News & Resources

Shub & Associates

Beyond HIPAA - Extra care required in disclosing substance abuse treatment records


by Coale Anderson | February, 2010 | Published in Health Care Compliance Today
Presented with a search warrant, valid subpoena signed by a judge, or a court order to release substance abuse treatment and related medical records, doctors or office managers are often understandably eager to comply, believing that they are required to respond to an official written demand. Depending on the circumstances, the opposite may be true, even if the patient provides a written release. In fact, the federal statute protecting substance abuse treatment records[i] and the rules implementing that code[ii] (collectively, the “Confidentiality Regulations”), may expose a health care provider who releases records of a patient treated for substance abuse to civil and criminal penalties. A health care provider’s simple acknowledgment that the person whose records are being subpoenaed is in fact a patient may constitute a “release of records” sufficient to violate the Confidentiality Regulations.
The purpose of the federal statute is to increase the success of substance abuse treatment programs by ensuring confidentiality to patients who might otherwise be reluctant to seek help. A commonly occurring side effect, however, is confusion among health care providers regarding when disclosure of substance abuse treatment records is permitted or required.
Which providers are subject to the Confidentiality Regulations?
Generally, the Confidentiality Regulations apply to drug or alcohol substance abuse treatment records created, maintained, or held by a federally assisted or federally regulated health care provider, practice, facility or substance abuse unit within a hospital that provides alcohol or drug abuse diagnosis, treatment, or referral. Certain federally assisted or federally regulated facilities that provide drug and alcohol treatment-related services, such as laboratories that conduct drug testing, also may be subject to the Confidentiality Regulations.
What to consider when a subpoena arrives
By complying with invalid subpoenas, custodians of substance abuse patient records often unwittingly expose themselves to significant liability (not to mention the nuisance of gathering, reviewing and copying documents and/or attending hearings).. Examples of potentially invalid subpoenas are those that:
  1. are issued without a specialized court order (see discussion below);
  2. are issued by a state court in another state;
  3. are issued in a civil case in another state by a federal court more than 100 miles from the place in which the hearing or deposition occurs;
  4. contain patient-identifying information;
  5. contain inaccurate essential information or are missing essential information (other than patient-identifying information), or
  6. are served improperly. 
Although compliance with an invalid subpoena may be unnecessary, the recipient should not ignore a subpoena. Rather, the recipient should notify the person issuing the subpoena of any deficiencies and request that the subpoena be withdrawn until a proper court order has been applied for and received.
In some states, health care providers (or their employees) who are validly subpoenaed may avoid the inconvenience and expense of appearing in court to testify as keepers of medical records by certifying the records so that they will qualify for a hearsay exception at trial. The recipient of the subpoena should ask his or her attorney to discuss such course of action with the person who issued the subpoena.
Even court orders may be insufficient to compel disclosure
As an initial matter, a court order authorizing disclosure of substance abuse treatment records is not valid unless:
  1. it is accompanied by a valid subpoena (see discussion above) or a similar legal mandate and
  2. a court of competent jurisdiction has balanced the evidence and determined that such disclosure is (a) necessary to protect against an existing threat to life or serious bodily injury, (b) necessary to investigate or prosecute an extremely serious crime or (c) in connection with litigation or an administrative proceeding in which the patient offers testimony or other evidence pertaining to the content of the confidential communications.
Even if the court order meets these threshold requirements, it is still not valid unless the order has been applied for by:
  • an appropriate person or entity, such as a person conducting investigative or prosecutorial activities with respect to the enforcement of criminal laws, or
  • a person who has a legally cognizable interest in disclosure of patient records for purposes other than a criminal investigation. 
Further, the application for the order and the order itself must use a fictitious name such as “John Doe” or “Jane Doe” to refer to any patient or otherwise disclose patient identifying information (except in certain limited circumstances). The court order must comply with additional requirements, which may vary depending on the context of and purpose of disclosure. 
Additional requirements in the criminal context
In addition to the requirements set forth above, a court order sought for investigative or prosecutorial activities with respect to enforcement of criminal laws, is not valid unless:
  1. the record keeper has been given the opportunity to appear and to be represented by independent counsel at a hearing held in the judge’s chambers or in some other manner which ensures that patient identifying information is not disclosed to anyone other than a party to the proceedings, the patient, or the record keeper,
