Among Americans, there is a widespread perception that people
with substance abuse disorders are weak or morally impaired.
The Federal confidentiality law and regulations grew out of
a concern that this social stigma and discrimination against
recovering substance users might deter people from entering treatment.
The law is codified as 42 U.S.C. §290dd-2. The implementing
Federal regulations, "Confidentiality of Alcohol and Drug Abuse
Patient Records," are contained in 42 Code of Federal Regulations
(C.F.R.), Part 2.
The Federal law and regulations severely restrict communications
about identifiable individuals by "programs" that provide substance
use diagnosis, treatment, or referral for treatment (§2.11)
(citations in the form "§2..." refer to specific sections
of 42 C.F.R. Part 2). The purpose of the law and regulations
is to decrease the risk that information about individuals in
recovery will be disseminated and that they will be subjected
to discrimination and to encourage people to seek treatment for
substance abuse disorders.
The regulations restrict communications more tightly in many
instances than, for example, the laws governing either doctor-patient
or attorney-client privilege. Violating the regulations is punishable
by a fine of up to $500 for a first offense and up to $5,000
for each subsequent offense (§2.4). Some may view these
Federal regulations governing communication about the client
and protecting privacy rights as an irritation or a barrier to
achieving program goals. However, most of the problems that
may crop up under the regulations can be easily avoided through
planning ahead. Familiarity with the regulations' requirements
will assist communication. It also can reduce confidentiality-related
conflicts among the program, client, and outside agencies so
that these conflicts rarely occur.
Any program that specializes, in whole or in part, in providing
treatment, counseling, and/or assessment and referral services
for clients with substance abuse disorders must comply with the
Federal confidentiality regulations (§2.12(e)). Although
the Federal regulations apply only to programs that receive Federal
assistance, this assistance includes indirect forms of Federal
aid such as tax-exempt status or State or local government funding
(in whole or in part) from the Federal government.
Coverage under the Federal regulations is not contingent upon
how a program labels its services. A "prevention" program is
not excused from adhering to the confidentiality rules. The
kind of services, not the label, determines whether the program
must comply with the Federal law.
The Federal confidentiality laws and regulations protect any
information about a client who has applied for or received any
substance abuse-related assessment, treatment, or referral services
from a program covered under the law. Services applied for or
received can include assessment, diagnosis, individual counseling,
group counseling, treatment, or referral for treatment. The
restrictions on disclosure (the act of making information known
to another) apply to any information that would identify the
client as a substance user either directly or by implication.
The general rule applies from the time the client makes an appointment,
applies for services, is assessed, or begins treatment. It also
applies to former clients. Furthermore, the rule applies whether
or not the person making an inquiry already has the information,
has other ways of getting it, has some form of official status,
is authorized by State law, or comes armed with a subpoena or
search warrant.
Information protected by the Federal confidentiality regulations
may always be disclosed after the client signs a proper consent
form. (For minors, however, parental consent must also be obtained
in some States.) The regulations also permit disclosure without
the client's consent in several situations, including during
medical emergencies, in communications among program staff, when
reporting is mandated as in instances of child abuse or neglect,
or when there is a danger to self or others. Nevertheless, obtaining
the client's consent is the most common exception to the general
rule prohibiting disclosure. The regulations' requirements regarding
consent are strict and somewhat unusual and must be carefully
followed.
Most disclosures are permissible if a client has signed a
valid consent form that has not expired or been revoked (§2.31).
However, no information obtained from a provider--even with
the client's consent--may be used in a criminal investigation
or prosecution of a client unless a court order also has been
issued in accordance with §2.65 (see §2.12(a) and (d)).
A proper consent form must be in writing and must contain
each of the items specified in §2.31, as follows:
The name or general description of the
program(s) making the disclosure
The name or title of the individual or organization that
will receive the disclosure
The name of the client who is the subject of the disclosure
The purpose or need for the disclosure
How much and what kind of information will be disclosed
A statement that the client may revoke (take back) the consent
at any time, except to the extent that the program has already
acted on it
The date, event, or condition upon which the consent will
expire if not previously revoked
The signature of the client (and, in some States, that of
her parent)
The date on which the consent is signed
A general medical release form, or any consent form that does
not contain all of the elements listed above, is not acceptable.
(See sample consent form in Figure B-1.)
Several items on this list deserve further explanation and are
discussed below: the purpose of the disclosure and how much and
what kind of information will be disclosed, the client's right
to revoke consent, expiration of the consent form, and the required
notice against rereleasing information.
