UNIVERSITY OF MAINE SYSTEM HIPAA GENERAL OPERATING POLICY# 45 DISCLOSURE OF SUBSTANCE ABUSE INFORMATION
I. General
Notwithstanding any other provision of these HIPAA General Operating Policies, disclosure of PHI containing information pertaining to the identity, diagnosis, prognosis, or treatment of an individual which is maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research, shall be governed by the provisions of this policy. This policy presents only a brief outline of the requirements regarding such information. HCCs should consult 42 U.S.C. 290dd-2 and 42 CFR Part 2 for a complete description of the requirements pertaining to such records.
II. Permitted Disclosure
a. Consent
PHI containing information pertaining to the identity, diagnosis, prognosis, or treatment of an individual which are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research, may be disclosed in accordance with the prior written authorization of the individual with respect to whom such record is maintained, but only to such extent, under such circumstances, and for such purposes as may be allowed under federal regulations.
Each disclosure made with the individual’s written consent must be accompanied by the following written statement:
This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.
b. Without Consent
Whether or not the individual, with respect to whom any PHI referred to in subsection (a) of this section is maintained, gives written authorization, the content of such record may be disclosed as follows:
1. To medical personnel to the extent necessary to meet a bona fide medical emergency.
2. In conformity with all other applicable laws and policies, to qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual in any report of such research, audit, or evaluation, or otherwise disclose individual identities in any manner.
3. If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefore, including the need to avert a substantial risk of death or serious bodily harm. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure.
III. Application
The prohibitions of this policy continue to apply to records concerning any individual who has been a patient, irrespective of whether or when such individual ceases to be a patient.
The prohibitions of this policy do not apply to the reporting under State law of incidents of suspected child abuse and neglect to the appropriate State or local authorities.
The prohibitions of this policy do not apply to communications from the HCC to law enforcement officers which— (i) Are directly related to a patient's commission of a crime on the premises of the HCC or against HCC personnel or to a threat to commit such a crime; and(ii) Are limited to the circumstances of the incident, including the patient status of the individual committing or threatening to commit the crime, that individual's name and address, and that individual's last known whereabouts.
Any answer to a request for a disclosure of PHI which is not permissible under this policy must be made in a way that will not affirmatively reveal that an identified individual has been, or is being diagnosed or treated for alcohol or drug abuse. This policy does not restrict a disclosure that an identified individual is not and never has been a patient.
Revised 05/09/05