When can a North Carolina substance abuse treatment facility release information about a patient to police, a court, or to anyone else, and how do federal rules and state rules interact?

Plain-English summary

Barbara Garlock asked the AG to lay out how NC substance abuse treatment facilities should handle requests for patient information, especially from law enforcement. The answer, by Senior Deputy AG Wanda G. Bryant and Associate AG Daniel D. Addison, walked through the two overlapping confidentiality regimes that NC programs operate under: federal 42 C.F.R. Part 2 (which applies to "federally assisted" alcohol and drug abuse programs) and NC's Chapter 122C (which applies to all such programs in the state).

The general framework, the AG explained, has three rules for a federally assisted program: it must obey all federal disclosure prohibitions, must obey any state-law prohibitions that go further, and may not disclose information that state law authorizes if federal law prohibits the same disclosure. 42 C.F.R. § 2.20.

A program is "federally assisted" if it is run by the federal government, operates under a federal license or registration (such as a methadone-treatment authorization or a controlled-substance dispensing registration), receives federal funds even indirectly through the host facility, or is tax-exempt or able to receive tax-deductible contributions. 42 C.F.R. § 2.12(b)–(c). Most substance abuse programs in NC qualify.

Federal law (42 U.S.C. §§ 290dd-3(a) and 290ee-3(a)) makes it a federal crime for a federally assisted program to disclose information about a current or past patient's identity, diagnosis, prognosis, treatment, education, training, rehabilitation, or referral. Even acknowledging that someone is a patient at a publicly-recognized drug or alcohol abuse program is prohibited, because that acknowledgment would identify the person as a substance abuser. A facility may, however, confirm that someone is not and has never been a patient. 42 C.F.R. § 2.13(c).

The AG then walked through the limited circumstances in which federally assisted programs may disclose patient information to law enforcement:

1. Patient consent. The patient may consent in writing under the detailed conditions in 42 C.F.R. § 2.31. Consent must be voluntary and the use of the disclosed information must be limited to the purposes consented to.

2. Child abuse and neglect reports. A program may report suspected child abuse or neglect to the proper authorities (typically county Departments of Social Services). 42 C.F.R. § 2.12(c)(6). Information disclosed in the initial report and investigation may flow to law enforcement assisting DSS, but the information cannot be used in subsequent civil or criminal proceedings arising out of the report.

3. On-premises crimes or threats. When a patient commits a crime on program premises, or against program personnel, or threatens to do so, certain limited disclosures are permitted.

4. Court order plus subpoena for prosecution of patients. This is tightly regulated. The application must use a fictitious name like "John Doe" for the patient. The program must get notice, a chance to be heard, and counsel at a confidential hearing. The court may authorize disclosure only if it finds: the investigation involves an extremely serious crime; the records are reasonably likely to yield substantial-value information; other means of getting the information would be unavailable or ineffective; and the public interest in the records outweighs the harm to the patient. Even then, the order must be narrowly drawn. 42 C.F.R. § 2.65.

Critically, a court order alone only permits disclosure; it does not require it. To compel disclosure, the law enforcement agency must also obtain a subpoena or similar compulsory process. A subpoena alone neither authorizes nor permits disclosure. Both pieces are required. 42 C.F.R. § 2.61.

5. Court order for investigation of the program itself. Similar procedure to #4, with one practical difference: notice of the court hearing is optional. Patient information obtained in an investigation of the program or its personnel cannot then be used to prosecute the patients. 42 C.F.R. § 2.66.

For programs that are not federally assisted, only NC Chapter 122C controls. NC's rules are similar but somewhat looser:

• Patient consent in writing, identifying the recipient, releases the facility to disclose. § 122C-53(a).
• Court order compels disclosure under § 122C-54(a), without the limiting findings the federal regulations require.
• Imminent danger. A "responsible professional" at the facility may, in his or her professional judgment, disclose confidential information when there is imminent danger to the health or safety of the client or another individual, or the likelihood of a felony or violent misdemeanor. § 122C-55(d). This NC exception is broader than the federal on-premises-crime exception. The "responsible professional" must be designated by the facility director and eligible to provide care to the client. § 122C-3(32).
• Child abuse, neglect, exploitation reports. State law lets a facility disclose information for reports or investigations involving children or disabled adults. § 122C-54(h).
• Escape from a 24-hour facility. When certain confined or conditionally-released clients escape or breach release conditions, the facility must notify law enforcement and may share enough information to identify the client and protect the public. § 122C-205.