A note about agency use of the consent forms follows.
These two items are closely related.
All disclosures, and especially those made pursuant to a consent
form, must be limited to information that is necessary to accomplish
the need or purpose for the disclosure (§2.13(a)).
It would be improper to disclose everything in a client's file
if the recipient of the information needs only one specific piece
of information.
The purpose or need for the communication of information must
be specified on the consent form.
Once the purpose or need has been identified, it is easier to
determine how much and what kind of information will be disclosed
and to tailor it to what is essential to the specified need or
purpose.
Thus, the amount and type of information required must be written
into the consent form.
(The release of any HIV-related information may require a separate
consent form, depending on the requirements of State law.
For a discussion of the confidentiality of HIV-related information,
see the forthcoming TIP, Substance Abuse Treatment for Persons
With HIV/AIDS, in press [b].)
As an illustration, if a client must have participation in
treatment verified to continue receiving public assistance, the
purpose of the disclosure would be to "verify treatment status
to the welfare authorities," and the amount and kind of information
to be disclosed would be "time and dates of appointments" or
"attendance." The disclosure would then be limited to a statement
that "Jane Doe (the client) is receiving counseling at the XYZ
Drug Treatment Program on Tuesday afternoons at 2 p.m."
The client may revoke consent at any time, and the consent
form must include a statement to this effect. Revocation need
not be in writing. If a program has already made a disclosure
prior to the revocation, acting in reliance on the client's signed
consent, it is not required to retrieve the information it has
already disclosed.
The regulations also provide that "acting in reliance" includes
provision of services while relying on a consent form permitting
disclosures to a third-party payor. (Third-party payors are
health insurance companies, Medicaid, or any party that pays
the bills other than the client's family.) Thus, a program can
bill the third-party payor for services provided before the consent
was revoked. However, a program that continues to provide services
after a client has revoked a consent authorizing disclosure to
a third-party payor does so at its own financial risk.
The consent form must contain a date, event, or condition
on which it will expire if not previously revoked. A consent
must last "no longer than reasonably necessary to serve the purpose
for which it is given" (§2.31(a)(9)). Depending on the
purpose of the consented disclosure, the consent form may expire
in 5 days, 6 months, or longer. Sound practice calls for adjusting
the expiration date in this way, rather than imposing a set time
period, say 60 to 90 days. For example, providers sometimes
find themselves in a situation requiring disclosure when the
client's consent form has expired. This means at the least that
the client must return to the agency to sign a new consent form.
At worst, the client has left or is unavailable, and the agency
will not be able to make the disclosure.
The consent form need not contain a specific expiration date
but may instead specify an event or condition. For example,
if a client is in treatment as part of a service plan drawn up
by the child protective services (CPS) agency, the consent form
can be drafted to expire at the completion of the case with the
CPS agency. Or if a client is being referred to a specialist
for a single appointment, the consent form should stipulate that
consent will expire after this appointment.
Once the consent form is properly completed, one formal requirement
remains. Any disclosure made with the client's consent must
be accompanied by a written statement that the information disclosed
is protected by Federal law and that the recipient cannot further
disclose or release such information unless permitted by the
regulations (§2.32). This statement, not the consent form
itself, should be delivered and explained to the recipient of
the information at the time of disclosure or earlier. (Of course,
a client may sign a consent form authorizing redisclosure.)
The fact that a client has signed a proper consent form authorizing
release of information does not compel a program to make the
proposed disclosure, unless the program has also received a subpoena
or court order (§§2.3(b)(1), 2.61(a)(b)). In most
cases, the decision whether to make a disclosure authorized by
a client's signed consent is up to the program, unless State
law requires or prohibits a particular disclosure even if consent
is given. The program's only obligation under the Federal regulations
is to refuse to honor a consent that is expired, deficient, or
otherwise known to be revoked, false, or incorrect (§2.31(c)).
In general, it is best to follow this rule: disclose only
what is necessary and only as long as necessary, keeping in mind
the purpose of disclosing the information.
Programs treating parents involved with CPS agencies may be
called on to provide information to CPS or to confer on an ongoing
basis with other agencies, such as mental health or child welfare
programs. The best way to proceed is to obtain the client's
consent. Care should be taken in wording the consent form to
permit the kinds of communications necessary.
For example, if the program is treating a client who has been
referred to treatment and whose parental rights are at risk,
the purpose of disclosure might be to "assist the client to comply
with the CPS system's requirements, goals, and timetables," or
to "supply periodic reports about attendance," and "how much
and what kind of information will be disclosed" might be "attendance"
or "progress in treatment."
