Attorney General: Susan S. Addiss, MPH MUrS, Department of Public Health & Addiction Services, 1994-015 Formal Opinion, Attorney General of Connecticut

Attorney General's Opinion

Attorney General Richard Blumenthal

June 29, 1994

Susan S. Addiss, MPH MUrS
Commissioner
Department of Public Health & Addiction Services
150 Washington Street
Hartford, CT 06106

Dear Commissioner Addiss:

Prior to the merger of the Department of Health Services and the former Connecticut Alcohol and Drug Abuse Commission (CADAC), the Executive Director of CADAC, Dr. John Higgins-Biddle, requested a formal opinion from this Office regarding the impact of the federal regulations concerning confidentiality of alcohol and drug abuse patient records, 42 C.F.R. Part 2, or any other pertinent state or federal law or regulation related to patient confidentiality, on a new data system that CADAC was having designed by Andersen Consulting, Inc. After the merger of CADAC into the Department of Public Health and Addiction Services (DPHAS),1 you informed us that your Department is continuing with the development of the proposed data system, that the merger has not affected either the scope or nature of Dr. Higgins-Biddle's previous opinion request, and that you still need advice regarding the questions that he originally posed. In his request for advice, Dr. Higgins-Biddle provided an extensive and informative overview of the many useful functions that could be served by the proposed data system. He cautioned, however, that the uses that may be made of the system depend upon the extent to which client identifying information (information from which a particular individual who has sought or received substance abuse treatment can be identified) may be provided to the system, and the extent to which the system may then share such information with various bureaus and units of DPHAS and with private substance abuse treatment programs. He further explained that CADAC, in preparing preliminary plans for the design of the data system, made certain assumptions about the manner in which client identifying information may be legally disclosed, and the entities to which such disclosures may be made. Dr. Higgins-Biddle then posed the following questions about which advice is needed to direct the further development of the data system:

1. Is CADAC correct in its assumption that data concerning a client enrolled in one of its own four treatment facilities can be shared among the appropriate treatment professionals at its other three facilities in conjunction with the current treatment episode for that client without the use of a consent form?

2. Is CADAC correct in its assumption that client identifying information and treatment episode information from CADAC's own four facilities may be supplied to the data unit at CADAC's central office without the use of a consent form for use in developing the aggregate data assembled for research and evaluation purposes, for the provision of a unique client identifying number, and for such other purposes as may be necessary for the management of the agency's treatment programs and the provision of treatment service to its clients?

3 May CADAC operated and CADAC funded programs share either or both patient identifying information and treatment episode information among themselves as may be necessary to provide appropriate treatment to individual clients without the use of consent forms?

4. May CADAC require that funded programs share either or both patient identifying information and treatment episode information with CADAC's central office data unit for the purpose of allowing CADAC to provide a unique client identifier and for research, audit and evaluation purposes?

5. If, as we believe, a consent form is necessary in order for programs which do not receive CADAC funding to provide information to other treatment programs or to CADAC's information unit, can a consent form be developed that conforms to the regulations, yet is broad enough to permit disclosure for these multiple purposes?

6. If the multi-agency data system is developed as envisioned by Section 3(d) of PA 92-20, can client identifying information be shared with such system? If so, what is the scope of the information which can be shared? Is a consent form necessary?

Discussion and Responses

Dr. Higgins-Biddle has pointed out in his request that certain provisions of both state and federal law encourage or require CADAC to collect statistical data regarding persons receiving substance abuse treatment and to track individual utilization of certain social services. Conn. Gen. Stat.  17a-636(7), for example, provides that the statutorily defined duties of CADAC include the responsibility to:

Specify uniform methods for keeping statistical information by public and private agencies, organizations and individuals, including a client identifier system, and collect and make available relevant statistical information, including the number of persons treated, frequency of admission and readmission, and frequency and duration of treatment and require all facilities for the treatment of alcohol dependence or drug dependence licensed under sections 19a-490 to 19a-503, inclusive, to implement such methods; . . . (emphasis added)

Similarly, Section 3 of 1992 Special Act 92-20, which reorganized the State's human service agencies, provides in relevant part:

(d) The Commissioners of the Department of Social Services, the Department of Public Health and Addiction Services and the Department of Developmental and Rehabilitative Services shall ensure that the following intraagency and interagency goals are addressed and met: . . . . (6) development of a common intake process for entry into the health and human services system for information and referral, screening, eligibility determinations and service delivery; (7) the creation of a single application form for client intake and eligibility determinations with a common client identifier; (8) development of a commonly-linked computerized management information system with the capacity to track clients and determine eligibility across programs; . . . .

