Planning for Alcohol and Other Drug Abuse Treatment for Adults in the Criminal Justice System
Treatment Improvement Protocol (TIP) Series 17

Federal Laws and the Right to Privacy

Two Federal laws and a set of regulations guarantee the strict confidentiality of information about persons -- including offenders -- receiving alcohol and drug abuse prevention, assessment, and treatment services. The legal citations for these laws and regulations are 42 U.S.C. §§290 dd-3 and ee-3, and 42 C.F.R. Part 2.

These laws and regulations are designed to protect patients' privacy rights in order to attract people into treatment. The regulations restrict communications more tightly in many instances than, for example, either the doctor-patient or the attorney-client privilege. Violating the regulations is punishable by a fine of up to $500 for a first offense and up to $5,000 for each subsequent offense (42 C.F.R. Part 2 §2.4).

Some may view these Federal regulations, which protect privacy rights, as an irritation or a barrier to achieving program goals. However, most problems related to these regulations can easily be avoided by planning ahead. Familiarity with the regulations will ease communication and can reduce confidentiality-related conflicts among the treatment program, the client, and the criminal justice agency.

For an overview of Federal alcohol and other drug confidentiality laws, regulations, and options for successful communication and collaboration, see Lopez, 1994.

The General Rule

The Federal confidentiality laws and regulations protect any information about an offender if the offender has applied for or received any AOD abuse-related services from a program that is covered by the law. Services applied for or received can include assessment, diagnosis, individual counseling, group counseling, treatment, or treatment referral. Restrictions on disclosure apply to any information that would identify the offender as an alcohol or drug abuser, either directly or by implication.⁶ The general rule applies from the time the offender makes an appointment with the treatment program.⁷ It applies to offenders who are mandated into treatment as well as those who enter treatment voluntarily. It also applies to former clients or patients. The rule applies whether or not the person making an inquiry already has the information, has other ways of getting it, has some form of official status, is authorized by State law, or comes armed with a subpoena or search warrant.

What Types of Programs are Governed by the Regulations?

Any program that specializes, in whole or in part, in providing treatment, counseling, and/or assessment and referral services for offenders with alcohol or other drug problems must comply with the Federal confidentiality regulations (42 C.F.R. Part 2 §212(e)). Although Federal regulations apply only to programs that receive Federal assistance, this assistance includes indirect forms of Federal aid such as tax-exempt status, or State or local government funding coming -- in whole or in part -- from the Federal Government. Thus, it can be seen that virtually all programs providing AOD services to offenders would be covered by these regulations, since funding for such services would come in whole or in part from Federal, State, or local government agencies.

Adherence to Federal regulations does not depend on how a program labels its services. A program that calls itself a "prevention program" or "assessment program" is not excused from adhering to the confidentiality rules. It is the kind of services, not the label, that determines whether the program must comply with the Federal law.

When May Confidential Information Be Shared With Others?

Information protected by the Federal confidentiality regulations may be disclosed after the offender has signed a proper consent form. (If the offender is a minor, parental consent also must be obtained in some States.) The regulations also permit disclosure without the offender's consent in several situations, including medical emergencies, program evaluations, and communications among program staff.

The most commonly used exception to the general rule prohibiting disclosures is when a program obtains the offender's consent. The regulations provide two different forms of consent for mandated criminal justice clients. For communications between a program and the person or entity within the criminal justice system that mandated the offender's compliance with assessment or treatment, the program should use the special criminal justice system consent form (42 C.F.R. Part 2 §2.35; Exhibit 8-1). For all other consented disclosures, the program should use the general consent form authorized by the regulations (§2.31; Exhibit 8-2). The general consent form will be discussed first. The regulations' requirements regarding consent are somewhat unusual and strict and must be carefully followed.

Rules About Consent Forms

Most disclosures are permissible if an offender has signed a valid consent form that has not expired or been revoked (§2.31).⁸ Consent forms must be signed voluntarily; the offender is free to choose not to receive treatment.