The pattern is consistent: federal rules are tighter than state rules, so federally assisted programs follow federal rules. Non-federally-assisted programs (rare in practice) follow the somewhat broader state rules.

Currency note

This opinion was issued in 1994. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Federal law in this area has been substantially restructured since 1994. The substantive provisions formerly at 42 U.S.C. §§ 290dd-3 and 290ee-3 were combined and recodified at 42 U.S.C. § 290dd-2. 42 C.F.R. Part 2 has been amended several times, including 2017–2024 updates that loosened some consent requirements, made Part 2 records discoverable in some health information exchanges, and aligned aspects with HIPAA. HIPAA itself, enacted in 1996, is now a major overlay for any disclosure question. NC Chapter 122C has likewise been amended. Anyone facing a current disclosure question should consult present 42 U.S.C. § 290dd-2, the current 42 C.F.R. Part 2, HIPAA, current Chapter 122C, and counsel familiar with substance-abuse-records law.

Common questions

Q: Can a police officer find out whether a person is a patient at a methadone clinic just by asking?
A: No. The federal regulations forbid even confirming someone's status as a patient at a publicly-recognized drug or alcohol program, because that confirmation identifies them as a substance abuser. The clinic must refuse to confirm or deny.

Q: What if police have a subpoena?
A: A subpoena alone is not enough for a federally assisted program. They need both a court order (issued under the protective procedures in 42 C.F.R. §§ 2.61–2.66) and a subpoena or other compulsory process. Programs that respond to a subpoena-only request commit a federal crime.

Q: Can a treatment facility report suspected child abuse?
A: Yes. Federal and state law both permit (and NC law requires, under separate child-protection statutes) reporting suspected child abuse to the appropriate authorities. Information disclosed in the report may be used in the investigation but not, under federal law, in any subsequent civil or criminal proceedings arising out of it. Disclosures about disabled adult abuse are allowed under NC law but not specifically required by Part 2.

Q: What happens if a patient threatens to hurt someone?
A: A federally assisted program may make a limited disclosure under the on-premises-crime exception if the threat occurs on premises or against staff. A non-federally-assisted program has more flexibility under NC's "imminent danger" professional judgment exception in § 122C-55(d).

Q: What if a patient escapes from inpatient treatment?
A: NC law requires the facility to notify law enforcement and may share enough information to identify and recover the patient. § 122C-205. Federal law has no comparable mandatory-notification exception, but the on-premises-crime or imminent-danger rules may apply depending on the facts.

Q: How is "federally assisted" defined?
A: Broadly. A program is federally assisted if the parent institution receives any federal funds (even if those funds do not pay for the substance abuse program itself), if it operates under a federal license (Medicare, methadone, controlled-substance registration), if it is tax-exempt under federal law, or if contributions to it are tax-deductible. Most NC programs fall in this category.

Background and statutory framework

The federal substance abuse confidentiality scheme was created in the early 1970s out of concern that treatment-seeking would be deterred if patients feared that records would surface in criminal cases. The statute (42 U.S.C. § 290dd-2 in current form, formerly §§ 290dd-3 and 290ee-3) authorizes the regulations at 42 C.F.R. Part 2. Part 2 is stricter than HIPAA in many respects, particularly around law enforcement access and consent specificity.

NC's Chapter 122C, the Mental Health, Developmental Disabilities, and Substance Abuse Act, codified after Reorganization in the 1980s, sets the state-law confidentiality framework for all mental health, developmental disability, and substance abuse facilities operated or licensed by the state. The 1994 AG opinion essentially walks a facility administrator through how to apply both layers, with a careful explanation of how federal-state interaction works under 42 C.F.R. § 2.20.

