a threat to the life or physical wellbeing of the youth or another person; and

the risk may be reduced by communicating relevant facts to the minor's parent/guardian.

If these conditions are not present, the program personnel must inform the minor of his or her right to refuse consent to communicate with a parent/guardian. However, the program cannot provide

services without such communication and parental consent. If State law does not require parental permission for treatment, programs still may withhold services from minors who will not authorize a disclosure so the program can obtain financial reimbursement for treatment, as long as this does not violate a State or local law.

Similarly, for adult patients who have been adjudicated incompetent, consent for disclosure may be made by the person's guardian or authorized representative. In situations in which a person has not been adjudicated incompetent but the program director determines that his or her present medical condition interferes with the ability to understand and take effective action, the director may authorize disclosure without patient consent only to obtain payment for services from a thirdparty payment source.

For deceased patients, disclosure may be authorized by the executor or administrator of his/her estate, spouse, or a family member. Without such consent, programs may make limited disclosures to comply with State or federal laws concerning collection of vital statistics or to respond to inquiries into the cause of death.

Any time a program releases information about a patient, it must be accompanied by a written statement indicating that the information is protected by federal law and the recipient cannot make further disclosure unless permitted by the regulations.

At times, patients may consent to disclosure of information to employers. Often, this can be limited to verification of treatment status or a general evaluation of progress. The program should limit

disclosure to only information that is related to the particular employment situation.

Persons may be required to participate in treatment as a condition of probation or parole, sentence, dismissal of charges, release from incarceration, or other criminal justice dispositions. These patients also are entitled to protection of confidentiality, but some special qualifications apply concerning the duration and revocability of consent. A sample consent form for release of information for a criminal justice system referral is shown on the next page.

Whenever a person moves from one phase of the criminal justice system to another, a substantial change in status occurs. Until such a change occurs, consent forms cannot be revoked. Criminal justice system consent forms can be irrevocable so that individuals who agree to treatment in lieu of prosecution or punishment can be monitored. However, the irrevocability of consent ends with the final disposition of the criminal proceedings. Information obtained by criminal justice agencies can be used only with respect to a particular criminal proceeding. It may be advisable for judges or criminal justice agencies to require that the individual sign the necessary consent forms before referral to a treatment program. If not, and the program is unable to obtain the individual's consent for disclosure, it may be prevented from providing information to the criminal justice agency that referred the patient to the program. Treatment programs are allowed to apprise criminal justice agencies, without

obtaining patient consent, if a person referred for treatment by such agencies fails to apply for or receive services from the program.

Because of the potential for abuse of methadone, these programs must take precautions that patients are not enrolled in multiple programs. Patients can be required to sign a consent form before they enter treatment to release information to a central registry. If the registry receives information about the same person in more than one program, each program may be notified so the problem can be resolved. Such consent remains in effect as long as the patient is enrolled in the program.

With a proper consent form, programs may release information to a patient's attorney. However, the program may use discretion to limit its response. Some programs may be concerned about potential law suits, but if they refuse to disclose information, attorneys may subpoena the records.

Internal Communications

Information about a patient may be shared among staff within a program only if there is a legitimate need for them to know it. When there is a need for internal communications, information that is shared always should be specifically related to the provision of substance abuse services being delivered.

When a program is part of a larger organization, such as a general hospital, community mental health center, or school, necessary information may be disclosed to other departments, such as central billing or medical records. However, any information that is not necessary to other departments should not be disclosed.

Disclosures Without Identification of Patients

Programs may release information that does not identify an individual as a substance abuser or verify someone else's identification of a patient. Reports of aggregate data about a program's participants may be provided. Individual information may be communicated in a manner that does not disclose that the person has a substance abuse problem. For example, the program may disclose that a person is a patient in a larger organization (e.g., general hospital, community mental health center, school)

without acknowledging that s/he has a substance abuse problem. Information may be disclosed anonymously without identifying either the individual's status as a substance abuse patient or the name of the program. Finally, an individual's case history may be reported anonymously, provided information about the patient and the agency are disguised sufficiently that the person's identity cannot be determined by a reader.

