42 U.S. Code § 290dd–2 - Confidentiality of records

(a) Requirement

Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance use disorder education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e), be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b).

(b) Permitted disclosure

(1) Consent

The following shall apply with respect to the contents of any record referred to in subsection (a):

(A) Such contents may be used or disclosed in accordance with the prior written consent of the patient with respect to whom such record is maintained.

(B) Once prior written consent of the patient has been obtained, such contents may be used or disclosed by a covered entity, business associate, or a program subject to this section for purposes of treatment, payment, and health care operations as permitted by the HIPAA regulations. Any information so disclosed may then be redisclosed in accordance with the HIPAA regulations. Section 17935(c) of this title shall apply to all disclosures pursuant to subsection (b)(1) of this section.

(C) It shall be permissible for a patient’s prior written consent to be given once for all such future uses or disclosures for purposes of treatment, payment, and health care operations, until such time as the patient revokes such consent in writing.

(D) Section 17935(a) of this title shall apply to all disclosures pursuant to subsection (b)(1) of this section.

(2) Method for disclosure

Whether or not the patient, with respect to whom any given record referred to in subsection (a) is maintained, gives written consent, the content of such record may be disclosed as follows:

(A) To medical personnel to the extent necessary to meet a bona fide medical emergency.

(B) To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual patient in any report of such research, audit, or evaluation, or otherwise disclose patient identities in any manner.

(C) If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor, including the need to avert a substantial risk of death or serious bodily harm. In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure.

(D) To a public health authority, so long as such content meets the standards established in section 164.514(b) of title 45, Code of Federal Regulations (or successor regulations) for creating de-identified information.

(c) Use of records in criminal, civil, or administrative contexts

Except as otherwise authorized by a court order under subsection (b)(2)(C) or by the consent of the patient, a record referred to in subsection (a), or testimony relaying the information contained therein, may not be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, State, or local authority, against a patient, including with respect to the following activities:

(1) Such record or testimony shall not be entered into evidence in any criminal prosecution or civil action before a Federal or State court.

(2) Such record or testimony shall not form part of the record for decision or otherwise be taken into account in any proceeding before a Federal, State, or local agency.

(3) Such record or testimony shall not be used by any Federal, State, or local agency for a law enforcement purpose or to conduct any law enforcement investigation.

(4) Such record or testimony shall not be used in any application for a warrant.

(d) Application

The prohibitions of this section continue to apply to records concerning any individual who has been a patient, irrespective of whether or when such individual ceases to be a patient.

(e) Nonapplicability

The prohibitions of this section do not apply to any interchange of records—

(1) within the Uniformed Services or within those components of the Department of Veterans Affairs furnishing health care to veterans; or

(2) between such components and the Uniformed Services.

The prohibitions of this section do not apply to the reporting under State law of incidents of suspected child abuse and neglect to the appropriate State or local authorities.

(f) Penalties

The provisions of sections 1176 and 1177 of the Social Security Act [42 U.S.C. 1320d–5, 1320d–6] shall apply to a violation of this section to the extent and in the same manner as such provisions apply to a violation of part C of title XI of such Act [42 U.S.C. 1320d et seq.]. In applying the previous sentence—

(1) the reference to “this subsection” in subsection (a)(2) of such section 1176 shall be treated as a reference to “this subsection (including as applied pursuant to section 290dd–2(f) of this title)”; and

(2) in subsection (b) of such section 1176—

(A) each reference to “a penalty imposed under subsection (a)” shall be treated as a reference to “a penalty imposed under subsection (a) (including as applied pursuant to section 290dd–2(f) of this title)”; and

(B) each reference to “no damages obtained under subsection (d)” shall be treated as a reference to “no damages obtained under subsection (d) (including as applied pursuant to section 290dd–2(f) of this title)”.

(g) Regulations

Except as provided in subsection (h), the Secretary shall prescribe regulations to carry out the purposes of this section. Such regulations may contain such definitions, and may provide for such safeguards and procedures, including procedures and criteria for the issuance and scope of orders under subsection (b)(2)(C), as in the judgment of the Secretary are necessary or proper to effectuate the purposes of this section, to prevent circumvention or evasion thereof, or to facilitate compliance therewith.