The federal government also requires that, as a recipient of a substance abuse block grant, DPHAS must develop the capacity to provide the Secretary of Health and Human Services with various statistical data regarding substance abuse treatment programs in Connecticut, including the number of persons treated and the demographic characteristics of such persons. 42 U.S.C.  290aa-4. In contrast to those state and federal laws which require the collection of information or the sharing of information among state and federal agencies, other laws limit the extent to which certain information about individuals may be disclosed. Communications that a person may have with a provider of health care or social services may, under certain circumstances, be privileged or subject to other confidentiality restrictions pursuant to state law. Conn. Gen. Stat.  52-146c to 52-146o. Similarly, information that state agencies possess about individuals' personal affairs must be maintained and utilized according to the provisions of the Personal Data Act, Conn. Gen. Stat.  4-190 to 4-197, and the regulations of the former CADAC that implement that Act, Reg. Conn. Agencies  17a-636-1 to 17a-636-5. It is a federal statute, however, that most closely guards the records of persons seeking substance abuse treatment against unauthorized disclosure. That statute, Section 543 of the Federal Public Health Services Act, 42 U.S.C.  290dd-2, and its implementing regulations, 42 C.F.R. Part 2, strictly limit the extent to which any federally assisted substance abuse program may disclose any information that would reveal, either directly or by reference to other publicly available information, that a particular individual has sought treatment for substance abuse.2 Such "patient identifying information" may only be disclosed in accordance with those regulations and may not otherwise be disclosed. 42 C.F.R.  2.13(a). Furthermore, no state law may authorize or compel any disclosure that is prohibited by those regulations. 42 C.F.R.  2.20. Through the statutes that define the powers and duties of the former CADAC, the General Assembly has explicitly recognized the overarching federal law that applies to substance abuse treatment records and has also tried to reconcile two vital, but opposing, public interests: the need to collect and analyze basic factual information about persons who utilize the services of state licensed facilities and other treatment programs, and the need to protect the confidentiality of persons seeking substance abuse treatment.

Section 17a-630 of the Connecticut General Statutes contains several provisions which relate to those two distinct objectives. Subsection (b) of that statute mandates that medical treatment facilities (defined by Conn. Gen. Stat.  17a-621 to include both facilities operated by the former CADAC and private facilities that treat substance abusers and that are licensed by the State), "shall keep and submit such records of all persons examined, admitted or treated pursuant to sections 17a-621 to 17a-643 [statutes relating to drug and alcohol abuse treatment] as may be required by the commission [CADAC]". Other subsections of Section 17a-630 contain the following pertinent provisions:

(c) No person, hospital, treatment facility or the commission may disclose or permit the disclosure of the identity, diagnosis, prognosis or treatment of any such patient that would constitute a violation of federal statutes concerning confidentiality of alcohol or drug patient records and any regulations pursuant thereto, or as they may be amended from time to time. The commission shall adopt regulations to protect the confidentiality of information obtained by it.

(e) The executive director may use or make available to authorized persons information from patients' records for purposes of conducting scientific research, management audits, financial audits, or program evaluation, provided such information shall not be utilized in a manner that discloses a patient's name or other identifying information.

Section 17a-636(a) of the Connecticut General Statutes also contains provisions relating to both data collection and patient confidentiality. As noted above, subdivision (7) of the statute provides for CADAC's development of a "client identifier system." Subdivision (12) further mandates that the agency, through its regulations, insure the confidentiality of the names of persons identified in any client identifier system.

In the responses that follow, we analyze how the various statutes and regulations described above may affect your agency's development and utilization of its proposed data system.

Question 1

1. Is CADAC correct in its assumption that data concerning a client enrolled in one of its own four treatment facilities can be shared among the appropriate treatment professionals at its other three facilities in conjunction with the current treatment episode for that client without the use of a consent form?

Dr. Higgins-Biddle correctly assumed that any of the four treatment facilities operated by the former CADAC (currently the addiction services division of DPHAS) may, for the purposes of treatment and without the use of a consent form, share client data with professionals at any of the other three facilities during a client's single treatment episode. The federal confidentiality regulations contain the following exception:

The restrictions on disclosure in these regulations do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of alcohol or drug abuse if the communications are
(i) Within a program or
(ii) Between a program and an entity that has direct administrative control over the program.