A proper consent form must be in writing and must contain each of the items listed in §2.31:

• The name or general description of the program(s) making the disclosure
• The name or title of the individual or organization that will receive the disclosure
• The name of the patient who is the subject of the disclosure
• The purpose or need for the disclosure
• How much and what kind of information will be disclosed
• A statement that the patient may revoke the consent at any time, except to the extent that the program has already acted on it⁹
• The date, event, or condition upon which the consent expires, if not previously revoked
• The signature of the patient
• The date on which the consent is signed.

A general medical release form, or any consent form that does not contain all of the above elements, is not acceptable. (See sample consent form in Exhibit 8-2.) A number of items on this list merit further explanation and are discussed in this chapter.

Required Notice Against Redisclosing Information

Once a consent form has been properly completed, one last formal requirement remains. Any disclosure made with written patient consent must be accompanied by a written statement that the information disclosed is protected by Federal law and that the person receiving the information cannot make any further disclosure of such information unless permitted by the regulations (§2.32). This statement, not the consent form itself, should be delivered and explained to the recipient at the time of disclosure, or earlier. (See Exhibit 8-3.)

The prohibition on redisclosure is clear and strict. Those who receive the notice are prohibited from rereleasing information except as permitted by the regulations. Of course, an offender may sign a consent form authorizing such a redisclosure.

Note on the Use of Consent Forms

The fact that an offender has signed a proper consent form authorizing the release of information does not force a program to make the proposed disclosure, unless the program has also received a subpoena or court order (§§2.3(b); 2.61(a)(b)). The program's only obligation is to refuse to honor a consent that is expired, deficient, or otherwise known to be revoked, false, or invalid (§2.31(c)).

In most cases, the decision of whether or not to make a disclosure pursuant to a consent form is within the discretion of the program, unless State law requires or prohibits disclosure once consent is given. In general, it is best to follow this rule: Disclose only what is necessary, for only as long as is necessary, keeping in mind the purpose of the communication.

Special Rules About Consent Forms

Programs assessing and treating offenders must follow the confidentiality rules that generally apply to drug and alcohol programs. However, some special rules apply when an offender comes for assessment or treatment as an official condition of probation, sentencing, dismissal of charges, release from detention, or other disposition of any criminal proceeding; and information is being disclosed to the mandating agency.

A consent form or court order is still required before any disclosure can be made about an offender who is mandated into assessment or treatment. However, the rules concerning the length of time that a consent remains valid are different. A "criminal justice system consent" cannot be revoked before its expiration event or date. Specifically, the regulations require that the following factors be considered in determining how long a criminal justice system consent will remain in effect:

• The anticipated duration of treatment
• The type of criminal proceeding in which the offender is involved
• The need for treatment information in dealing with the proceeding
• When the final disposition will occur
• Other information the patient, program, or criminal justice agency believes is relevant.

These rules allow programs to continue to use a traditional expiration condition for a consent form that once was the only one allowed: "when there is a substantial change in the patient's justice system status." This formula appears to work well. A substantial change in status occurs whenever the offender moves from one phase of the criminal justice system to the next. For example, if an offender is on probation or parole and is in a program as a condition of probation or parole, there would be a change in criminal justice status when the term of probation or parole ended, either by successful completion or revocation. Thus, the program could provide an assessment or periodic treatment reports to the probation or parole officer monitoring the offender and could even testify at a probation or parole revocation hearing if it is so desired, since no change in criminal justice status would occur until after that hearing.