(h) Application to Department of Veterans Affairs

The Secretary of Veterans Affairs, acting through the Under Secretary for Health, shall, to the maximum feasible extent consistent with their responsibilities under title 38, prescribe regulations making applicable the regulations prescribed by the Secretary of Health and Human Services under subsection (g) to records maintained in connection with the provision of hospital care, nursing home care, domiciliary care, and medical services under such title 38 to veterans suffering from substance use disorder. In prescribing and implementing regulations pursuant to this subsection, the Secretary of Veterans Affairs shall, from time to time, consult with the Secretary of Health and Human Services in order to achieve the maximum possible coordination of the regulations, and the implementation thereof, which they each prescribe.

(i) Antidiscrimination

(1) In general

No entity shall discriminate against an individual on the basis of information received by such entity pursuant to an inadvertent or intentional disclosure of records, or information contained in records, described in subsection (a) in—

(A) admission, access to, or treatment for health care;

(B) hiring, firing, or terms of employment, or receipt of worker’s compensation;

(C) the sale, rental, or continued rental of housing;

(D) access to Federal, State, or local courts; or

(E) access to, approval of, or maintenance of social services and benefits provided or funded by Federal, State, or local governments.

(2) Recipients of Federal funds

No recipient of Federal funds shall discriminate against an individual on the basis of information received by such recipient pursuant to an intentional or inadvertent disclosure of such records or information contained in records described in subsection (a) in affording access to the services provided with such funds.

(j) Notification in case of breach

The provisions of section 17932 of this title shall apply to a program or activity described in subsection (a), in case of a breach of records described in subsection (a), to the same extent and in the same manner as such provisions apply to a covered entity in the case of a breach of unsecured protected health information.

(k) Definitions

For purposes of this section:

(1) Breach

The term “breach” has the meaning given such term for purposes of the HIPAA regulations.

(2) Business associate

The term “business associate” has the meaning given such term for purposes of the HIPAA regulations.

(3) Covered entity

The term “covered entity” has the meaning given such term for purposes of the HIPAA regulations.

(4) Health care operations

The term “health care operations” has the meaning given such term for purposes of the HIPAA regulations.

(5) HIPAA regulations

The term “HIPAA regulations” has the meaning given such term for purposes of parts 160 and 164 of title 45, Code of Federal Regulations.

(6) Payment

The term “payment” has the meaning given such term for purposes of the HIPAA regulations.

(7) Public health authority

The term “public health authority” has the meaning given such term for purposes of the HIPAA regulations.

(8) Treatment

The term “treatment” has the meaning given such term for purposes of the HIPAA regulations.

(9) Unsecured protected health information

The term “unprotected [1] health information” has the meaning given such term for purposes of the HIPAA regulations.

(July 1, 1944, ch. 373, title V, § 543, formerly Pub. L. 91–616, title III, § 321, Dec. 31, 1970, 84 Stat. 1852, as amended Pub. L. 93–282, title I, § 121(a), May 14, 1974, 88 Stat. 130; Pub. L. 94–371, § 11(a), (b), July 26, 1976, 90 Stat. 1041; Pub. L. 94–581, title I, § 111(c)(1), Oct. 21, 1976, 90 Stat. 2852; renumbered § 522 of act July 1, 1944, and amended Pub. L. 98–24, § 2(b)(13), Apr. 26, 1983, 97 Stat. 181; renumbered § 543, Pub. L. 100–77, title VI, § 611(2), July 22, 1987, 101 Stat. 516; Pub. L. 102–321, title I, § 131, July 10, 1992, 106 Stat. 368; Pub. L. 102–405, title III, § 302(e)(1), Oct. 9, 1992, 106 Stat. 1985; Pub. L. 105–392, title IV, § 402(c), Nov. 13, 1998, 112 Stat. 3588; Pub. L. 116–136, div. A, title III, § 3221(a)–(h), Mar. 27, 2020, 134 Stat. 375–378.)

---

[1]  So in original.

Editorial Notes

References in Text

The Social Security Act, referred to in subsec. (f), is act Aug. 14, 1935, ch. 531, 49 Stat. 620. Part C of title XI of the Act is classified generally to part C (§ 1320d et seq.) of subchapter XI of chapter 7 of this title. For complete classification of this Act to the Code, see section 1305 of this title and Tables.

Codification

Section was formerly classified to section 4581 of this title prior to renumbering by Pub. L. 98–24.