On the other hand, if the program needs ongoing communications
with a mental health provider, the purpose of the disclosure
would be "coordination of care for John Doe," and "how much and
what kind of information will be disclosed" might be "treatment
status, treatment issues, and progress in treatment."
Note that
the kinds of information disclosed in these two examples are
quite different. The program might well share detailed clinical
information about a client with a mental health provider if sharing
would assist in coordinating care. Disclosure to CPS agencies
should be limited to a brief statement about the client's attendance
or progress in treatment. Disclosure of detailed clinical information
to CPS agencies could, in many circumstances, be inappropriate.
The program should also give considerable thought to the date
or event that will end the period of consent. For coordinating
care with a mental health program, it might be appropriate to
have the consent form expire when treatment by either agency
ends. A consent form permitting disclosures to CPS agencies
might expire when the client's CPS case is closed.
Programs treating clients often refer them to other health
care or social service agencies. Giving a client the name and
telephone number of an outside gynecologist, tutoring service,
or training program might not be effective unless the client's
treatment counselor calls to set up the appointment for the client.
However, such a call is a disclosure of confidential information
that the client has a substance abuse problem, and thus the counselor
is required to obtain the client's consent in writing (as well
as parental consent in States requiring it).
Programs assessing or treating clients who are involved in
the criminal justice system (CJS) must still follow the Federal
confidentiality rules. However, special rules apply when a client
comes for assessment or treatment as an official condition of
probation, sentence, dismissal of charges, release from detention,
or other disposition of a criminal justice proceeding. (Note
that these rules do not apply to clients referred by the
CPS system or "mandated" into treatment by CPS. They apply only
to clients mandated into treatment as a condition of the disposition
of a criminal case.)
A consent form (or court order) is required before a program
can disclose information about a client who is the subject of
CJS referral. However, the rules are different concerning the
length of time a consent is valid and the process for revoking
it (§2.35). Specifically, the regulations require that
the following factors be considered in determining how long a
criminal justice consent will remain in effect:
Anticipated duration of treatment
Type of criminal proceeding
Need for treatment information in dealing with the proceeding
Time of the final disposition
Anything else the client, program, or justice agency believes
is relevant
These rules allow programs to draft the consent form to expire
"when there is a substantial change in the client's justice system
status."
A substantial change in justice system status occurs whenever
the client moves from one phase of the CJS to the next.
For example, for a client on probation, a change in CJS status
would occur when the probation ends, either by successful completion
or revocation.
Thus, the program could provide an assessment and periodic reports
to the client's probation officer and could even testify at a
probation revocation hearing if it so desired, because no change
in status would occur until after that hearing.
An important difference between the regular consent form and
the CJS consent form is that the Federal regulations permit the
program to draft the CJS consent form so that it cannot be revoked
until a specified date or condition occurs. The regulations
permit the CJS consent form to be irrevocable so that a client
who has agreed to enter treatment in lieu of prosecution or punishment
cannot then prevent the court, probation department, or other
agency from monitoring her progress. Note that although a CJS
consent may be made irrevocable for a specified period of time,
that period must end no later than the time of the final disposition
of the juvenile or criminal justice proceeding. Thereafter,
the client may freely revoke consent. A sample CJS consent form
appears in Figure B-2.
Chapter 6 made reference to other
exceptions to the general rule prohibiting disclosure of information
about a client who seeks or receives substance use treatment
services. These include
Disclosures that do not reveal "client-identifying"
information
Disclosures authorized by court order
Disclosures to an outside agency that provides a service
to the program
Federal regulations permit treatment programs to disclose
information about a client if the program reveals no client-identifying
information. "Client-identifying" information is information
that identifies an individual as a substance user. Thus, a program
may disclose information about a client if that information does
not identify him as a substance user or support anyone else's
identification of the client as a substance user. For example,
a counselor in a program that provides services to clients with
other problems or illnesses as well as substance abuse disorders
may disclose information about an identified client to a peer
in another treatment program or to a lawyer at a legal services
program (to obtain advice, for example) as long as the counselor
does not reveal the fact that the client has a substance abuse
disorder or is receiving treatment (§2.12(a)(i)). Similarly,
a counselor employed by a program that is part of a general hospital
could make such a disclosure, if no mention is made of the client's
substance abuse or participation in a treatment program. Of
course, if information the counselor must discuss with the colleague
or lawyer involves substance abuse, this exception will not work.