42 C.F.R.  2.12(c)(3).

According to the definitions set forth in the regulations, "program" means "a person which in whole or in part holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment, or referral for treatment." 42 C.F.R.  2.11. "Person", in turn, means "an individual, partnership, corporation, Federal, State or local government agency, or any other legal entity." Id. DPHAS, as a state agency that receives federal assistance to operate facilities which perform substance abuse diagnosis and treatment, falls within the regulatory definition of "program". Under federal law, therefore, client data may be shared among the agency's treatment professionals for the purpose of meeting a client's current treatment needs. State law also permits disclosure of this nature, although state statutes mandate that when such a disclosure is made by a psychiatrist or a certified independent social worker, the client must be informed of the disclosure. Conn. Gen. Stat.  52-146f(1),  52-146q(c)(1).3

Question 2

2. Is CADAC correct in its assumption that client identifying information and treatment episode information from CADAC's own four facilities may be supplied to the data unit at CADAC's central office without the use of a consent form for use in developing the aggregate data assembled for research and evaluation purposes, for the provision of a unique client identifying number, and for such other purposes as may be necessary for the management of the agency's treatment programs and the provision of treatment service to its clients?

Dr. Higgins-Biddle correctly assumed that client identifying information and treatment episode information from the four facilities operated by the former CADAC may be supplied to the data unit at the agency's central office, without the use of a consent form, for purposes related to the management of the agency's treatment programs and the provision of treatment services to its clients. Federal law exempts such sharing of information from the general restrictions on disclosure. See 42 C.F.R.  2.12(c)(3) (quoted above in the response to Question 1). State law, in our opinion, also permits the four DPHAS facilities to transmit patient identifying information to the agency's central data unit for the purposes which Dr. Higgins-Biddle identified in his second question. As noted above, Conn. Gen. Stat.  17a-630(b) explicitly mandates that "[m]edical treatment facilities shall keep and submit such records of all persons examined, admitted or treated pursuant to sections 17a-621 to 17a-643, inclusive, as may be required by the commission."4 We recognize that Conn. Gen. Stat.  52-146e(a) prohibits the disclosure or transmittal of psychiatric "communications or records or the substance or any part of any resume thereof which identify a patient to any person, corporation or government agency without the consent of the patient or his authorized representative," except as permitted by Conn. Gen. Stat.  52-146f through 52-146i. Although psychiatric care is frequently a component of substance abuse treatment, we conclude that this statute does not prevent disclosures authorized pursuant to Section 17a-630(b). There are several bases for our conclusions. First, basic tenets of statutory construction compel this result. One fundamental rule of statutory construction dictates that "[i]f two statutes appear to be in conflict but can be construed as consistent with each other, then the court should give effect to both." Dugas v. Lumbermens Mutual Casualty Co., 217 Conn. 631, 641, 587 A.2d 415, 420 (1991). See also Blue Cross and Blue Shield of Connecticut, Inc. v. Mike, 184 Conn. 352, 362, 439 A.2d 1026, 1032 (1981) ("when two statutes relate to the same subject matter, every effort should be made to find a reasonable field for operation of both statutes.") Another "well-settled principle of statutory construction [is] that specific terms covering the given subject matter will prevail over general language of the same or another statute which might otherwise prove controlling." Gaynor v. Union Trust Co., 216 Conn. 458, 476, 582 A.2d 190, 199 (1990). Applying these principles to Sections 52-146e and 17a-630(b), we note that the latter statute is extremely limited in scope; it concerns only information which the former CADAC seeks from treatment facilities about persons examined or treated for substance abuse. Section 52-146e, on the other hand, applies to virtually all data about patients who receive psychiatric care. Consequently, the unrestricted application of Section 52-146e in the context of substance abuse treatment would effectively nullify Subsection 17a-630(b). We therefore conclude that Section 52-146e should not be construed to prohibit the disclosure of information whose submission to the former CADAC is authorized by 17a-630(b). This conclusion is consistent with the provisions of Subsection 17a-630(c), which explicitly require that the former CADAC protect the confidentiality of patient identifying information to the extent required by federal law. That provision, which treats substance abuse patient records differently from other personal data, suggests that the General Assembly recognized the sensitive nature of the information whose transmittal the former CADAC may require under 17a-630(b) and the need to guard it against further disclosure. We also find it noteworthy that Subsections 17a-630(b) and (c) are closely analogous to Conn. Gen. Stat.  52-146h, which authorizes mental health facilities to transmit patient information and records to the Commissioner of Mental Health for the purposes of administration, planning and research.5 We have concluded in a prior opinion that Section 52-146h permits the Department of Mental Health to obtain from its grantee agencies, without patient consent, patient information that is subject to the psychiatric privilege. 1993 Conn. Op. Atty. Gen., October 1, 1993 (letter to Albert J. Solnit, M.D., Commissioner, Department of Mental Health). The final basis for our conclusion is that Subsections (b) and (c) of Section 17a-630 have never been substantively amended since the psychiatrist-patient confidentiality statutes were enacted in their present form, even though other subsections of Section 17a-630 have been added, expanded or revised. The General Assembly could easily have amended Subsection 17a-630(b) to preclude treatment facilities' disclosure of information subject to the psychiatric privilege, but it has not done so. "There is a presumption that the legislature, in enacting a law, . . . [does] so in view of existing relevant statutes and [intends] it to read with them so as to make one consistent body of law." Frazer v. Manson, 176 Conn. 638, 642, 410 A.2d 475, 478 (1979). See also Lafayette Bank and Trust Co. v. Szentkuti, 27 Conn. App. 15, 19-20, 603 A.2d 1215, 1217, cert. denied 222 Conn. 901, 606 A.2d 1327 (1992).