Amendments

2020—Subsec. (a). Pub. L. 116–136, § 3221(a), substituted “substance use disorder” for “substance abuse”.

Subsec. (b)(1). Pub. L. 116–136, § 3221(b), amended par. (1) generally. Prior to amendment, text read as follows: “The content of any record referred to in subsection (a) may be disclosed in accordance with the prior written consent of the patient with respect to whom such record is maintained, but only to such extent, under such circumstances, and for such purposes as may be allowed under regulations prescribed pursuant to subsection (g).”

Subsec. (b)(2)(D). Pub. L. 116–136, § 3221(c), added subpar. (D).

Subsec. (c). Pub. L. 116–136, § 3221(e), amended subsec. (c) generally. Prior to amendment, text read as follows: “Except as authorized by a court order granted under subsection (b)(2)(C), no record referred to in subsection (a) may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient.”

Subsec. (f). Pub. L. 116–136, § 3221(f), amended subsec. (f) generally. Prior to amendment, text read as follows: “Any person who violates any provision of this section or any regulation issued pursuant to this section shall be fined in accordance with title 18.”

Subsec. (h). Pub. L. 116–136, § 3221(a), substituted “substance use disorder” for “substance abuse”.

Subsec. (i). Pub. L. 116–136, § 3221(g), added subsec. (i).

Subsec. (j). Pub. L. 116–136, § 3221(h), added subsec. (j).

Subsec. (k). Pub. L. 116–136, § 3221(d), added subsec. (k).

1998—Subsec. (e)(1), (2). Pub. L. 105–392 substituted “Uniformed Services” for “Armed Forces”.

1992—Pub. L. 102–405 substituted “Under Secretary for Health” for “Chief Medical Director” in subsec. (h).

Pub. L. 102–321 amended section generally, substituting provisions relating to confidentiality of records for provisions relating to admission of alcohol abusers and alcoholics to general hospitals and outpatient facilities.

1983—Pub. L. 98–24, § 2(b)(13), renumbered section 4581 of this title as this section.

Subsec. (a). Pub. L. 98–24, § 2(b)(13)(C), made a technical amendment to reference to section 300s–3 of this title.

1976—Subsec. (a). Pub. L. 94–371, § 11(a), inserted “, or outpatient facility (as defined in section 300s–3(6) of this title)” after “hospital”.

Subsec. (b)(1). Pub. L. 94–371, § 11(b), inserted “and outpatient facilities” after “hospitals”, and “or outpatient facility” after “hospital” wherever appearing, and substituted “shall issue regulations not later than December 31, 1976” for “is authorized to make regulations”.

Subsec. (b)(2). Pub. L. 94–581 provided that subsec. (b)(2), which directed the Administrator of Veteran’s Affairs, through the Chief Medical Director, to prescribe regulations making applicable the regulations prescribed by the Secretary under subsec. (b)(1) to the provision of hospital care, nursing home care, domiciliary care, and medical services under title 38 to veterans suffering from alcohol abuse or alcoholism and to consult with the Secretary in order to achieve the maximum possible coordination of the regulations, and the implementation thereof, which they each prescribed, was superseded by section 4131 [now 7331] et seq. of Title 38, Veterans’ Benefits.

1974—Subsec. (a). Pub. L. 93–282, in revising text, prohibited discrimination because of alcohol abuse, substituted provisions respecting eligibility for admission and treatment based on suffering from medical conditions for former provision based on medical need and ineligibility, because of discrimination, for support in any form from any program supported in whole or in part by funds appropriated to any Federal department or agency for former requirement for treatment by a general hospital which received Federal funds, and deleted prohibition against receiving Federal financial assistance for violation of section and for termination of Federal assistance on failure to comply, now incorporated in regulation authorization of subsec. (b) of this section.

Subsec. (b). Pub. L. 93–282 substituted provisions respecting issuance of regulations by the Secretary concerning enforcement procedures and suspension or revocation of Federal support and by the Administrator concerning applicable regulations for veterans, and for coordination of the respective regulations for former provisions respecting judicial review.

Statutory Notes and Related Subsidiaries

Effective Date of 1992 Amendment

Amendment by Pub. L. 102–321 effective Oct. 1, 1992, with provision for programs providing financial assistance, see section 801(c), (d) of Pub. L. 102–321, set out as a note under section 236 of this title.

