(1) Subpart B: General Provisions, including definitions, applicability, and general restrictions;

(2) Subpart C: Uses and Disclosures With Patient Consent, including uses and disclosures that require patient consent and the consent form requirements;

(3) Subpart D: Uses and Disclosures Without Patient Consent, including uses and disclosures which do not require patient consent or an authorizing court order; and

(4) Subpart E: Court Orders Authorizing Use and Disclosure, including uses and disclosures of records which may be made with an authorizing court order and the procedures and criteria for the entry and scope of those orders.

(1) The regulations in this part prohibit the use and disclosure of records unless certain circumstances exist. If any circumstance exists under which use or disclosure is permitted, that circumstance acts to remove the prohibition on use and disclosure but it does not compel the use or disclosure. Thus, the regulations in this part do not require use or disclosure under any circumstance other than when disclosure is required by the Secretary to investigate or determine a person's compliance with this part pursuant to § 2.3(c).

(2) The regulations in this part are not intended to direct the manner in which substantive functions such as research, treatment, and evaluation are carried out. They are intended to ensure that a patient receiving treatment for a substance use disorder in a part 2 program is not made more vulnerable by reason of the availability of their record than an individual with a substance use disorder who does not seek treatment.

(3) The regulations in this part shall not be construed to limit:

(1) Before presenting a request, subpoena, or other demand for records, or placing an undercover agent or informant in a health care practice or provider, as applicable, such person acted with reasonable diligence to determine whether the regulations in this part apply to the records, part 2 program, or other person holding records under this part. Reasonable diligence means taking all of the following actions where it is reasonable to believe that the practice or provider provides substance use disorder diagnostic, treatment, or referral for treatment services:

(2) The person followed all of the applicable provisions in this part for any use or disclosure of the received records under this part that occurred, or will occur, after the person or investigative agency knew, or by exercising reasonable diligence would have known, that it received records under this part.

(1) Who is a patient or employee of a part 2 program or who becomes a patient or employee of a part 2 program at the request of a law enforcement agency or official; and

(2) Who at the request of a law enforcement agency or official observes one or more patients or employees of the part 2 program for the purpose of reporting the information obtained to the law enforcement agency or official.

(1) Written consent in accordance with § 2.31 with an accompanying notice of disclosure.

(2) One of the exceptions to the written consent requirements in 42 U.S.C. 290dd-2 or this part.

(1) In the case of a part 2 program that is a natural person, that person.

(2) In the case of a part 2 program that is an entity, the person designated as director or managing director, or person otherwise vested with authority to act as chief executive officer of the part 2 program.

(1) A person (other than a general medical facility) that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or

(2) An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or

(3) Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.

(1) Provides services to a part 2 program, such as data processing, bill collecting, dosage preparation, laboratory analyses, or legal, accounting, population health management, medical staffing, or other professional services, or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy, and

(2) Has entered into a written agreement with a part 2 program under which that person:

(3) Qualified service organization includes a person who meets the definition of business associate in 45 CFR 160.103, paragraphs (1), (2), and (3), for a part 2 program that is also a covered entity, with respect to the use and disclosure of protected health information that also constitutes a “record” as defined by this section.

(1) A patient is, agrees to be, or is legally required to be diagnosed, evaluated, or treated, or agrees to accept consultation, for any condition by a person; and

(2) The person undertakes or agrees to undertake diagnosis, evaluation, or treatment of the patient, or consultation with the patient, for any condition.

(1) Restrictions on use and disclosure. The restrictions on use and disclosure in the regulations in this part apply to any records which:

(2) Restriction on use or disclosure. The restriction on use or disclosure of information to initiate or substantiate any criminal charges against a patient or to conduct any criminal investigation of a patient (42 U.S.C. 290dd-2(c)) applies to any information, whether or not recorded, which is substance use disorder information obtained by a federally assisted substance use disorder program after March 20, 1972 (part 2 program), or is alcohol use disorder information obtained by a federally assisted alcohol use disorder or substance use disorder program after May 13, 1974 (part 2 program); or if obtained before the pertinent date, is maintained by a part 2 program after that date as part of an ongoing treatment episode which extends past that date; for the purpose of treating a substance use disorder, making a diagnosis for the treatment, or making a referral for the treatment.