As for the revocability of the consent -- the rules under which the offender can take back his or her consent -- the regulations provide that the consent form can state that consent cannot be revoked until a certain specified date or condition occurs. The regulations permit the criminal justice system consent form to be irrevocable so that an offender who has agreed to enter treatment in lieu of prosecution or punishment cannot prevent the court, probation department, or other agency from monitoring his or her progress. Note that although a criminal justice system consent may be made irrevocable for a specified period of time, its irrevocability must end no later than the final disposition of the criminal proceeding. Thereafter, the offender may freely revoke consent. (See Exhibit 8-1.)¹⁰

Several other considerations relating to criminal justice system referrals are important. First, any information received by one of the eligible criminal justice agencies from a treatment program can be used by that justice agency only in connection with its official duties with respect to that particular criminal proceeding. The information may not be used in other proceedings, for other purposes, or with respect to other individuals (42 C.F.R. Part 2 §2.34(d)). Second, whenever possible, it is best to have the judge or referring agency require that a proper criminal justice system consent form be signed by the offender before he or she is referred to the treatment program. If that is not possible, the treatment program should have the offender sign a criminal justice system consent form at his or her very first appointment. With a proper criminal justice consent form signed, the AOD abuse treatment program can communicate with the referring criminal justice agency even if the offender appears for assessment or treatment only once. This procedure avoids the unfortunate problems that may arise if an offender mandated into assessment or treatment does not sign a proper consent form and then leaves before the assessment or treatment has been completed.

If a program fails to have the offender sign a criminal justice system form and the offender fails to complete the assessment process or treatment, the program has few options when faced with a request for information from the referring criminal justice agency. The program could attempt to locate the offender and ask him or her to sign a consent form, but that, of course, is unlikely to happen. Also, there is some question of whether a court can issue an order to authorize the program to release information about a referred offender who has left the program in this situation. This question comes up because the regulations allow a court to order disclosure of treatment information for the purpose of investigating or prosecuting a patient for a crime only when the crime is "extremely serious," and a parole or probation violation generally will not meet that criterion. Therefore, unless a consent form is obtained by the judge or criminal justice agency or by the treatment program at the very beginning of the assessment or treatment process, the program may ultimately be prevented from providing any information to the criminal justice agency that referred the offender.

If the offender referred by a criminal justice agency never applies for or receives program services, that fact may be communicated to the referring agency without patient consent (42 C.F.R. Part 2 §2.13(c)(2)). But once an offender makes an appointment to visit the program, consent or a court order is needed for any disclosures.

Seeking Information from Collateral Sources

Making inquiries of employers, schools, doctors, and other healthcare entities might, at first glance, seem to pose no risk to an offender's right to confidentiality. But it does.

When a program that screens, assesses, or treats offenders asks an employer, doctor, family member, AOD program that previously treated the offender, or mental health professional to verify information it has obtained from the offender, the program is making a patient-identifying disclosure that the offender has sought its services. In other words, when program staff seek information from other sources, they are informing these sources that the offender has asked for AOD services. Federal regulations generally prohibit this kind of disclosure unless the offender consents.

How, then, is a screening or assessment program to proceed? The easiest way is to get the offender's consent to contact the employer, family member, school, AOD abuse treatment program, healthcare facility, and the like. As noted above, when filling out the consent form, thought should be given to the purpose of the disclosure and how much and what kind of information would be disclosed. For example, if a program is assessing an offender for treatment and seeks records from a mental health provider, the purpose of the disclosure would be "to obtain mental health treatment records to complete the assessment." The kind of information disclosed would then be limited to a statement that "Michael Smith [the offender] is being assessed by the XYZ Program." No other information about Michael Smith would be released to the mental health provider.

If the program not only seeks records, but also needs to discuss with the mental health provider the treatment it provided the offender, the purpose of the disclosure would be "to discuss mental health treatment provided to Michael Smith by the mental health program." If the program merely seeks information, the kind of information disclosed would, as in the example above, be limited to a statement that "Michael Smith [the offender] is being assessed by the XYZ Program." However, if the program needs to disclose information it gained in its assessment of Michael Smith to the mental health provider in order to further the discussion, the kind of information disclosed would be "assessment information about Michael Smith."

A program that routinely seeks collateral information from many sources could consider asking the offender to sign a consent form that permitted disclosure for purposes of seeking information from collateral sources to any one of a number of entities or persons listed on the consent form. Note that this combination form must still include "the name or title of the individual or the name of the organization" for each collateral source the program may contact. Whichever method the program chooses, it must use the general consent form, not the special criminal justice system consent form.

