42 U.S.C. § 290dd–2 — Confidentiality of records

(a) Requirement Records about a patient's identity, diagnosis, prognosis, or treatment — kept by any program dealing with substance use disorder education, prevention, training, treatment, rehabilitation, or research that a federal department or agency runs, regulates, or helps pay for — must be kept confidential. They can only be shared for the reasons and in the ways listed in subsection (b), unless subsection (e) says the rule doesn't apply. (b) Permitted disclosure (1) Consent A record's contents can be used or shared if the patient gives written consent ahead of time. Once a patient has given written consent, a covered entity, business associate, or program can use or share the contents for treatment, payment, and health care operations, following HIPAA rules. Information shared this way can then be shared again under HIPAA rules. A patient can give one written consent that covers all future uses for treatment, payment, and health care operations, until the patient cancels that consent in writing. (2) Method for disclosure Whether or not the patient consents, the record's contents can be disclosed: to medical staff, if needed to handle a real medical emergency; to qualified people doing scientific research, management audits, financial audits, or program evaluations — but they can't identify any patient, directly or indirectly, in their reports; if a court with proper authority orders it, after finding good cause — including a need to prevent a serious risk of death or bodily harm, weighing the public interest and need for disclosure against the harm to the patient, the doctor-patient relationship, and the treatment program, with safeguards against further unauthorized disclosure; or to a public health authority, if the information meets federal standards (45 C.F.R. § 164.514(b)) for being "de-identified." (c) Use of records in criminal, civil, or administrative contexts Unless a court orders it under (b)(2)(C) or the patient consents, these records or testimony about them can't be used against a patient in any federal, state, or local court case, agency hearing, or law enforcement action. Specifically: they can't be entered as evidence in a criminal or civil case; they can't be part of the record an agency uses to decide something; law enforcement can't use them to investigate; and they can't be used to get a search warrant. (d) Application This confidentiality rule keeps applying to someone's records even after they stop being a patient — it doesn't matter when or whether they leave the program. (e) Nonapplicability These confidentiality rules don't apply to records shared within the Uniformed Services, within the parts of the Department of Veterans Affairs that give veterans health care, or between those VA components and the Uniformed Services. They also don't apply when a state law requires reporting suspected child abuse or neglect to state or local authorities. (f) Penalties The same penalty rules that apply to violations of the Social Security Act's HIPAA provisions (42 U.S.C. §§ 1320d–5, 1320d–6) apply to a violation of this section, with a few technical adjustments to how those provisions' cross-references are read. (g) Regulations Except as (h) says otherwise, the Secretary must write regulations to carry out this section — including definitions, safeguards, and procedures (like rules for court orders under (b)(2)(C)) needed to make the section work and stop people from getting around it. (h) Application to Department of Veterans Affairs The Secretary of Veterans Affairs, through the Under Secretary for Health, must apply the Secretary of Health and Human Services' regulations to VA hospital, nursing home, in-home ("domiciliary"), and medical records for veterans with substance use disorders, as far as the VA's other duties under title 38 allow. The two Secretaries must keep checking in with each other so their regulations line up. (i) Antidiscrimination (1) In general No one may discriminate against a person because of information they got from an inadvertent or intentional disclosure of these records — in health care admission or treatment; in hiring, firing, job terms, or workers' compensation; in selling, renting, or renewing a housing rental; in access to courts; or in access to, approval of, or keeping government-funded social services and benefits. (2) Recipients of Federal funds Anyone who gets federal funds can't discriminate against a person, in giving access to services paid for with those funds, because of information from a disclosure of these records. (j) Notification in case of breach If there's a breach of these records, the program must follow the same breach-notification rules (under section 17932) that apply to a "covered entity" under HIPAA when protected health information is breached. (k) Definitions This section borrows several terms — "breach," "business associate," "covered entity," "health care operations," "HIPAA regulations," "payment," "public health authority," "treatment," and "unsecured protected health information" — from the meanings those terms already have under HIPAA regulations. (The statutory text shows "unprotected 1 health information" for the last term, apparently an OCR artifact, but it points to the HIPAA definition.)