(1) It is conducted in whole or in part, whether directly or by contract or otherwise by any department or agency of the United States (but see paragraphs (c)(1) and (2) of this section relating to the Department of Veterans Affairs and the Uniformed Services);

(2) It is being carried out under a license, certification, registration, or other authorization granted by any department or agency of the United States including but not limited to:

(3) It is supported by funds provided by any department or agency of the United States by being:

(4) It is assisted by the Internal Revenue Service of the Department of the Treasury through the allowance of income tax deductions for contributions to the program or through the granting of tax exempt status to the program.

(1) Department of Veterans Affairs. These regulations do not apply to information on substance use disorder patients maintained in connection with the Department of Veterans Affairs' provision of hospital care, nursing home care, domiciliary care, and medical services under Title 38, U.S.C. Those records are governed by 38 U.S.C. 7332 and regulations issued under that authority by the Secretary of Veterans Affairs.

(2) Uniformed Services. The regulations in this part apply to any information described in paragraph (a) of this section which was obtained by any component of the Uniformed Services during a period when the patient was subject to the Uniform Code of Military Justice except:

(3) Communication within a part 2 program or between a part 2 program and an entity having direct administrative control over that part 2 program. The restrictions on use and disclosure in the regulations in this part do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of patients with substance use disorders if the communications are:

(4) Qualified service organizations. The restrictions on use and disclosure in the regulations in this part do not apply to the communications between a part 2 program and a qualified service organization of information needed by the qualified service organization to provide services to or on behalf of the program.

(5) Crimes on part 2 program premises or against part 2 program personnel. The restrictions on use and disclosure in the regulations in this part do not apply to communications from part 2 program personnel to law enforcement agencies or officials which:

(6) Reports of suspected child abuse and neglect. The restrictions on use and disclosure in the regulations in this part do not apply to the reporting under state law of incidents of suspected child abuse and neglect to the appropriate state or local authorities. However, the restrictions continue to apply to the original substance use disorder patient records maintained by the part 2 program including their use and disclosure for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect.

(1) Restriction on use and disclosure of records. The restriction on the use and disclosure of any record subject to the regulations in this part to initiate or substantiate criminal charges against a patient or to conduct any criminal investigation of a patient, or to use in any civil, criminal, administrative, or legislative proceedings against a patient, applies to any person who obtains the record from a part 2 program, covered entity, business associate, intermediary, or other lawful holder, regardless of the status of the person obtaining the record or whether the record was obtained in accordance with subpart E of this part. This restriction on use and disclosure bars, among other things, the introduction into evidence of a record or testimony in any criminal prosecution or civil action before a Federal or state court, reliance on the record or testimony to inform any decision or otherwise be taken into account in any proceeding before a Federal, state, or local agency, the use of such record or testimony by any Federal, state, or local agency for a law enforcement purpose or to conduct any law enforcement investigation, and the use of such record or testimony in any application for a warrant, absent patient consent or a court order in accordance with subpart E of this part. Records obtained by undercover agents or informants, § 2.17, or through patient access, § 2.23, are subject to the restrictions on uses and disclosures.

(2) Restrictions on uses and disclosures —

(1) Coverage. These regulations cover any information (including information on referral and intake) about patients receiving diagnosis, treatment, or referral for treatment for a substance use disorder created by a part 2 program. Coverage includes, but is not limited to, those treatment or rehabilitation programs, employee assistance programs, programs within general hospitals, school-based programs, and private practitioners who hold themselves out as providing, and provide substance use disorder diagnosis, treatment, or referral for treatment. However, the regulations in this part would not apply, for example, to emergency room personnel who refer a patient to the intensive care unit for an apparent overdose, unless the primary function of such personnel is the provision of substance use disorder diagnosis, treatment, or referral for treatment and they are identified as providing such services or the emergency room has promoted itself to the community as a provider of such services.