Programs should keep in mind that even when information is disclosed over the telephone, they are still required to notify those receiving the information of the prohibition on redisclosure. Mention should be made of this restriction during the conversation; for example, program staff could say, "I'll be sending you a written statement that the information I gave you about Mr. Smith cannot be redisclosed."

Ongoing Communication

Special Problems of AOD Treatment Programs Housed in Correctional Facilities

AOD programs housed in correctional facilities, and AOD programs that are in correctional facilities dedicated to AOD treatment, face special problems in complying with the Federal confidentiality regulations. Free-standing community-based programs must think through every disclosure they make about offenders, but they are able to perform many of their basic functions without making any disclosures. Programs housed in correctional institutions, unlike community-based programs, would be unable to function without being able to communicate at least some information to the security staff at the institution, to the corrections department, and to other parts of the criminal justice system.

To take an obvious example, an AOD treatment program in a maximum-security correctional facility would be required to provide the security staff with a "count" of inmates regularly during the day. A statement that "150 inmates are in the unit" violates no one's confidentiality, but if one inmate has disappeared, the AOD program clearly must report his or her name to the security staff. (See the subsequent discussion of "Communications That Do Not Disclose Patient-Identifying Information." This disclosure that an inmate named Arthur Greenfield was missing from the AOD program would be a disclosure prohibited under the Federal regulations, even though the security staff knew full well that Arthur was in the program. How can the program proceed? Must it get Arthur's consent to disclose his disappearance? Not necessarily. The regulations permit staff within a program to make certain disclosures to each other and to those with direct administrative control over the program:

The restrictions on disclosure in these regulations do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of alcohol or drug abuse if the communications are (i) within a program or (ii) between a program and an entity that has direct administrative control over that program (42 C.F.R. Part 2 §2.12(c)(3)).

In other words, staff who have access to offender AOD records because they work for the program, including full- or part-time employees and unpaid volunteers, may consult among themselves or otherwise share information if their substance abuse work so requires. And staff may communicate patient-identifying information to a person or entity having "direct administrative control" over a program if there is a need for the information "in connection with their [AOD] duties." The question is whether the above example fits within this exception. This is not an easy question. However, the argument can be made that the AOD program housed in a correctional facility cannot function unless it can engage in this kind of communication, and therefore the communication is "in connection with [its AOD] duties."

How far this exception can be expanded is an open question. Can the AOD abuse treatment program communicate patient-identifying information to the central office of the Department of Correction? If the Department of Correction has jurisdiction not only over correctional facilities but also over probation and parole, can information be shared as the offender moves from probation to an institution or from an institution to parole?

The answers to these kinds of questions are among the most complicated in this area. In brief, there may be circumstances in which the AOD treatment unit can share information with other units or a supervisory agency without the offender's consent, but it is essential before such a system is set up that an expert in the area be consulted for assistance.

Two crucial issues must be considered. First, the program must always keep in mind that it may communicate only information that will assist it or the supervisory entity to provide AOD services.

The second issue to consider is that once communications are made to an entity having administrative control over the program, that entity becomes part of "the program," and it is now subject to the Federal confidentiality regulations. This transition means that personnel in that entity must become familiar with the Federal rules and that information from the AOD program cannot be redisclosed to anyone else unless the inmate consents or one of the other exceptions in the Federal regulations applies.

In the example given above about the prisoner's escape, the warden or security staff could call the police to report an escape from the facility because disclosure of Arthur's disappearance need not reveal any patient-identifying information. The warden need only report that a prisoner named Arthur Greenfield has escaped; there is no need to report that the prisoner was in the AOD program. But in other circumstances, disclosure might be prohibited. (See subsequent discussion of "Communications That Do Not Disclose Patient-Identifying Information.")