Question 3

3. May CADAC operated and CADAC funded programs share either or both patient identifying information and treatment episode information among themselves as may be necessary to provide appropriate treatment to individual clients without the use of consent forms?

As noted above in response to Question 1, CADAC operated facilities, are all part of a single treatment "program", and therefore may share patient identifying information among themselves, without patient consent, for the purpose of providing appropriate care to a particular patient. Similar exchanges, however, may not occur between CADAC facilities and other programs, regardless of whether such programs receive CADAC funding. The federal confidentiality regulations contain no exception that would permit separate substance abuse treatment programs to share with one another, without patient consent, patient identifying data or treatment episode information for diagnostic or treatment purposes. Under the federal law, nonconsensual disclosures for treatment purposes may be made only within a program, or between a program and an entity having direct administrative control over that program, 42 C.F.R.  2.12(c)(3), or if the patient is the victim of a medical emergency. 42 C.F.R.  2.51(a). See Response to Question 1, supra. The receipt by a private or municipal substance abuse treatment facility of DPHAS funding does not alter the restrictions imposed by the federal confidentiality regulations. Even though a private or municipal facility may receive assistance from DPHAS, it nevertheless remains a distinct "program" separate from the state agency. According to current state laws and regulations, such programs do not become part of DPHAS or subject to the agency's direct administrative control by accepting DPHAS funds. See Reg. Conn. Agencies  17-226d-1 through 17-226d-11 (setting forth eligibility standards for CADAC funding for private nonprofit organizations and municipalities).

Question 4

4. May CADAC require that funded programs share either or both patient identifying information and treatment episode information with CADAC's central office data unit for the purpose of allowing CADAC to provide a unique client identifier and for research, audit and evaluation purposes?

Although this question has been posed with respect to CADAC funded programs only, our response applies to both funded and nonfunded programs. State law permits DPHAS to obtain from any state licensed facility, regardless of whether the facility receives funding from DPHAS, any records of clients' examinations, admissions, or treatment that the agency requires. Conn. Gen. Stat.  17a-630(b). See discussion, supra, in response to Question 2. Federal law also permits DPHAS, without patient consent, to conduct research, audit and evaluation functions relating to substance abuse treatment, provided such functions are carried out in the manner specified by the federal confidentiality regulations. One section of those regulations, 42 C.F.R.  2.52, specifically applies to research activities,6 while the subsequent section, 42 C.F.R.  2.53, pertains to audit and evaluation functions.7 Those federal regulations are sufficiently broad to allow DPHAS to obtain from programs, without client consent, both patient identifying information and treatment episode information to be used for research, audit and evaluation purposes, provided the procedures specified in the regulations are followed. The scope of those regulations also permit DPHAS to assign to each patient a unique client identifier for the agency's own use in research, audits and evaluations. The use of such client identifiers, however, by persons outside the agency or for purposes other than research, evaluations or audits is prohibited by the regulations. See 42 C.F.R.  2.13(a).