(2) Federal assistance to program required. If a patient's substance use disorder diagnosis, treatment, or referral for treatment is not provided by a part 2 program, that patient's record is not covered by the regulations in this part. Thus, it is possible for an individual patient to benefit from federal support and not be covered by the confidentiality regulations because the program in which the patient is enrolled is not federally assisted as defined in paragraph (b) of this section. For example, if a federal court placed an individual in a private for-profit program and made a payment to the program on behalf of that individual, that patient's record would not be covered by the regulations in this part unless the program itself received federal assistance as defined by paragraph (b) of this section.

(3) Information to which restrictions are applicable. Whether a restriction applies to the use or disclosure of a record affects the type of records which may be disclosed. The restrictions on use and disclosure apply to any records which would identify a specified patient as having or having had a substance use disorder. The restriction on use and disclosure of records to bring a civil action or criminal charges against a patient in any civil, criminal, administrative, or legislative proceedings applies to any records obtained by the part 2 program for the purpose of diagnosis, treatment, or referral for treatment of patients with substance use disorders. (Restrictions on use and disclosure apply to recipients of records as specified under paragraph (d) of this section.)

(4) How type of diagnosis affects coverage. These regulations cover any record reflecting a diagnosis identifying a patient as having or having had a substance use disorder which is initially prepared by a part 2 program in connection with the treatment or referral for treatment of a patient with a substance use disorder. A diagnosis prepared by a part 2 program for the purpose of treatment or referral for treatment, but which is not so used, is covered by the regulations in this part. The following are not covered by the regulations in this part:

(1) The presence of an identified patient in a health care facility or component of a health care facility that is publicly identified as a place where only substance use disorder diagnosis, treatment, or referral for treatment is provided may be acknowledged only if the patient's written consent is obtained in accordance with subpart C of this part or if an authorizing court order is entered in accordance with subpart E of this part. The regulations permit acknowledgment of the presence of an identified patient in a health care facility or part of a health care facility if the health care facility is not publicly identified as only a substance use disorder diagnosis, treatment, or referral for treatment facility, and if the acknowledgment does not reveal that the patient has a substance use disorder.

(2) Any answer to a request for a disclosure of patient records which is not permissible under the regulations in this part must be made in a way that will not affirmatively reveal that an identified individual has been, or is being, diagnosed or treated for a substance use disorder. An inquiring party may be provided a copy of the regulations in this part and advised that they restrict the disclosure of substance use disorder patient records, but may not be told affirmatively that the regulations restrict the disclosure of the records of an identified patient.

(1) Where state law requires consent of a parent, guardian, or other person for a minor to obtain treatment for a substance use disorder, any written consent for use or disclosure authorized under subpart C of this part must be given by both the minor and their parent, guardian, or other person authorized under state law to act on the minor's behalf.

(2) Where state law requires parental consent to treatment, the fact of a minor's application for treatment may be communicated to the minor's parent, guardian, or other person authorized under state law to act on the minor's behalf only if:

(1) A minor applicant for services lacks capacity because of extreme youth or mental or physical condition to make a rational decision on whether to consent to a disclosure under subpart C of this part to their parent, guardian, or other person authorized under state law to act on the minor's behalf; and

(2) The minor applicant's situation poses a substantial threat to the life or physical well-being of the minor applicant or any other person which may be reduced by communicating relevant facts to the minor's parent, guardian, or other person authorized under state law to act on the minor's behalf.

(1) Adjudication by a court. In the case of a patient who has been adjudicated as lacking the capacity, for any reason other than insufficient age, to make their own health care decisions, any consent which is required under the regulations in this part may be given by the personal representative.

(2) No adjudication by a court. In the case of a patient, other than a minor or one who has been adjudicated as lacking the capacity to make health care decisions, that for any period suffers from a medical condition that prevents knowing or effective action on their own behalf, the part 2 program director may exercise the right of the patient to consent to a use or disclosure under subpart C of this part for the sole purpose of obtaining payment for services from a third-party payer or health plan.