Effective Date of 1976 Amendment

Amendment by Pub. L. 94–581 effective Oct. 21, 1976, see section 211 of Pub. L. 94–581, set out as a note under section 111 of Title 38, Veterans’ Benefits.

Regulations

Pub. L. 116–136, div. A, title III, § 3221(i), Mar. 27, 2020, 134 Stat. 378, provided that:

“(1) In general.—

The Secretary of Health and Human Services, in consultation with appropriate Federal agencies, shall make such revisions to regulations as may be necessary for implementing and enforcing the amendments made by this section [amending this section], such that such amendments shall apply with respect to uses and disclosures of information occurring on or after the date that is 12 months after the date of enactment of this Act [Mar. 27, 2020].

“(2) Easily understandable notice of privacy practices.—

Not later than 1 year after the date of enactment of this Act, the Secretary of Health and Human Services, in consultation with appropriate legal, clinical, privacy, and civil rights experts, shall update section 164.520 of title 45, Code of Federal Regulations, so that covered entities and entities creating or maintaining the records described in subsection (a) provide notice, written in plain language, of privacy practices regarding patient records referred to in section 543(a) of the Public Health Service Act (42 U.S.C. 290dd–2(a)), including—

“(A) a statement of the patient’s rights, including self-pay patients, with respect to protected health information and a brief description of how the individual may exercise these rights (as required by subsection (b)(1)(iv) of such section 164.520); and

“(B) a description of each purpose for which the covered entity is permitted or required to use or disclose protected health information without the patient’s written authorization (as required by subsection (b)(2) of such section 164.520).”

Construction of 2020 Amendment

Pub. L. 116–136, div. A, title III, § 3221(j), Mar. 27, 2020, 134 Stat. 379, provided that:

“Nothing in this Act [div. A of Pub. L. 116–136, see Tables for Classification] or the amendments made by this Act shall be construed to limit—

“(1) a patient’s right, as described in section 164.522 of title 45, Code of Federal Regulations, or any successor regulation, to request a restriction on the use or disclosure of a record referred to in section 543(a) of the Public Health Service Act (42 U.S.C. 290dd–2(a)) for purposes of treatment, payment, or health care operations; or

“(2) a covered entity’s choice, as described in section 164.506 of title 45, Code of Federal Regulations, or any successor regulation, to obtain the consent of the individual to use or disclose a record referred to in such section 543(a) to carry out treatment, payment, or health care operation.”

Jessie’s Law

Pub. L. 115–271, title VII, §§ 7051–7053, Oct. 24, 2018, 132 Stat. 4017, 4018, provided that:

“SEC. 7051. INCLUSION OF OPIOID ADDICTION HISTORY IN PATIENT RECORDS.

“(a) Best Practices.—

“(1) In general.—

Not later than 1 year after the date of enactment of this Act [Oct. 24, 2018], the Secretary of Health and Human Services (in this section referred to as the ‘Secretary’), in consultation with appropriate stakeholders, including a patient with a history of opioid use disorder, an expert in electronic health records, an expert in the confidentiality of patient health information and records, and a health care provider, shall identify or facilitate the development of best practices regarding—

“(A) the circumstances under which information that a patient has provided to a health care provider regarding such patient’s history of opioid use disorder should, only at the patient’s request, be prominently displayed in the medical records (including electronic health records) of such patient;

“(B) what constitutes the patient’s request for the purpose described in subparagraph (A); and

“(C) the process and methods by which the information should be so displayed.

“(2) Dissemination.—

The Secretary shall disseminate the best practices developed under paragraph (1) to health care providers and State agencies.

“(b) Requirements.—

In identifying or facilitating the development of best practices under subsection (a), as applicable, the Secretary, in consultation with appropriate stakeholders, shall consider the following:

“(1) The potential for addiction relapse or overdose, including overdose death, when opioid medications are prescribed to a patient recovering from opioid use disorder.

“(2) The benefits of displaying information about a patient’s opioid use disorder history in a manner similar to other potentially lethal medical concerns, including drug allergies and contraindications.

“(3) The importance of prominently displaying information about a patient’s opioid use disorder when a physician or medical professional is prescribing medication, including methods for avoiding alert fatigue in providers.

“(4) The importance of a variety of appropriate medical professionals, including physicians, nurses, and pharmacists, having access to information described in this section when prescribing or dispensing opioid medication, consistent with Federal and State laws and regulations.

