• What information is protected?
• What is required for consent to disclose?
• When can information be disclosed without consent?
• What if the treatment is court ordered in a criminal case?
• What if the patient is a minor?

Courts look at both the specific laws related to substance abuse treatment records and the appropriate privilege statutes to determine whether to permit or order the disclosure of information.20

Note that these confidentiality provisions apply to any substance abuse treatment, whether it was undertaken voluntarily, involuntarily by an order of the Probate Court, or court-ordered as a consequence of some other type of legal proceeding, such as a criminal arrest or a neglect proceeding in juvenile court.

Broad protection is granted to all records related to the identity, diagnosis, prognosis, or treatment of any patient that are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation or research.21 It does not matter if the patient is no longer in treatment.22

There are two subsets of information that are defined in the federal regulations that have specific types of protection granted.

Patient identifying information means the name, address, social security number, fingerprints, photograph, or similar information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information.23 This information may be disclosed for medical emergencies and research or audit purposes.24

Confidential communications are statements made by a patient to a program "in the course of diagnosis, treatment, or referral for treatment."25 This information may be disclosed only by court order under extremely limited circumstances.

Records of substance abuse treatment are not protected when they come within the scope of any state law requiring the reporting of suspected child abuse and neglect.26

An individual may always consent to the disclosure of his or her own records. A written consent27 is required, and must include the following:

• The specific name or general designation of the program or person permitted to make the disclosure.
• The name or title of the individual or the name of the organization to which disclosure is to be made.
• The name of the patient.
• The purpose of the disclosure.
• How much and what kind of information is to be disclosed.
• The signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent, or, when required for a patient who is incompetent or deceased, the signature of a person authorized to sign in lieu of the patient.
• The date on which the consent is signed.
• A statement that the consent is subject to revocation at any time except to the extent that the program or person which is to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third party payer.
• The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must insure that the consent will last no longer than reasonably necessary to serve the purpose for which it is given.

Each disclosure made with consent must be accompanied by the following written statement:28

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

Unless the individual consents to the disclosure, the only way for a party to obtain the information is by application to the court.29

A court order under the regulations is an order that authorizes the disclosure; it does not, by itself, compel the disclosure. The order must be accompanied by a subpoena or other legal mandate.30

The court may order the disclosure of patient records, other than confidential communications, if the party seeking disclosure demonstrates good cause. This includes "objective run-of-the-mill" data, including intake records, discharge records, attendance records, drug screen test results and records indicating compliance and noncompliance with treatment programs.31

If the request is for the disclosure of confidential communications, the party seeking disclosure must show good cause for the disclosure plus one of the following:

• the disclosure is necessary to protect against an existing threat to life or of serious bodily injury, including circumstances that constitute child abuse and neglect and verbal threats against third parties;
• the disclosure is necessary in connection with investigations or prosecution of an extremely serious crime; or
• the disclosure is in connection with litigation or an administrative proceeding in which the patient offers testimony or other evidence pertaining to the content of the confidential communications.

An order may be entered for disclosure only if the court finds good cause, by finding that:

• other ways of obtaining the information are not available or would not be effective; and
• the public interest and need for the disclosure outweigh the potential injury to the patient, the physician-patient relationship and the treatment services.32

An order authorizing the disclosure of patient records for purposes other than criminal investigation or prosecution may be applied for by any person having a legally recognized interest in the disclosure which is sought. It may be filed separately or as part of a pending civil action. It must use a fictitious name, and notice must be given to both the individual and the person holding the records.33

To obtain a court order for the disclosure of substance abuse treatment records, the party seeking the records must apply to the court for permission to issue a subpoena. The court order must then be attached to the subpoena and delivered to the health care provider. The records are then delivered to the court under seal. The court must hold a hearing at which the parties have the opportunity to be heard on whether the records should be disclosed. This hearing must be conducted to preserve the confidentiality of the information.

The order must narrowly define the scope of the order.34 Specifically, the order may:

• limit disclosure to those parts of the patient's record which are essential to fulfill the objective of the order,
• limit disclosure to those persons whose need for information is the basis for the order, and
• include such other measures as are necessary to limit disclosure for the protection of the patient, the physician-patient relationship and the treatment services.

The order may include orders for an in camera review to allow the court to redact portions that are confidential communications prior to disclosure, and orders not to redisclose, to use only for the purposes of the litigation, and/or to destroy or return the records at the end of the proceedings.

The fact that the court permitted the disclosure does not effect the admissibility of the evidence at trial.

A program may disclose information about a patient to those persons within the criminal justice system that have made participation in the program a condition of the disposition of any criminal proceedings against the patient or of the patient's parole or other release from custody if:

• the disclosure is only to those individuals within the criminal justice system who have a need for the information in connection with their obligation to monitor the patient’s progress, and
• the patient has signed an appropriate consent form.35