Medical Emergencies

In a situation that poses an immediate threat to the health of the patient or any other individual, and requires immediate medical intervention, such as a dangerous drug overdose or an attempted suicide, necessary information may be disclosed to medical personnel. Such a disclosure must be documented in the patient's records, including the name and affiliation of the person receiving the information, the name of the person making the disclosure, the date and time of the disclosure, and the nature of the emergency. Programs should ask participants in advance to indicate a person to be notified in the event of an emergency, and the patient should be asked to sign a consent form allowing the program to notify the named person if an emergency should arise. Even without patient consent, information may be disclosed to the federal Food and Drug Administration if an error has been made in packaging or manufacturing a drug used in substance abuse treatment and this may endanger the health of patients.

Court Orders

State and federal courts may issue orders authorizing programs to release information that otherwise would be unlawful. However, certain procedures are required when such court orders are issued. A subpoena, search warrant or arrest warrant alone is not sufficient to permit a program to make a disclosure. First, a program and a patient whose records are sought must be given notice that an application for the court order has been made. The program and the individual must have an

opportunity to make an oral or written statement to the court about the application. If the purpose of the court order is to investigate or prosecute a patient, it is only necessary to notify the program. Before an order is issued, there must be a finding of "good cause" for the disclosure. If the public interest and need for disclosure outweigh possible adverse effects to the individual, the doctorpatient relationship, and the program's services, the order may be issued. Information that is essential for the purpose of the court order is all that may be released. Only persons who need the information may receive it. A court order may require disclosure of confidential communications if one of the following conditions exist:

disclosure is necessary to protect against a threat to life or of serious bodily injury; disclosure is required to investigate or prosecute an extremely serious crime; or disclosure is necessary in a proceeding in which the patient has already provided evidence about confidential communications.

Before a court order can be issued to release patient information for a criminal investigation or prosecution, five criteria must be met. These are:

1. the crime is extremely serious (e.g., threatening to cause death or serious injury); 2. the records sought will probably contain information that is significant to the

investigation or prosecution of the crime;

3. there is no other feasible way to acquire the information;

4. the public interest in disclosure outweighs any harm to the patient, doctorpatient relationship, and the agency's ability to provide services; and

5. the program has an oppor tunity to be represented by independent counsel when law enforcement personnel seek the order.

Subpoenas may require a person to appear to give testimony or to bring documents to a hearing. Although they may be signed by a judge or other legal officials, subpoenas are not the type of court order required by the confidentiality regulations. Thus, federal confidentiality laws and regulations prohibit treatment programs from responding to subpoenas by disclosing information concerning current or former patients. However, if the person about whom the information is requested signs a proper consent form authorizing the release, the program may do so. If a court order is issued after giving the program and patient an opportunity to be heard, and after making a good cause

determination, treatment programs may respond to subpoenas.

Search warrants, similarly, may not be used to allow law enforcement officers to enter the program's facilities. However, arrest warrants do permit law enforcement personnel to search for a particular patient who has committed or threatened a crime on the premises of the program or against program personnel. Unless the arrest warrant is accompanied by a court order, the program may not cooperate with a search for a patient who committed a crime elsewhere.

Crimes at the Program or Against Program Staff

A program may report, or seek assistance from law enforcement agencies, when a patient commits or threatens to commit a crime on the program's premises or against program personnel. Information that may be disclosed includes the suspect's name, address, last known whereabouts, and status as a patient in the program.

Information a patient may divulge about crimes or threats to persons away from the program present special dilemmas. In some States therapists are liable if they fail to warn someone that a patient has threatened to harm him or her. At the same time, the federal regulations, which override State laws, prohibit disclosures that identify substance abuse patients unless they are made pursuant to a court order or without identifying the patient. Such circumstances require knowledge of the applicable State and federal laws and a balancing of moral and legal obligations. If possible, the best solution may be for the program to try to make the warning in a manner that does not identify the individual as a substance abuser.

Research and Audits

Researchers may obtain patientidentifying information if certain precautions are applied. The research protocol must ensure that information will be securely stored and not redisclosed except as allowable under the federal regulations. Confidentiality safeguards must be approved by an independent body of three or more persons. Researchers are strictly prohibited from redisclosing patient information. Reports of the research must not identify a patient, directly or indirectly.

Government agencies, thirdparty payers and peer review organizations may need to review program records without patient consent to conduct an audit or evaluation. Those persons involved in such