Question 5

5. If, as we believe, a consent form is necessary in order for programs which do not receive CADAC funding to provide information to other treatment programs or to CADAC's information unit, can a consent form be developed that conforms to the regulations, yet is broad enough to permit disclosure for these multiple purposes? A private or municipal program's receipt or nonreceipt of DPHAS funding does not affect whether patient consent must be obtained before that program discloses patient identifying information to a second program. Unless two or more facilities are part of the same treatment program, a facility must always obtain patient consent before disclosing patient identifying information to another facility, except in a medical emergency. See Response to Question 3, supra. Similarly, a private facility's receipt or nonreceipt of DPHAS funding does not affect that facility's duty to disclose to the information unit of DPHAS data that the agency requires for research, audit and evaluation purposes. Patient consent is not necessary for such disclosures. It should also be noted that, with the exception of DPHAS' own four treatment facilities, which are part of the same program and may share patient identifying information among themselves for purposes of diagnosis, treatment or referral, 42 C.F.R.  2.12(c)(3), DPHAS may not share patient identifying information obtained from one treatment program with any other treatment program without patient consent. For those circumstances in which patient consent is required, it should be feasible to create a consent form that conforms to the requirements of federal law governing patient consent, set forth in 42 C.F.R.  2.31, yet permits the agency to obtain and use patient identifying information for a variety of purposes. Our staff is available at your request to assist you in composing such a form.

Question 6

6. If the multi-agency data system is developed as envisioned by Section 3(d) of PA 92-20, can client identifying information be shared with such system? If so, what is the scope of the information which can be shared? Is a consent form necessary?

Subsection 3(d) of 1992 Special Act No. 92-90, quoted above, requires the three reorganized state agencies created by that Act to institute common procedures for receiving and processing applications and to adopt a single application form and use a common client identifier for making eligibility determinations. It also requires the three new agencies to develop "a commonly-linked computerized management information system with the capacity to track clients and determine eligibility across programs . . . ." 1992 Conn. Spec. Act 92-20,  3(d)(8). This question asks how DPHAS may accomplish those goals within the parameters of applicable confidentiality laws. In the absence of patient consent, federal law prohibits DPHAS from sharing with other state agencies any information that could be used to identify an individual as being a drug or alcohol abuser or as having sought or received treatment for drug or alcohol abuse. 42 C.F.R.  2.3, 2.11, 2.12. DPHAS may legally disclose client identifying information to the multi-agency data system only if the client, prior to the disclosure, executes a consent that meets the specifications set forth in the federal regulations, 42 C.F.R.  2.31 - 2.33. Once a client has provided consent, DPHAS may share with the multi-agency data system any information about that client which falls within the scope of that consent. DPHAS may also disclose to the multi-agency data system, without client consent, aggregate data or any other information which cannot lead to the identification of a client as an "individual who has applied for or been given diagnosis or treatment for alcohol or drug abuse". 42 C.F.R. 2.11.

We hope the responses set forth above are helpful to you. If we can be of any further assistance as you proceed with the development of your data system, please do not hesitate to call on us.

Very truly yours,

RICHARD BLUMENTHAL
ATTORNEY GENERAL

Heather J. Wilson
Assistant Attorney General

RB:HJW:dh


Footnote:

1 On July 1, 1993, all programs of the Connecticut Alcohol and Drug Abuse Commission (CADAC) were transferred to the Department of Public Health and Addiction Services (DPHAS). 1992 Conn. Spec. Act 92-20,  2. The terms "CADAC," "the Commission", "DPHAS" and "the Department" will hereinafter be used interchangeably to refer to the Department of Public Health and Addiction Services.

2 42 C.F.R.  2.11 includes the following pertient definitions:

"Patient" means any individual who has applied for or been given diagnosis or treatment for alcohol or drug abuse at a federal assisted program and includes any individual who, after arrest on a criminal charge, is identified as an alcohol or drug abuser in order to determine that individual's eligibility to participate in a program.
"Patient identifying information" means the name, address, social security number, fingerprints, photograph, or similar information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information. The term does not include a number assigned to a patient by a program, if that number does not consist of, or contain numbers (such as a social security, or driver's license number) which could be used to identify a patient with reasonable accuracy and speed from sources external to the program.