(1) Vital statistics. These regulations do not restrict the disclosure of patient identifying information relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.

(2) Consent by personal representative. Any other use or disclosure of information identifying a deceased patient as having a substance use disorder is subject to the regulations in this part. If a written consent to the use or disclosure is required, that consent may be given by the personal representative.

(1) Requirements for formal policies and procedures. These policies and procedures must address all of the following:

(2) Exception for certain lawful holders. Family, friends, and other informal caregivers who are lawful holders as defined in this part are not required to comply with paragraph (a) of this section.

(1) The patient who is the subject of the records gives written consent (meeting the requirements of § 2.31) to a transfer of the records to the acquiring program or to any other program designated in the consent (the manner of obtaining this consent must minimize the likelihood of a disclosure of patient identifying information to a third party);

(2) There is a legal requirement that the records be kept for a period specified by law which does not expire until after the discontinuation or acquisition of the part 2 program; or

(3) The part 2 program is transferred, retroceded, or reassumed pursuant to the Indian Self-Determination and Education Assistance Act (ISDEAA), 25 U.S.C. 5301 et seq., and its implementing regulations in 25 CFR part 900.

(1) Records in non-electronic (e.g., paper) form must be:

(2) All of the following requirements apply to records in electronic form:

(1) Required elements. The notice must include the following content:

(2) Optional elements.

(3) Revisions to the notice. The part 2 program must promptly revise and distribute its notice whenever there is a material change to the uses or disclosures, the patient's rights, the part 2 program's legal duties, or other privacy practices stated in the notice. Except when required by law, a material change to any term of the notice may not be implemented prior to the effective date of the notice in which such material change is reflected.

(1) A part 2 program must provide the notice:

(2) If the part 2 program maintains a physical service delivery site:

(3) Specific requirements for electronic notice include all the following:

(1) Must be made in writing; and

(2) Are limited to disclosures made within the past 3 years.

(1) Respond in 30 or fewer days of receipt of the written request; and

(2) Provide, for each disclosure, the name(s) of the entity(ies) to which the disclosure was made, the date of the disclosure, and a brief description of the patient identifying information disclosed.

(1) A part 2 program must provide a patient with an accounting of disclosures of records for treatment, payment, and health care operations only where such disclosures are made through an electronic health record.

(2) A patient has a right to receive an accounting of disclosures described in paragraph (b)(1) of this section during only the 3 years prior to the date on which the accounting is requested.

(1) A part 2 program must permit a patient to request that the part 2 program restrict uses or disclosures of records about the patient to carry out treatment, payment, or health care operations, including when the patient has signed written consent for such disclosures.

(2) Except as provided in paragraph (a)(6) of this section, a part 2 program is not required to agree to a restriction.

(3) A part 2 program that agrees to a restriction under paragraph (a)(1) of this section may not use or disclose records in violation of such restriction, except that, if the patient who requested the restriction is in need of emergency treatment and the restricted record is needed to provide the emergency treatment, the part 2 program may use the restricted record, or may disclose information derived from the record to a health care provider, to provide such treatment to the patient.

(4) If information from a restricted record is disclosed to a health care provider for emergency treatment under paragraph (a)(3) of this section, the part 2 program must request that such health care provider not further use or disclose the information.

(5) A restriction agreed to by a part 2 program under paragraph (a) of this section is not effective under this subpart to prevent uses or disclosures required by law or permitted by this part for purposes other than treatment, payment, and health care operations.

(6) A part 2 program must agree to the request of a patient to restrict disclosure of records about the patient to a health plan if:

(1) The patient agrees to or requests the termination in writing.

(2) The patient orally agrees to the termination and the oral agreement is documented.

(3) The part 2 program informs the patient that it is terminating its agreement to a restriction, except that such termination is:

(1) The name of the patient.

(2) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.

(3) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.

(4)

(5) A description of each purpose of the requested use or disclosure.

(6) The patient's right to revoke the consent in writing, except to the extent that the part 2 program or other lawful holder of patient identifying information that is permitted to make the disclosure has already acted in reliance on it, and how the patient may revoke consent.