AOD programs that are in correctional facilities dedicated to AOD treatment present even more difficult confidentiality issues. Strictly interpreted, the Federal regulations prohibit the warden of a dedicated correctional facility from acknowledging to anyone that Arthur is an inmate because that would disclose Arthur's AOD abuse problem. While §2.12(c)(3) might permit the warden to make some kinds of disclosures to the Department of Correction, since the Department has direct administrative control over the institution, the warden might not be permitted to acknowledge Arthur's presence, for example, to a sheriff who came to serve Arthur with legal papers, or to his wife who came to visit, unless Arthur had signed a proper consent form agreeing to have the fact of his treatment disclosed to his wife or to the sheriff.

One solution to this problem is to have the offender, upon entering treatment at a dedicated correctional facility, sign consent forms that would permit the warden to disclose information in the event the offender escaped or otherwise misbehaved¹¹ in a way that required communication with the outside world. While the offender could revoke these consent forms, it is unlikely that he or she would remember to do so before a report were made.

Jurisdictions that consider establishing a system of comprehensive treatment for offenders along the entire criminal justice continuum and would like to encourage a flow of information about those offenders in treatment should settle confidentiality questions before the system is established. Planners may find that the most sensible way to deal with questions about how protected information can flow from arrest through incarceration through parole and back is to use consent forms. As the offender enters each phase of the system, a series of signed consent forms will enable the treatment program to

• Gain information from AOD programs in the system that previously treated the offender
• Communicate with those criminal justice entities with whom communication is essential
• Disclose information to AOD abuse treatment programs that will treat the offender in the next phase of supervision.

Offenders who refuse to sign consent forms permitting essential communications can be excluded from treatment and returned to the general population or provided treatment temporarily in the hope that resistance to signing the consent forms will lessen as treatment proceeds.

Duty to Warn

For most treatment professionals, the issue of reporting a patient's threat to harm someone or to commit a crime is troubling. Many professionals believe that they have an ethical, professional, or moral obligation to prevent a crime when they are in a position to do so, particularly when the crime is a serious one.

There has been a developing legal trend to require psychiatrists and other therapists to take "reasonable steps" to protect an intended victim when they learn that a patient presents a "serious danger of violence to another." This started with the case of Tarasoff v. Regents of the University of California, 17 Cal. 3d 425 (1976), in which the California Supreme Court held a psychologist liable for money damages because he failed to warn a potential victim when his patient threatened to kill, and then the patient killed the threatened individual. The court ruled that if a psychologist knows that a patient poses a serious risk of violence to a particular person, the psychologist has a duty "to warn the intended victim or others likely to apprise the victim of the danger, to notify the police, or to take whatever other steps are reasonably necessary under the circumstances."

While the Tarasoff ruling, strictly speaking, applies only in California, courts in a number of other States have followed Tarasoff in finding therapists liable for money damages when they failed to warn someone threatened by a patient. Most of these cases are limited to situations in which patients threaten a specific, identifiable victim, and they do not usually apply when a patient makes a general threat without identifying the intended target. States that have enacted laws on the subject have similarly limited the duty to warn to such situations.

When a program is faced with a question about duty to warn, there are always at least two and sometimes three questions that must be answered:

1. Is there a legal duty to warn in this particular situation under State law?
2. Even if there is no State legal requirement that the program warn an intended victim or the police, does the program feel a moral obligation to warn someone?

The first question can only be answered by an attorney familiar with the law in the State in which the program operates. If the answer to the first question is "no," it is advisable to discuss the second question with a knowledgeable lawyer also.

3. If the answer to questions 1 or 2 is "yes," can the program warn the victim or someone likely to be able to take action without violating the Federal AOD confidentiality regulations?

The problem is that there is a conflict between the Federal confidentiality requirements and the "duty to warn" imposed by States that have adopted the principles of the Tarasoff case. Simply put, the Federal confidentiality law and regulations prohibit the type of disclosure that Tarasoff and similar cases require,¹² unless the program can make the disclosure by using one of the regulation's narrow exceptions.