Programs that provide only substance abuse services cannot
disclose information that identifies a client under this exception,
because telling a colleague or a lawyer that the call is being
made from the "XYZ Drug Treatment Program" automatically identifies
the client as a participant in the program. However, a free-standing
program can sometimes make "anonymous" disclosures; that is,
disclosures that do not mention the name of the program or otherwise
reveal the client's status as a substance user. In other words,
a counselor could call a colleague or a lawyer and ask for advice,
yet not be obliged to identify the program by name.
A State or Federal court may issue an order permitting a program
to make a disclosure about a client that would otherwise be forbidden.
However, a court may issue one of these authorizing orders only
after it follows special procedures and makes particular determinations
required by the regulations. A subpoena, search warrant,
or arrest warrant, even when signed by a judge, is not sufficient,
standing alone, to require or even to permit a program to disclose
information (§2.61). Additional information about dealing
with subpoenas appears in Confidentiality: A Guide to the
Federal Laws and Regulations (Legal Action
Center, 1995).
Before a court can issue an order authorizing a disclosure
about a client that is otherwise forbidden, the program and the
client whose records are sought must be given notice of the application
for the order, as well as an opportunity to make an oral or written
statement to the court. (If the information is being sought
to investigate or prosecute a client for a crime, however, only
the program need be notified (§2.65). If the information
is sought to investigate or prosecute the program, no prior notice
at all is required (§2.66).)
Generally, the application and any court order must use a
fictitious (made-up) name for any known client, not the
real name. All court proceedings in connection with the application
must remain confidential unless the client requests otherwise
(§§2.64(a), (b), 2.65, 2.66).
Before issuing an authorizing order, the court must find that
there is "good cause" for the disclosure. A court can find "good
cause" only if it determines that the public interest and the
need for disclosure outweigh any negative effect the disclosure
will have on the client or the doctor-patient or counselor-client
relationship and on the effectiveness of the program's treatment
services. Before it may issue an order, the court also must
find that other ways of obtaining the information are not available
or would be ineffective (§2.64(d)). The judge may examine
the records before making a decision (§2.64(c).
The scope of the disclosure a court may authorize is limited
as well, even when the court finds good cause. The disclosure
must be limited to information essential to fulfill the purpose
of the order, and it must be restricted to those persons who
need the information for that purpose. The court also should
take any other steps necessary to protect the client's confidentiality,
including sealing court records from public scrutiny (§2.64(e)).
The court may order disclosure of "confidential communications"
by a client to the program only if the disclosure is:
Necessary to protect against a threat to
life or of serious bodily injury
Necessary to investigate or prosecute an extremely serious
crime (including child abuse)
Connected with a proceeding at which the client has already
presented evidence concerning confidential communications (for
example, "I told my counselor...") (§2.63)
These standards govern any effort by CPS agencies to obtain
information from a program. However, if the information is sought
not by CPS, but by law enforcement authorities to investigate
or prosecute a client for a crime, the court must make these
additional findings:
The crime involved is extremely serious,
such as an act causing or threatening to cause death or serious
injury (including child abuse and neglect)
The records sought are likely to contain information of significance
to the investigation or prosecution
There is no other practical way to obtain the information
The public interest in disclosure outweighs any actual or
potential harm to the client, the doctor-patient relationship,
and the ability of the program to provide services to other clients
When law enforcement personnel seek the order, the court also
must find that the program had an opportunity to be represented
by independent counsel. If the program is a government entity,
it must be represented by counsel (§2.65(d)).
If a program routinely must share certain information with
an outside agency that provides services to the program, a qualified
service organization agreement (QSOA) can be made. A QSOA is
a written agreement between a program and a person (or agency)
providing services to the program, in which that person (or agency):
Acknowledges that in receiving, storing,
processing, or otherwise dealing with any client records from
the program, he is fully bound by Federal confidentiality regulations
Promises that, if necessary, he will resist in judicial proceedings
any efforts to obtain access to client records except as permitted
by these regulations (§§2.11, 2.12(c)(4)).
A QSOA should be used only when an agency or official outside
the program is providing a service to the program itself.
One example of a QSOA is an agreement with an attorney who advises
and represents the program.
This kind of agreement is helpful if a program has a question
about making a report to the CPS system, or receives a subpoena
or a notice that someone is seeking a court order authorizing
the program to disclose records.
The attorney is providing a service to the program by advising
on whether a child abuse report must be made or how to handle
a subpoena.
If a QSOA is made with an attorney, the program can disclose
the information the attorney needs to provide the advice.