The opinion is a useful early roadmap. Modern compliance officers will need to layer in HIPAA and the 2017–2024 Part 2 amendments, but the basic federal/state interaction model has not changed: stricter rule wins, federally assisted programs follow Part 2 plus any tighter state rules, court orders plus subpoenas are required for compelled disclosure to law enforcement under federal Part 2.

Citations

• 42 U.S.C. §§ 290dd-3(a), 290ee-3(a) (federal crime to disclose patient information from federally assisted programs; combined and recodified after 1994 at § 290dd-2)
• 42 C.F.R. § 2.12 (definition of "federally assisted" program)
• 42 C.F.R. § 2.13 (general prohibition; rule against confirming patient identity at publicly-recognized programs)
• 42 C.F.R. § 2.20 (three-rule federal/state interaction framework)
• 42 C.F.R. § 2.31 (patient consent requirements)
• 42 C.F.R. § 2.61 (court order and subpoena both required to compel disclosure)
• 42 C.F.R. § 2.65 (court-order findings for prosecution of patients)
• 42 C.F.R. § 2.66 (court-order findings for investigation of programs)
• N.C. Gen. Stat. § 122C-3(6), (9), (14), (32) (definitions of client, confidential information, responsible professional)
• N.C. Gen. Stat. § 122C-53(a) (written patient consent)
• N.C. Gen. Stat. § 122C-54(a), (h) (court-ordered disclosure; child/disabled adult abuse reports)
• N.C. Gen. Stat. § 122C-55(d) (imminent danger; responsible-professional disclosure)
• N.C. Gen. Stat. § 122C-205 (mandatory law-enforcement notification for escapes from 24-hour facilities)
• N.C. Gen. Stat. § 7A-544 (DSS authority to seek law enforcement assistance in abuse investigations; current cross-references appear in Chapter 7B)

Source

• Landing page: https://ncdoj.gov/opinions/confidentiality-of-patient-information-at-drug-and-alcohol-abuse-treatment-facilities/

Original opinion text

The fetched body opens mid-list. The opening text describing the request and the federal/state framework is not in the available extract; the following reproduces what the source page returned.

• (1) Must obey all federal disclosure prohibitions; and
• (2) Must obey any State law disclosure prohibitions beyond the prohibitions of the federal law; but
• (3) May not disclose information authorized or compelled to be disclosed by State law if disclosure of that same information is prohibited by federal law. (See, 42 C.F.R. § 2.20).

Facilities that are not federally assisted are subject only to State law restrictions. In some circumstances, non-federally assisted facilities may be required or permitted by State law to make disclosures that federally assisted facilities would be prohibited from making. These circumstances will be discussed later, following a discussion of the restrictions that apply to federally assisted programs.

The definition for federally assisted programs is detailed in 42 C.F.R. § 2.12(b) and (c). Generally, alcohol or drug abuse programs are considered to be federally-assisted if they are:

• (1) Conducted by United States government agencies;
• (2) Carried out under federal licenses, certifications, registrations or other authorizations, such as Medicare, methadone maintenance treatment authorization, or controlled substance dispensing registration;
• (3) Supported by funds from the federal government (a program is considered to be supported by such funds if the facility or department housing the program receives such funds, even if the funds are not used to pay for the program itself); or
• (4) Tax exempt, or tax deductions may be taken for contributions to the program.

It is a federal crime for federally assisted alcohol or drug abuse programs and their personnel to disclose certain information, whether recorded or not, concerning patients. The federal law prohibits disclosure of information concerning the identity, diagnosis, prognosis, treatment, education, training, rehabilitation or referral for treatment of current or past patients. 42 U.S.C. §§ 290dd-3(a) and § 290ee-3(a). The law also prohibits the disclosure of any information that might identify a patient as a past or present alcohol or drug abuser. 42 C.F.R. § 2.12. Thus, disclosing the presence of a person as a patient at a publicly-recognized drug or alcohol abuse program is expressly prohibited, since revealing that information might identify that person as a drug or alcohol abuser. 42 C.F.R. § 2.13(c). However, a facility may acknowledge the presence of a patient at the facility if it is not publicly recognized as a drug or alcohol abuse program, so long as disclosing the patient's presence does not identify him as an alcohol or drug abuser. The regulations also do not prohibit disclosing that a person is not and has never been a patient. 42 C.F.R. § 2.13(c).