(7) An expiration date or an expiration event that relates to the individual patient or the purpose of the use or disclosure. The statement “end of the treatment,” “none,” or similar language is sufficient if the consent is for a use or disclosure for treatment, payment, or health care operations. The statement “end of the research study” or similar language is sufficient if the consent is for a use or disclosure for research, including for the creation and maintenance of a research database or research repository.

(8) The signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent under § 2.14; or, when required for a patient who has been adjudicated as lacking the capacity to make their own health care decisions or is deceased, the signature of a person authorized to sign under § 2.15. Electronic signatures are permitted to the extent that they are not prohibited by any applicable law.

(9) The date on which the consent is signed.

(10) A patient's written consent to use or disclose records for treatment, payment, or health care operations must include all of the following statements:

(1) Notwithstanding any provision of this subpart, a part 2 program must obtain consent for any use or disclosure of SUD counseling notes, except:

(2) A written consent for a use or disclosure of SUD counseling notes may only be combined with another written consent for a use or disclosure of SUD counseling notes.

(3) A part 2 program may not condition the provision to a patient of treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of a written consent for a use or disclosure of SUD counseling notes.

(1) Has expired;

(2) On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section;

(3) Is known to have been revoked; or

(4) Is known, or through reasonable diligence could be known, by the person holding the records to be materially false.

(1) Statement 1.

This record which has been disclosed to you is protected by Federal confidentiality rules (42 CFR part 2). These rules prohibit you from using or disclosing this record, or testimony that describes the information contained in this record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against the patient, unless authorized by the consent of the patient, except as provided at 42 CFR 2.12(c)(5) or as authorized by a court in accordance with 42 CFR 2.64 or 2.65. In addition, the Federal rules prohibit you from making any other use or disclosure of this record unless at least one of the following applies:

(2) Statement 2. “42 CFR part 2 prohibits unauthorized use or disclosure of these records.”

(1) A part 2 program may use and disclose those records in accordance with that consent to any person or category of persons identified or generally designated in the consent, except that disclosures to central registries and in connection with criminal justice referrals must meet the requirements of §§ 2.34 and 2.35, respectively.

(2) When the consent provided is a single consent for all future uses and disclosures for treatment, payment, and health care operations, a part 2 program, covered entity, or business associate may use and disclose those records for treatment, payment, and health care operations as permitted by the HIPAA regulations, until such time as the patient revokes such consent in writing.

(1) When disclosed for treatment, payment, and health care operations activities to a covered entity or business associate, such recipient may further disclose those records in accordance with the HIPAA regulations, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient.

(2) When disclosed with consent given once for all future treatment, payment, and health care operations activities to a part 2 program that is not a covered entity or business associate, the recipient may further disclose those records consistent with the consent.

(3) When disclosed for payment or health care operations activities to a lawful holder that is not a covered entity or business associate, the recipient may further disclose those records as may be necessary for its contractors, subcontractors, or legal representatives to carry out the payment or health care operations specified in the consent on behalf of such lawful holders.

(1) The disclosure is made when:

(2) The disclosure is limited to:

(3) The disclosure is made with the patient's written consent meeting the requirements of § 2.31, except that:

(1) The name, address, and telephone number of the member program(s) in which the patient is already enrolled to the inquiring member program; and

(2) The name, address, and telephone number of the inquiring member program to the member program(s) in which the patient is already enrolled. The member programs may communicate as necessary to verify that no error has been made and to prevent or eliminate any multiple enrollments.

(1) The name, address, and telephone number of the member program(s) in which the patient is enrolled;

(2) Type and dosage of any medication for substance use disorder being administered or prescribed to the patient by the member program(s); and

(3) Relevant dates of any such administration or prescription. The central registry and non-member program treating prescriber may communicate as necessary to verify that no error has been made and to prevent or eliminate any multiple enrollments or improper prescribing.