In return, the attorney guarantees that he is bound by the Federal
regulations and will not disclose information learned from the
program unless the disclosure is permitted by the Federal regulations.
Without a QSOA, the program might not be able to communicate
with an attorney in order to get assistance--unless the client(s)
whose records are sought consents.
It is not always possible to obtain a client's consent; for example,
she might be incarcerated. Of course, the attorney cannot redisclose
the information when redisclosure would violate the regulations.
A QSOA is not a substitute for individual consent in other
situations. Disclosures under a QSOA must be limited to information
needed by others so that the program can function effectively.
A QSOA may not be used between different programs providing
substance abuse treatment and other services.
The Federal regulations permit some information to be disclosed
to staff within the same program:
The restrictions on disclosure in these regulations do not
apply to communications of information between or among personnel
having a need for the information in connection with their duties
that arise out of the provision of diagnosis, treatment, or referral
for treatment of substance abuse if the communications are (i)
within a program or (ii) between a program and an entity that
has direct administrative control over that program (§2.12(c)(3)).
In other words, staff members who have access to client records
because they work for or administratively direct the program--including
full- or part-time employees and unpaid volunteers--may consult
among themselves or otherwise share information if their substance
abuse work so requires (§2.12(c)(3)).
A program may make disclosures to public or private medical
personnel "who have a need for information about [a client] for
the purpose of treating a condition which poses an immediate
threat to the health" of the client or any other individual.
The regulations define "medical emergency" as a situation that
poses an immediate threat to health and requires immediate medical
intervention (§2.51).
The medical emergency exception permits disclosure only to
medical personnel. This means that the exception cannot be used
as the basis for a disclosure to the police or other nonmedical
personnel.
Whenever a disclosure is made to cope with a medical emergency,
the program must document the following information in the client's
records:
Name and affiliation of the recipient of
the information
The confidentiality regulations also permit programs to disclose
client-identifying information to researchers, auditors, and
evaluators without client consent, provided certain safeguards
are met (§§2.52, 2.53).
The Federal confidentiality regulations require programs to
notify clients of their right to confidentiality and to give
them a written summary of the regulations' requirements. The
notice and summary should be handed to clients when they begin
participating in the program or soon thereafter (§22(a)).
The regulations contain a sample notice. Programs can use their
own judgment about when to permit clients to view or obtain copies
of their records, unless State law allows clients the right of
access to records. The Federal regulations do not require programs
to obtain written consent from clients before permitting them
to see their own records.
The Federal regulations require programs to keep written records
in a secure room, locked file cabinet, safe, or other similar
container. Programs should establish written procedures that
regulate access to and use of clients' records. Either the program
director or a single staff person should be designated to process
inquiries and requests for information (§2.16). Computerization
of records greatly complicates efforts to ensure security. (For
a brief discussion of some of the issues computerization raises,
see TIP 23, Treatment Drug Courts: Integrating Substance Abuse
Treatment With Legal Case Processing [CSAT, 1996].)
States also have laws limiting what information about clients
may be disclosed and how disclosure must be handled. For example,
most States have laws that offer some protection to patients'
medical information. Clients think of these laws as the "doctor-patient
privilege."
Strictly speaking, the doctor-patient privilege is a rule
of evidence that governs whether a clinician can be asked or
compelled to testify in a court case about a client. In many
States, however, laws offer wider protection. Some States have
special confidentiality laws that explicitly prohibit certain
types of providers from divulging information about clients without
consent. States often include such prohibitions in professional
licensing laws, which generally prohibit licensed professionals
from divulging information about clients and make unauthorized
disclosures grounds for disciplinary action, including license
revocation.
Each State has its own set of rules, which means that the
scope of protection offered by State law varies widely. Whether
a communication (or laboratory test result) is "privileged" or
"protected" may depend on a number of factors:
The type of professional holding the information
and whether he is licensed or certified by the State
The context in which the information was communicated to
or obtained by the professional
The context in which the information will be or was disclosed
Exceptions to any general rule protecting information
To be effective in treating clients with substance abuse disorders,
counselors must respect their clients' right to confidentiality.
With the complex layering of Federal and State rules concerning
confidentiality, how does a counselor avoid violating the rules--short
of hiring a lawyer? When in doubt, counselors usually can follow
these simple rules: (1) consult the client--making clear the
options, as well as the counselor's legal obligations, (2) be
sensitive to what information is disclosed and how, and (3) review
the case with a clinical supervisor. Only as a last resort should
the counselor have to consult State law or a lawyer.
Site Map
Help
Account
Cart
Home