The federal regulations state specifically that the disclosure prohibitions apply to the release of information to law enforcement personnel. 42 C.F.R. § 2.13(b). However, the statute and regulations specify certain limited circumstances in which release of confidential patient information by federally assisted programs to law enforcement personnel may be permitted or required. These circumstances are listed here, and discussed below:

• (1) The patient consents to release of the information;
• (2) The program is reporting suspected incidents of child abuse or neglect under State law;
• (3) A patient commits a crime on the program premises, or against program personnel, or threatens to commit such a crime;
• (4) A court has issued a proper order for release of information in criminal investigations or prosecutions of patients; or
• (5) A court has issued a proper order for release of information in criminal/administrative investigations or prosecutions of the program or program personnel.

A federally assisted program may disclose patient information if the patient consents. The conditions for obtaining patient consent are listed in detail in the federal regulations. 42 C.F.R. § 2.31. Generally, these conditions ensure that consent is given voluntarily, and that use of disclosed information is restricted to the purposes for which consent is given.

A federally assisted program may disclose patient information to proper authorities in reporting suspected incidents of child abuse or neglect under State law. 42 C.F.R. § 2.12(c)(6). In North Carolina, child abuse and neglect reports are made typically to county Departments of Social Services. However, these departments are permitted to seek the assistance of local or State law enforcement personnel in evaluating or investigating abuse or neglect reports. N.C. Gen. Stat. § 7A-544. It is possible, therefore, that substance abuse program personnel might reveal confidential information to law enforcement personnel acting under authority of the Director of a Department of Social Services. However, the disclosure of information under these circumstances would be limited to the initial reporting and investigation by the Department of Social Services. Program personnel may not disclose patient information for use in civil or criminal proceedings which may arise out of the report of suspected child abuse or neglect. 42 C.F.R. § 2.12(c)(6).

The circumstances in which federally assisted program personnel may disclose patient information to law enforcement personnel for criminal investigations or prosecutions of patients are closely regulated. Those seeking to investigate or prosecute patients must apply for a court order. An application for a court order must use a fictitious name such as John Doe to refer to the patient, and the application may not use any other information that might identify the patient. The program must be given adequate notice, an opportunity to be heard, and an opportunity to be represented by counsel at a hearing to determine whether the information sought should be disclosed. (If the program is run by a government agency, that agency must be represented by counsel). Hearings are confidential. The court may authorize disclosure and use of the information only if it finds:

• (1) The investigation involves an extremely serious crime;
• (2) There is a reasonable likelihood that the records will reveal information of substantial value to the investigation;
• (3) Other ways of obtaining the information are unavailable or would be ineffective; and
• (4) The public interest in the need for the records outweighs potential injury to the patient.

If the court authorizes disclosure, the order must be drawn narrowly to accomplish only the purposes for which it was made and to avoid further unnecessary disclosures. 42 C.F.R. § 2.65.

The court's order may authorize the program to disclose confidential information. However, the court's order may not compel the program to disclose information. If the agency seeking the information wishes to compel disclosure, it must also obtain a subpoena or similar legal mandate, which may be obtained at the same time as the order. 42 C.F.R. § 2.61.

Thus, a court order, alone, merely permits but does not require a program to disclose patient information. A subpoena, alone, neither authorizes nor permits a federally assisted program to disclose patient information. A program is required to disclose patient information only if the law enforcement agency has obtained a court order and a subpoena or other form of compulsory process. 42 C.F.R. § 2.61.

Federally assisted programs may also be required or permitted to disclose patient information to law enforcement personnel in investigations or prosecutions of the program, itself, or its personnel. Generally, the prerequisites and restrictions for releasing information in these circumstances are the same as those for releasing information in investigations or prosecutions of patients. These procedures and restrictions are detailed at 42 C.F.R. § 2.66. The major differences are that in investigations of programs or their personnel, notice of the court hearing before issuance of the disclosure order is optional. Also, no patient information obtained in investigations of programs or their personnel may be used to investigate or prosecute patients. Id.