There are five ways a program can proceed when an offender makes a threat to harm him- or herself or another person, and the program decides to report the threat. First, the program can make a report to the criminal justice agency that mandated the offender into treatment, as long as it has a criminal justice system consent form signed by the offender that is worded broadly enough to allow this sort of information to be disclosed. The criminal justice agency can then act on the information. However, the regulations limit what the criminal justice agency can do with the information. Anyone receiving information pursuant to a criminal justice system consent "may redisclose and use it only to carry out that person's official duties with regard to the patient's conditional release or other action in connection with which the consent was given" (42 C.F.R. Part 2 §235(d)).

Thus, the disclosure can be used by the referring criminal justice agency to revoke an offender's conditional release, probation, or parole. If the referring criminal justice agency wants to warn the victim or to notify another law enforcement agency of the threat, it must be careful that no mention is made that the source was an AOD program or that the offender is in AOD assessment or treatment. (Disclosures that do not identify the offender as someone with an AOD problem are permitted. See the discussion of this exception below.) However, the disclosure most likely cannot be used to prosecute the offender for a separate crime (in other words, for making the threat). The only way to prosecute an offender based on information obtained from a program is to obtain a special court order in accordance with 42 C.F.R. Part 2 §2.65. (See below.)

The second way a program can proceed when an offender makes a threat to harm him- or herself or another person is to request a court order authorizing the disclosure. The program must take care that the court abides by the requirements of the Federal AOD regulations. (See the discussion of the court order exception below.)

A third way to proceed is to make a disclosure that does not identify as a patient the individual who threatens to commit the crime. This nondisclosure can be accomplished either by making an anonymous report or, for a program that is part of a larger non-AOD entity, by making the report in the larger entity's name. For example, a counselor employed by an AOD program that is part of a mental health facility could phone the police or the potential target of an attack, identify him- or herself as "a counselor at the New City Mental Health Clinic," and explain the risk to the potential target. This mode of reporting would convey the vital information without identifying the client as an AOD abuser. Counselors at free-standing AOD units cannot give the name of the program.

A fourth way to proceed is to make a report to medical personnel if the threat presents a medical emergency that poses an immediate threat to the health of any individual and requires immediate medical intervention (§2.51). (See the discussion of the medical emergency exception later in this chapter.)

Finally, the program can obtain the client's consent to report the threat of harm to the individual he or she has threatened.¹³

If none of these five options is practical, what should a program do when confronted with conflicting moral and legal obligations? If a program believes there is a clear and imminent danger to a client or a particular person, it is probably wiser to err on the side of making an effective report about the danger to the authorities or to the threatened individual. This is especially true in States that already follow the Tarasoff rule.

While each case presents different questions, it is doubtful that any prosecution or successful civil lawsuit under the confidentiality regulations would be brought against a counselor who warned about potential violence when he or she believed in good faith that there was real danger to a particular individual. On the other hand, a civil lawsuit for failure to warn may well result if the threat is actually carried out. In any event, the counselor should at least try to make the warning in a manner that does not identify the individual as an alcohol or other drug abuser.

Communications That Do Not Disclose Patient-Identifying Information

The Federal regulations permit programs to disclose information about an offender if the program reveals no patient-identifying information. "Patient-identifying" information is information that identifies someone as an alcohol or other drug abuser. Thus, a program may disclose information about an offender if that information does not identify him or her as an AOD abuser or support anyone else's identification of the offender as an AOD abuser.

There are two basic ways a program may make a disclosure that does not identify a patient. The first way is obvious; a program can report aggregate data about its population -- summary information that gives an overview of the patients served in the program -- or some portion of its populations. Thus, a program could tell the newspaper that in the past 6 months it screened 43 offenders, 10 female and 33 male. Using the second method, a program can communicate information about an offender in a way that does not reveal the offender's status as a drug or alcohol abuse patient (42 C.F.R. Part 2 §2.12(a)(i)). For example, a program that provides services to clients with other problems or illnesses as well as alcohol or other drug abuse may disclose information about a particular client as long as the fact that the client has a substance abuse problem is not revealed. Specifically, a program that was part of a general hospital could have a counselor call the police about a threat a client made, as long as the counselor did not disclose that the client had an AOD abuse problem or was a client of the AOD abuse treatment program.