(1) The disclosure is made only to those persons within the criminal justice system who have a need for the information in connection with their duty to monitor the patient's progress (e.g., a prosecuting attorney who is withholding charges against the patient, a court granting pretrial or post-trial release, probation or parole officers responsible for supervision of the patient); and

(2) The patient has signed a written consent meeting the requirements of § 2.31 (except paragraph (a)(6) of this section which is inconsistent with the revocation provisions of paragraph (c) of this section) and the requirements of paragraphs (b) and (c) of this section.

(1) The anticipated length of the treatment;

(2) The type of criminal proceeding involved, the need for the information in connection with the final disposition of that proceeding, and when the final disposition will occur; and

(3) Such other factors as the part 2 program, the patient, and the person(s) within the criminal justice system who will receive the disclosure consider pertinent.

(1) Meet a bona fide medical emergency in which the patient's prior written consent cannot be obtained; or

(2) Meet a bona fide medical emergency in which a part 2 program is closed and unable to provide services or obtain the prior written consent of the patient, during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time that the part 2 program resumes operations.

(1) The name of the medical personnel to whom disclosure was made and their affiliation with any health care facility;

(2) The name of the person making the disclosure;

(3) The date and time of the disclosure; and

(4) The nature of the emergency (or error, if the report was to FDA).

(1) The person designated as director or managing director, or person otherwise vested with authority to act as chief executive officer or their designee, of a part 2 program or other lawful holder of data under this part, makes a determination that the recipient of the patient identifying information is:

(2) The part 2 program or other lawful holder of data under this part is a HIPAA covered entity or business associate, and the use or disclosure is made in accordance with the requirements at 45 CFR 164.512(i).

(3) If neither paragraph (a)(1) or (2) of this section apply to the receiving or disclosing party, this section does not apply.

(1) Is fully bound by the regulations in this part and, if necessary, will resist in judicial proceedings any efforts to obtain access to patient records except as permitted by the regulations in this part.

(2) Must not redisclose patient identifying information except back to the person from whom that patient identifying information was obtained or as permitted under paragraph (c) of this section.

(3) May include data under this part in research reports only in aggregate form in which patient identifying information has been de-identified in accordance with the requirements of 45 CFR 164.514(b) such that there is no reasonable basis to believe that the information can be used to identify a patient.

(4) Must maintain and destroy patient identifying information in accordance with the security policies and procedures established under § 2.16.

(5) Must retain records in compliance with applicable federal, state, and local record retention laws.

(1) Researchers. Any person conducting scientific research using patient identifying information obtained under paragraph (a) of this section that requests linkages to data sets from a data repository(ies) holding patient identifying information must:

(2) Data repositories. For purposes of this section, a data repository is fully bound by the provisions of part 2 upon receipt of the patient identifying data and must:

(1) Performs the audit or evaluation on behalf of:

(2) Is determined by the part 2 program or other lawful holder to be qualified to conduct an audit or evaluation of the part 2 program or other lawful holder.

(1) Agrees in writing to:

(2) Performs the audit or evaluation on behalf of:

(1) Activities undertaken by a Federal, state, or local governmental agency, or a third-party payer or health plan, in order to:

(2) Reviews of appropriateness of medical care, medical necessity, and utilization of services.

(1) Patient identifying information, as defined in § 2.11, may be disclosed under paragraph (e) of this section to any person for the purpose of conducting a Medicare, Medicaid, or CHIP audit or evaluation, including an audit or evaluation necessary to meet the requirements for a Centers for Medicare & Medicaid Services (CMS)-regulated accountable care organization (CMS-regulated ACO) or similar CMS-regulated organization (including a CMS-regulated Qualified Entity (QE)), if the person agrees in writing to comply with the following:

(2) A Medicare, Medicaid, or CHIP audit or evaluation under this section includes a civil or administrative investigation of a part 2 program by any federal, state, or local government agency with oversight responsibilities for Medicare, Medicaid, or CHIP and includes administrative enforcement, against the part 2 program by the government agency, of any remedy authorized by law to be imposed as a result of the findings of the investigation.