  2. the records are reasonably likely to disclose information of substantial value in the investigation or prosecution,
  3. there is no other way to obtain the information,
  4. the potential injury to the patient and the ability of the substance abuse treatment provider to provide treatment to other patients is outweighed by public interest and the need for disclosure, and
  5. the order limits disclosure to portions of the patient records essential to fulfill the objective of the order and to law enforcement and prosecutorial officials. 
Additional requirements in the civil context
In addition to the general requirements set forth above for court orders, a court order sought for purposes other than for a criminal investigation is not valid unless:
  1. both the patient and the record keeper are provided with an opportunity to file a written response, or to appear in person to respond, to the application for the court order,
  2. any oral argument, review of evidence, or hearing on such application must be held in the judge's chambers or in some manner which ensures that patient identifying information is not disclosed to anyone other than a party to the proceeding, the patient, or the record keeper (except in certain limited circumstances);
  3. there are no effective alternative means of obtaining the information,
  4. the public interest and need for disclosure outweigh the potential injury to the patient and treatment services in general,
  5. the order limits disclosure to portions of the record which are essential to fulfill the objective of the order and to persons whose need for information is the basis of the order and includes other measures necessary to limit disclosure to protect the patient and efficacy of treatment services in general (such as by sealing the record).
Patient consent
A person or facility subject to the Confidentiality Regulations should not disclose patient identities or records—even if the patient consents—unless such consent is in writing and satisfies the requirements of the Confidentiality Regulations. Such requirements prohibit disclosure based on a consent that has expired, is known to have been revoked, is known, or through reasonable effort could be known, by the person holding the records to be materially false, or fails to contain any of the information in the following sample consent.
Sample Consent
I __________________ [Name of Patient] authorize _______________________ [Name or Type of Program Disclosing] to disclose ____________________ [Kind and Amount of Information to be Disclosed] to _____________________ [Intended Recipient of Disclosed Information] for ______________________ [Purpose of Disclosure]. I understand that this consent is subject to revocation at any time except to the extent that the program which is to make the disclosure has already taken action in reliance on it. If not previously revoked, this consent will terminate upon _________________________ [Specific Date, Event, or Condition].
_________________________________      Dated:__________________________
(Patient Signature)
_________________________________      Dated:__________________________
(Guardian/Parent Signature, if required)
_________________________________      Dated:__________________________
(Signature of person authorized to sign
in lieu of the patient, if required)
Points to keep in mind
If disclosure is permitted, the Confidentiality Regulations require the record keeper to provide the recipient of the records with notice that the Confidentiality Regulations apply to the records and that re-disclosure is not permitted.
The Confidentiality Regulations are protections in addition to those provided for by state laws and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and corresponding regulations.. Although state laws and HIPAA requirements are outside the scope of this article, compliance with applicable state laws and HIPAA is also imperative.
Certain other narrow disclosures may be permitted under the Confidentiality Regulations, which are not discussed in this article, such as disclosures:
  1. to medical personnel in the event of a medical emergency,
  2. to law enforcement officers in connection with a crime (or threat thereof) on the premises of the practice or program where the records are kept or against personnel of such practice or program,
  3. for internal audits,
  4. for records (or portions thereof) that are not likely to identify any patient,
  5. for initial reports of suspected child abuse or neglect,
  6. to certain qualified service organization or business associates,
  7. for research, if certain regulatory requirements are satisfied, and
  8. for internal communications to personnel who have a need to know of the information.
Even more stringent forms of the confidentiality requirements may apply to records created prior to 1987.
Note that a state court order may not be considered a “final” judgment, and therefore seeking a federal court review in connection with state orders pursuant to the Confidentiality Regulations may be advisable.

Disclaimer – This article does not provide legal or other professional advice, and does not create an attorney-client relationship. Laws and their application and relevance vary depending upon jurisdiction and factual circumstances. Information in this article should not be used in lieu of consultation with professional advisors. 


[i] Title 42 U.S.C. § 290dd-2
[ii] 42 CFR Part 2