Programs that provide only alcohol or other drug services or that provide a full range of services but are identified by the general public as AOD treatment programs cannot disclose information that identifies a client under this exception, since letting someone know a counselor is calling from the "XYZ Treatment Program" will automatically identify the offender as someone in the program. However, a free-standing program can sometimes make "anonymous" disclosures, that is, disclosures that do not mention the name of the program or otherwise reveal the offender's status as an alcohol or other drug abuser.

Court-Ordered Disclosures

A State or Federal court may issue an order that will permit a program to make a disclosure about an offender that would otherwise be forbidden. A court may issue one of these authorizing orders only after it follows certain special procedures and makes particular determinations required by the regulations. A subpoena, search warrant or arrest warrant, even when signed by a judge, is not alone sufficient to require or even to permit a program to disclose information (§2.61).¹⁴

Before a court can issue a court order authorizing a disclosure about an offender, the program and any offenders whose records are sought must be given notice of the application for the order and some opportunity to make an oral or written statement to the court.¹⁵ Generally, the application and any court order must use fictitious names for any known offender, and all court proceedings in connection with the application must remain confidential unless the offender requests otherwise (§§2.64(a), (b); 2.65, 2.66).

Before issuing an authorizing order, the court must find that there is "good cause" for the disclosure. A court can find "good cause" only if it determines that the public interest and the need for disclosure outweigh any negative effect that the disclosure would have on the patient, or the doctor-patient or counselor-patient relationship, and the effectiveness of the program's treatment services. Before it may issue an order, the court must also find that other ways of obtaining the information are not available or would be ineffective (§2.64(d)). The judge may examine the records before making a decision (§2.64(c)).

If the purpose of seeking the court order is to obtain authorization to disclose information in order to investigate or prosecute a patient for a crime, the court must also find that

• The crime involved is extremely serious, such as an act causing or threatening to cause death or serious injury
• The records sought are likely to contain information of significance to the investigation or prosecution
• There is no other practical way to obtain the information
• The public interest in disclosure outweighs any actual or potential harm to the patient, the doctor-patient relationship, and the ability of the program to provide services to other patients.

When law enforcement personnel seek the order, the court must also find that the program had an opportunity to be represented by independent counsel. (If the program is a governmental entity, it must be represented by counsel, §2.65(d)). There are also limits on the scope of the disclosure that a court may authorize, even when it finds good cause. The disclosure must be limited to information essential to fulfill the purpose of the order, and it must be restricted to those persons who need the information for that purpose. The court should also take any other steps that are necessary to protect the offender's confidentiality, including sealing court records from public scrutiny (§§2.64(e); 2.65(e)).

The court may order disclosure of "confidential communications" by an offender to the program only if the disclosure

• Is necessary to protect against a threat of death or serious bodily injury
• Is necessary to investigate or prosecute an extremely serious crime (including child abuse)
• Is in connection with a proceeding at which the offender has already presented evidence concerning confidential communications (for example, "I told my counselor . . .".) (§2.63).

Medical Emergencies

A program may make disclosures to public or private medical personnel "who have a need for information about [an offender] for the purpose of treating a condition which poses an immediate threat to the health" of the offender or any other individual. The regulations define "medical emergency" as a situation that poses an immediate threat to health and requires immediate medical intervention (§2.51). The medical emergency exception permits disclosure only to medical personnel. This restriction means that this exception cannot be used as the basis for a disclosure to the police or other nonmedical personnel, including family.

Whenever a disclosure is made to cope with a medical emergency, the program must document in the offender's records

• The name and affiliation of the recipient of the information
• The name of the individual making the disclosure
• The date and time of the disclosure
• The nature of the emergency.