(3) An audit or evaluation necessary to meet the requirements for a CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE) must be conducted in accordance with the following:

(4) Program, as defined in § 2.11, includes an employee of, or provider of medical services under the program when the employee or provider is the subject of a civil investigation or administrative remedy, as those terms are used in paragraph (e)(2) of this section.

(5) If a disclosure to a person is authorized under this section for a Medicare, Medicaid, or CHIP audit or evaluation, including a civil investigation or administrative remedy, as those terms are used in paragraph (e)(2) of this section, the person may further use or disclose the patient identifying information that is received for such purposes to its contractor(s), subcontractor(s), or legal representative(s), to carry out the audit or evaluation, and a quality improvement organization which obtains such information under paragraph (a) or (b) of this section may use or disclose the information to that person (or, to such person's contractors, subcontractors, or legal representatives, but only for the purposes of this section).

(6) The provisions of this paragraph (e) do not authorize the part 2 program, the Federal, state, or local government agency, or any other person to use or disclose patient identifying information obtained during the audit or evaluation for any purposes other than those necessary to complete the audit or evaluation as specified in this paragraph (e).

(1) A person holding records subject to the regulations in this part receives a subpoena for those records. The person may not use or disclose the records in response to the subpoena unless a court of competent jurisdiction enters an authorizing order under the regulations in this part.

(2) An authorizing court order is entered under the regulations in this part, but the person holding the records does not want to make the use or disclosure. If there is no subpoena or other compulsory process or a subpoena for the records has expired or been quashed, that person may refuse to make the use or disclosure. Upon the entry of a valid subpoena or other compulsory process the person holding the records must use or disclose, unless there is a valid legal defense to the process other than the confidentiality restrictions of the regulations in this part.

(1) The disclosure is necessary to protect against an existing threat to life or of serious bodily injury, including circumstances which constitute suspected child abuse and neglect and verbal threats against third parties;

(2) The disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, such as one which directly threatens loss of life or serious bodily injury, including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, or child abuse and neglect; or

(3) The disclosure is in connection with a civil, criminal, administrative, or legislative proceeding in which the patient offers testimony or other evidence pertaining to the content of the confidential communications.

(1) Adequate notice in a manner which does not disclose patient identifying information to other persons; and

(2) An opportunity to file a written response to the application, or to appear in person, for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order as described in § 2.64(d).

(1) Other ways of obtaining the information are not available or would not be effective; and

(2) The public interest and need for the use or disclosure outweigh the potential injury to the patient, the physician-patient relationship and the treatment services.

(1) Limit use or disclosure to only those parts of the patient's record, or testimony relaying those parts of the patient's record, which are essential to fulfill the objective of the order;

(2) Limit use or disclosure to those persons whose need for information is the basis for the order; and

(3) Include such other measures as are necessary to limit use or disclosure for the protection of the patient, the physician-patient relationship and the treatment services; for example, sealing from public scrutiny the record of any proceeding for which use or disclosure of a patient's record, or testimony relaying the contents of the record, has been ordered.

(1) Adequate notice (in a manner which will not disclose patient identifying information to other persons) of an application by a law enforcement agency or official;

(2) An opportunity to appear and be heard for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order as described in § 2.65(d); and

(3) An opportunity to be represented by counsel independent of counsel for an applicant who is a law enforcement agency or official.

(1) The crime involved is extremely serious, such as one which causes or directly threatens loss of life or serious bodily injury including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, and child abuse and neglect.

(2) There is a reasonable likelihood that the records or testimony will disclose information of substantial value in the investigation or prosecution.

(3) Other ways of obtaining the information are not available or would not be effective.

(4) The potential injury to the patient, to the physician-patient relationship and to the ability of the part 2 program to provide services to other patients is outweighed by the public interest and the need for the disclosure.

(5) If the applicant is a law enforcement agency or official, that:

(1) Limit use and disclosure to those parts of the patient's record, or testimony relaying the information contained in those records, which are essential to fulfill the objective of the order;

(2) Limit disclosure to those law enforcement and prosecutorial officials who are responsible for, or are conducting, the investigation or prosecution, and limit their use of the records or testimony to investigation and prosecution of the extremely serious crime or suspected crime specified in the application; and

(3) Include such other measures as are necessary to limit use and disclosure to the fulfillment of only that public interest and need found by the court.