As was mentioned earlier, drug or alcohol abuse treatment programs that are not federally assisted are subject only to the disclosure restrictions of Chapter 122C of the North Carolina General Statutes.

In many respects, State law restrictions on the disclosure of patient information are similar to the federal restrictions. Drug and alcohol abuse treatment facilities and their personnel are prohibited from disclosing client information, whether recorded or not, concerning the care, treatment, habilitation or rehabilitation of substances abusers. N.C. Gen. Stat. § 122C-3(9) and (14). Disclosure prohibitions apply to in-patient and out-patient clients, and to current and past clients. N.C. Gen. Stat. § 122C-3(6). Although State law does not specify that the identity of a client, or his presence at a facility, are confidential information, these are impliedly confidential information. (E.g., statistical information about treatment of patients may be disclosed for training or monitoring purposes so long as such information "does not identify clients." N.C. Gen. Stat. § 122C-3(9).

The circumstances in which confidential client information is permitted or required by State law are listed here, and discussed below:

• (1) The patient consents to release of the information;
• (2) A court orders release of the information;
• (3) There is an imminent danger to the health or safety of the client or another individual or there is a likelihood of the commission of a felony or a violent misdemeanor;
• (4) The information is part of a report of neglect or abuse of a child or disabled adult; or
• (5) A confined client escapes from the facility.

Under State law, a facility is permitted to disclose confidential information if the client releases it. The release must be in writing and must specify the person to whom the information is releasable. N.C. Gen. Stat. § 122C-53(a). These provisions are similar to federal law, except federal law specifies the detailed contents of written patient releases. (Compare, 42 C.F.R. § 2.31).

Under State law, a facility is required to disclose confidential information if a court of competent jurisdiction issues an order compelling disclosure. N.C. Gen. Stat. § 122C-54(a). Unlike the federal statute and regulations, this subsection does not specify any limiting conditions for such an order, or factors to be considered by the court in issuing such an order. (Compare, 42 C.F.R. §§ 2.65 and 2.66).

Under State law, confidential client information may be disclosed by facilities to law enforcement personnel or to others if, in the opinion of a responsible professional, there is an imminent danger to the health or safety of a client or another individual or there is a likelihood of the commission of a felony or violent misdemeanor. N.C. Gen. Stat. § 122C-55(d). A "responsible professional" is a person in the facility designated by the director and eligible to provide care, treatment, habilitation, or rehabilitation to the specific client. N.C. Gen. Stat. § 122C-3(32). The release of information under this provision is optional, based on the opinion of the responsible professional. Although similar to the provisions of this section, federal law is more restrictive, allowing release only of certain specified information when a crime is committed or threatened on the premises or against program personnel. (Compare, 42 C.F.R. § 2.12(c)(5).

Like federal law, State law permits a facility to disclose confidential information for purposes of reporting or assisting in the investigation of suspected incidents of child abuse or neglect. Unlike federal law, State law permits facilities to disclose confidential client information for the purposes of reporting or assisting in the investigation of suspected incidents of abuse, neglect, or exploitation of disabled adults. N.C. Gen. Stat. § 122C-54(h). This provision also differs from federal law in that the federal law specifies the patient information remains confidential and may not be used in civil or criminal proceedings stemming from abuse reports. (Compare, 42 C.F.R. § 2.12(c)(6).

Under specified circumstances, when certain clients who are committed to, detained at, or on conditional release from a 24-hour facility either escape or breach conditions of release, the facility is required by State law to notify certain law enforcement agencies. N.C. Gen. Stat. § 122C-205. In these circumstances, the facility may disclose sufficient confidential information to identify the client to assure his return to the facility, and to assist the law enforcement personnel in protecting the public. There is no comparable federal provision for disclosing information under these circumstances.

We hope that this fully answers your request. Should you have further questions regarding this issue, please do not hesitate to contact us.

Wanda G. Bryant
Senior Deputy Attorney General

Daniel D. Addison
Associate Attorney General