3 Conn. Gen. Stat.  52-146f, which pertains to the diagnosis or treatment of a patient by a psychiatrist, provides in relevant part:

Consent of the patient shall not be required for the disclosure or transmission of communications or records of the patient in the following situations as specifically limited:
(1) Communications or records may be disclosed to other persons engaged in the diagnosis or treatment of the patient or may be transmitted to another mental health facility to which the patient is admitted for diagnosis or treatment if the psychiatrist in possession of the communications or records determines that the disclosure or transmission is needed to accomplish the objectives of diagnosis or treatment. The patient shall be informed that the communications or records will be disclosed or transmitted. For purposes of this subsection, persons in professional training are to be considered as engaged in the diagnosis or treatment of the patients.

Similar provisions regarding the disclosure of communications made to a social worker by a client are contained in Conn. Gen. Stat.  52-146q(c)(1).

4 According to Conn. Gen. Stat.  17a-621(17), "'[t]reatment facility' means (A) a facility providing treatment and operating under the direction and control of the commission or (B) a private facility providing treatment and licensed under the provisions of sections 19a-490 to 19a-503, inclusive."

5 Conn. Gen. Stat.  52-146h provides:

(a) Any mental health facility may transmit information and records, if requested, to the commissioner of mental health pursuant to his obligation under section 17a-451 to maintain, subject to the approval of the board of mental health, the overall responsibility for the care and treatment of the mentally ill. The commissioner of mental health may collect and use the information and records for administration, planning or research, subject to the provisions of section 52-146g. The commissioner of mental health may enter into contracts within the state and into interstate compacts for the efficient storage and retrieval of the information and records.
(b) Identifiable data shall be removed from all information and records before issuance from the mental health facility which prepared them, and a code, the key to which shall remain in possession of the issuing facility and be otherwise available only to the commissioner of mental health for purposes of planning, administration or research, shall be the exclusive means of identifying patients. The key to the code shall not be available to any data banks in which the information is stored or to any other persons, corporations or agencies, private or governmental.

6 With respect to research activities, 42 C.F.R.  2.52 provides:

(a) Patient identifying information may be disclosed for the purpose of conducting scientific research if the program director makes a determination that the recipient of the patient identifying information:
(1) Is qualified to conduct the research;

(2) Has a research protocol under which the patient identifying information:
(i) Will be maintained in accordance with the security requirements of  2.16 of these regulations (or more stringent requirements); and
(ii) Will not be redisclosed except as permitted under paragraph (b) of this section; and

(3) Has provided a satisfactory written statement that a group of three or more individuals who are independent of the research project has reviewed the protocol and determined that:
(i) The rights and welfare of patients will be adequately protected; and
(ii) The risks in disclosing patient identifying information are outweighed by the potential benefits of the research.
(b) A person conducting research may disclose patient identifying information obtained under paragraph (a) of this section only back to the program from which that information was obtained and may not identify any individual patient in any report of that research or otherwise disclose patient identities. 7 With respect to audit and evaluation activities, 42 C.F.R.  2.53 states in pertinent part:
(a) Records not copied or removed. If patient records are not copied or removed, patient identifying information may be disclosed in the course of a review of records on program premises to any person who agrees in writing to comply with the limitations on redisclosure and use in paragraph (d) of this section and who:

(1) Performs the audit or evaluation activity on behalf of:
(i) Any Federal, State, or local governmental agency which provides financial assistance to the program or is authorized by law to regulate its activities; . . . . . .
(b) Copying or removal of records. Records containing patient identifying information may be copied or removed from program premises by any person who:

(1) Agrees in writing to:
(i) Maintain the patient identifying information in accordance with the security requirements provided in  2.16 of these regulations (or more stringent requirements);
(ii) Destroy all the patient identifying information upon completion of the audit or evaluation; and
(iii) Comply with the limitations on disclosure and use in paragraph (d) of this section; and

(2) Performs the audit or evaluation activity on behalf of:
(i) Any Federal, State, or local governmental agency which provides financial assistance to the program or is authorized by law to regulate its activities; . . . .
(d) Limitations on disclosure and use. Except as provided in paragraph (c) of this section, [relating to Medicare and Medicaid audit or evaluation] patient identifying information disclosed under this section may be disclosed only back to the program from which it was obtained and used only to carry out an audit or evaluation purpose . . . .


Back to the 1994 Opinions Page
Back to Opinions Page



Content Last Modified on 6/7/2005 12:28:44 PM