(1) An order authorizing the use or disclosure of patient records subject to this part to investigate or prosecute a part 2 program or the person holding the records (or employees or agents of that part 2 program or person holding the records) in connection with a criminal or administrative matter may be applied for by any investigative agency having jurisdiction over the program's or person's activities.

(2) The application may be filed separately or as part of a pending civil or criminal action against a part 2 program or the person holding the records (or agents or employees of the part 2 program or person holding the records) in which the applicant asserts that the patient records are needed to provide material evidence. The application must use a fictitious name, such as John Doe, to refer to any patient and may not contain or otherwise disclose any patient identifying information unless the court has ordered the record of the proceeding sealed from public scrutiny or the patient has provided written consent (meeting the requirements of § 2.31) to that disclosure.

(3) Upon discovering in good faith that it received records under this part in the course of investigating or prosecuting a part 2 program or the person holding the records (or employees or agents of that part 2 program or person holding the records), an investigative agency must do the following:

(1) Other ways of obtaining the information are not available, would not be effective, or would yield incomplete information;

(2) The public interest and need for the use or disclosure outweigh the potential injury to the patient, the physician-patient relationship, and the treatment services; and

(3) For an application being submitted pursuant to paragraph (a)(3)(ii) of this section, the investigative agency has satisfied the conditions at § 2.3(b). Information from records obtained in violation of this part, including § 2.12(d), cannot be used in an application for a court order to obtain such records.

(1) An order entered under this section must require the deletion or removal of patient identifying information from any documents or oral testimony made available to the public.

(2) No information obtained under this section may be used or disclosed to conduct any investigation or prosecution of a patient in connection with a criminal matter, or be used or disclosed as the basis for an application for an order under § 2.65.

(1) The part 2 program director is involved in the suspected criminal activities to be investigated by the undercover agent or informant; or

(2) The part 2 program director will intentionally or unintentionally disclose the proposed placement of an undercover agent or informant to the employees or agents of the program who are suspected of criminal activities.

(1) There is reason to believe that an employee or agent of the part 2 program is engaged in criminal activity;

(2) Other ways of obtaining evidence of the suspected criminal activity are not available, would not be effective, or would yield incomplete evidence;

(3) The public interest and need for the placement of an undercover agent or informant in the part 2 program outweigh the potential injury to patients of the part 2 program, physician-patient relationships, and the treatment services; and

(4) For an application submitted after the placement of an undercover agent or informant has already occurred, that the investigative agency has satisfied the conditions at § 2.3(b) and only discovered that a court order was necessary after such placement occurred. Information from records obtained in violation of this part, including § 2.12(d), cannot be used in an application for a court order to obtain such records.

(1) Specifically authorize the placement of an undercover agent or an informant;

(2) Limit the total period of the placement to twelve months, starting on the date that the undercover agent or informant is placed on site within the program. The placement of an undercover agent or informant must end after 12 months, unless a new court order is issued to extend the period of placement;

(3) Prohibit the undercover agent or informant from using or disclosing any patient identifying information obtained from the placement except as necessary to investigate or prosecute employees or agents of the part 2 program in connection with the suspected criminal activity; and

(4) Include any other measures which are appropriate to limit any potential disruption of the part 2 program by the placement and any potential for a real or apparent breach of patient confidentiality; for example, sealing from public scrutiny the record of any proceeding for which disclosure of a patient's record has been ordered.

(1) The number of applications made under §§ 2.66(a)(3)(ii) and 2.67(c)(4) during the calendar year;

(2) The number of instances in which such applications were denied, due to findings by the court of violations of this part during the calendar year; and

(3) The number of instances in which records under this part were returned or destroyed following unknowing receipt without a court order, in compliance with § 2.66(a)(3)(iii), (iv), or (v), respectively during the calendar year.