Crimes on Program Premises or Against Personnel

When an offender has committed or has threatened to commit a crime on program premises or against program personnel, the regulations permit the program to report the crime to a law enforcement agency or to seek its assistance. In such a situation, without any special authorization, the program can disclose the circumstances of the incident, including the suspect's name, address, last known whereabouts, and status as a patient at the program (42 C.F.R. Part 2 §2.12(c)(5)).

Sharing Information With an Outside Agency (QSOAs)

If a program routinely needs to share certain information with an outside agency that provides services to the program, it can enter into what is known as a qualified service organization agreement (QSOA).

A QSOA is a written agreement between a program and a person providing services to the program. In the QSOA, the person 1) acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records from the program he or she is fully bound by Federal confidentiality regulations; and 2) promises that, if necessary, he or she will resist in judicial proceedings any efforts to obtain access to patient records except as permitted by these regulations (§§2.11; 2.12(c)(4)). A sample QSOA is provided in Exhibit 8-4.

A QSOA should only be used when an agency or official outside the program is providing a service to the program itself. An example is when laboratory analysis or data processing is performed for the program by an outside agency. A QSOA is not a substitute for individual consent in other situations. Disclosures under a QSOA must be limited to information that is needed by others so the program can function effectively. QSOAs may not be used between programs providing alcohol and other drug services.

Reporting Child Abuse and Neglect

All 50 States and the District of Columbia have statutes that require reporting when there is reasonable cause to believe or suspect child abuse or neglect. While many State statutes are similar, each has different rules about what kinds of conditions must be reported, who must report, and when and how reports must be made.

Most States now require not only physicians but also educators and social service workers to report child abuse. Most States require an immediate oral -- usually telephone -- report, and many now have toll-free numbers to facilitate reporting. Half the States require that both oral and written reports be made. All States extend immunity from prosecution to persons reporting child abuse and neglect. In other words, a person who reports child abuse or neglect cannot be brought into court. Most States provide penalties for failure to report.

The Federal confidentiality regulations permit programs to comply with State laws that require reporting child abuse and neglect. Thus, if an offender reveals to program staff that he or she has neglected or abused children, that fact may well have to be reported to State authorities. Note, however, that this exception to the general rule prohibiting disclosure of any information about a client applies only to initial reports of child abuse or neglect. Programs may not respond to followup requests for information or even subpoenas for additional information, even if the records are sought for use in civil or criminal proceedings resulting from the program's initial report, unless the offender consents or the appropriate court issues an order under subpart E of 42 C.F.R. Part 2. Because of the variation in State laws, programs should consult an attorney familiar with State law to ensure that their reporting practices are in compliance.

Research, Audit, or Evaluation

Confidentiality regulations also permit programs to disclose patient-identifying information to researchers, auditors, and evaluators without patient consent, providing certain safeguards are met (§§2.52; 2.53). Another TIP in this series, TIP 14: Developing State Outcomes Monitoring Systems for Alcohol and Other Drug Abuse Treatment, addresses these issues.

Patient Notice and Access to Records

Federal confidentiality regulations require programs to notify patients of their right to confidentiality and to give them a written summary of the regulations' requirements. The notice and summary should be handed to offenders when they begin participating in the program or soon thereafter (§2.22(a)). The regulations also contain a sample notice. Programs can use their own judgment to decide when to permit offenders to view or obtain copies of their records, unless State law grants patients the right of access to records. The Federal regulations do not require programs to obtain written consent from patients before permitting them to see their own records.

Security of Records

Federal regulations require programs to keep written records in a secure room, a locked file cabinet, a safe, or other similar container. (Staff in correctional facilities may face special problems maintaining records in accordance with the regulations. However, procedures must be worked out that follow the regulations as closely as possible.) The program should establish written procedures that regulate access to and use of offenders' records. Either the program director or a single staff person should be designated to process inquiries and requests for information (§2.16).