“(5) The importance of protecting patient privacy, including the requirements related to consent for disclosure of substance use disorder information under all applicable laws and regulations.

“(6) All applicable Federal and State laws and regulations.

“SEC. 7052. COMMUNICATION WITH FAMILIES DURING EMERGENCIES.

“(a) Promoting Awareness of Authorized Disclosures During Emergencies.—

The Secretary of Health and Human Services shall annually notify health care providers regarding permitted disclosures under Federal health care privacy law during emergencies, including overdoses, of certain health information to families, caregivers, and health care providers.

“(b) Use of Material.—

For the purposes of carrying out subsection (a), the Secretary of Health and Human Services may use material produced under section 7053 of this Act or section 11004 of the 21st Century Cures Act (42 U.S.C. 1320d–2 note).

“SEC. 7053. DEVELOPMENT AND DISSEMINATION OF MODEL TRAINING PROGRAMS FOR SUBSTANCE USE DISORDER PATIENT RECORDS.

“(a) Initial Programs and Materials.—

Not later than 1 year after the date of the enactment of this Act [Oct. 24, 2018], the Secretary of Health and Human Services (in this section referred to as the ‘Secretary’), in consultation with appropriate experts, shall identify the following model programs and materials (or if no such programs or materials exist, recognize private or public entities to develop and disseminate such programs and materials):

“(1) Model programs and materials for training health care providers (including physicians, emergency medical personnel, psychiatrists, psychologists, counselors, therapists, nurse practitioners, physician assistants, behavioral health facilities and clinics, care managers, and hospitals, including individuals such as general counsels or regulatory compliance staff who are responsible for establishing provider privacy policies) concerning the permitted uses and disclosures, consistent with the standards and regulations governing the privacy and security of substance use disorder patient records promulgated by the Secretary under section 543 of the Public Health Service Act (42 U.S.C. 290dd–2) for the confidentiality of patient records.

“(2) Model programs and materials for training patients and their families regarding their rights to protect and obtain information under the standards and regulations described in paragraph (1).

“(b) Requirements.—

The model programs and materials described in paragraphs (1) and (2) of subsection (a) shall address circumstances under which disclosure of substance use disorder patient records is needed to—

“(1) facilitate communication between substance use disorder treatment providers and other health care providers to promote and provide the best possible integrated care;

“(2) avoid inappropriate prescribing that can lead to dangerous drug interactions, overdose, or relapse; and

“(3) notify and involve families and caregivers when individuals experience an overdose.

“(c) Periodic Updates.—

The Secretary shall—

“(1) periodically review and update the model program and materials identified or developed under subsection (a); and

“(2) disseminate such updated programs and materials to the individuals described in subsection (a)(1).

“(d) Input of Certain Entities.—

In identifying, reviewing, or updating the model programs and materials under this section, the Secretary shall solicit the input of relevant stakeholders.

“(e) Authorization of Appropriations.—

There is authorized to be appropriated to carry out this section—

“(1) $4,000,000 for fiscal year 2019;

“(2) $2,000,000 for each of fiscal years 2020 and 2021; and

“(3) $1,000,000 for each of fiscal years 2022 and 2023.”

Report of Administrator of Veterans’ Affairs to Congressional Committees; Publication in Federal Register

Pub. L. 93–282, title I, § 121(b), May 14, 1974, 88 Stat. 131, which directed Administrator of Veterans’ Affairs to submit to appropriate committees of House of Representatives and Senate a full report (1) on regulations (including guidelines, policies, and procedures thereunder) he had prescribed pursuant to section 321(b)(2) of Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970 [former 42 U.S.C. 290dd–2(b)(2)], (2) explaining bases for any inconsistency between such regulations and regulations of Secretary under section 321(b)(1) of such Act [42 U.S.C. 290dd–2(b)(1)], (3) on extent, substance, and results of his consultations with Secretary respecting prescribing and implementation of Administrator’s regulations, and (4) containing such recommendations for legislation and administrative actions as he determined were necessary and desirable, with Administrator to submit report not later than sixty days after effective date of regulations prescribed by Secretary under such section 321(b)(1) [42 U.S.C. 290dd–2(b)(1)], and to publish such report in Federal Register, was characterized by section 111(c)(5) of Pub. L. 94–581 as having been superseded by section 4134 [now 7334] of Title 38, Veterans’ Benefits.