Appendix B—Opinion Letters

Richard Riseberg, Esq.
General Counsel
Office of the General Counsel
Alcohol, Drug Abuse, and Mental Health Administration
Room 4A_53 Parklawn
5600 Fishers Lane
Rockville, MD 20857

Dear Mr. Riseberg:

We are writing to offer our comments on two opinion letters issued in the past two years about disclosure of HIV-related information to state health departments under 42 C.F.R., Part 2. (Opinion letter by the Legal Advisor to the Alcohol, Drug Abuse, and Mental Health Administration to the Oklahoma State Department of Health (September 2, 1988) and Opinion letter by Acting General Counsel to the Department of Health and Human Services (Office of the Secretary) to the New York State Department of Health (May 17, 1989).)

These two letters suggest a variety of ways in which HIV-related information contained in alcohol or drug abuse patient records protected by 42 U.S.C. § 290 dd–3 and § 290 ee–3 and 42 C.F.R. Part 2 can be disclosed to state health departments pursuant to mandatory reporting requirements. We think that some of the advice offered in the letters is excellent. For example, we agree that obtaining patient consent is the best way to report such information while abiding by the federal law and regulations; and we agree that reports can be made by some programs by deleting alcohol or drug abuse information from the report. However, a number of suggestions the letters make disturb us profoundly.

1. Use of the "audit or evaluation" exception of 42 C.F.R. § 2.53

Both letters suggest that reports of HIV information may be made by a drug or alcohol program to the state health department pursuant to 42 C.F.R. § 2.53, the "audit or evaluation" exception of the regulations. The letters approve the use of § 2.53 whether the purpose of the state's reporting law is research or whether it also includes measures to control the spread of infection, such as contact tracing. The letters state that HIV reports made for the purposes of audit or evaluation could be used for contact tracing purposes if the identity of the infected individual remains anonymous. The letters also state that the health department can contact the patient to discuss his or her HIV status, and presumably, sexual and needle contacts. In other words, the public health authority can use the information disclosed by the programs to contact the HIV-infected patient directly to offer counseling and contact notification services and then approach those contacts, provided that the patient's name is not revealed to the contacts.

We believe that using § 2.53 to report HIV data to public health authorities distorts the meaning and purpose of that section.¹

Section 2.53 is designed to permit financial and programmatic evaluation of programs' functioning. The section contemplates an outside agency such as an accounting firm or a state regulatory agency entering the program's premises and examining and/or copying its books and records for the purposes of determining how the program is functioning financially or otherwise. Reporting the HIV status of patients to public health authorities pursuant to a mandatory reporting law serves no audit or evaluation function. The purpose of reporting patients' HIV status is clearly not to determine how the program is functioning but to permit the public health authorities to use patient-identifying information gained by the program for other purposes.

Moreover, the public health department's use of patient-identifying information to perform contact tracing would likely violate subsection (d) of § 2.53, which states that "patient identifying information disclosed under [§ 2.53] may be disclosed only back to the program from which it was obtained and used only to carry out an audit or evaluation purpose ...." (emphasis added). Since contact tracing is not an audit or evaluation and does not serve such a purpose, § 2.53(d) appears to prohibit the use of information about a patient to perform contact tracing functions, even when the name of the patient is not disclosed to his or her contact.

2. Use of patient consent when the reporting may lead to civil or criminal sanctions

The May 17, 1989 letter from the Acting General Counsel to the New York State Health Department notes that it would clearly be improper to use either § 2.52 or § 2.53 to make reports to public health officials "if the purpose of the initial report ... is to investigate an alcohol or drug abuse patient for purposes of civil or criminal sanctions...." However, the letter then suggests that a program making an initial report to investigate a patient in order to punish that patient might make the report with patient consent under § 2.31. In fact, 42 U.S.C. §§ 290 dd–3(c) and ee–3(c) make clear that only a court order—not written consent—can authorize use of records for criminal investigations. That prohibition is carried over into the regulations at 42 C.F.R. § 2.12(d)(1).

We thought we would share with you another solution to the problem of complying with a mandatory reporting law that has occurred to us: using a "qualified service organization agreement" to make such mandated reports. This might be especially useful for programs that are not part of a general medical or mental health facility and are therefore barred in a practical sense from making a report by deleting alcohol or drug information. Such a "free-standing" program could enter into a QSOA with a laboratory or medical care provider that conducts HIV testing or other diagnostic services for the program. As part of its service the QSO could report the HIV information to the public health department and delete the alcohol and drug information from the report. We recognize that this solution would not be available in some states (New York is among them) that have strict laws restricting disclosure of HIV-related information.

We would be pleased to discuss the issues this letter raises with you, at your convenience.

Sincerely,

Margaret K. Brooks
President/Director
Legal Action Center
153 Waverly Place
New York, NY 10014

^{__________________________________}

1However, we believe that if the purpose of the state's reporting law is solely to collect research data about the existence, incidence and impact of HIV/AIDS, alcohol and drug programs can comply if the procedural requirements of § 2.52 are met, i.e., (1) if the public health authority is qualified to conduct the research (which it probably is), (2) if it has a research protocol to protect patient-identifying information and if a group of three or more individuals independent of the research project has reviewed the protocol and found it adequate, and (3) if the public health authority agrees not to disclose patient-identifying information except back to the program and not to identify any individual patient in any report or otherwise disclose patient identities.

May 17, 1989

Peter J. Millock
General Counsel
Department of Health
State of New York
Corning Tower, Empire State Plaza
Albany, New York 12237

Dear Mr. Millock:

We are responding to your letter of April 21 seeking our advice on how the Federal confidentiality regulations on alcohol and drug abuse patient records, 42 C.F.R. Part 2, affect the reporting of communicable diseases under New York law. In our opinion, such disclosures may be made by deletion of all alcohol or drug abuse information from the report consistent with 42 C.F.R. § 2.13(c)(1), with written patient consent under 42 C.F.R. § 2.31–2.33, or as disclosure for purposes of research, audit, or evaluation under 42 C.F.R. § 2.52–2.53. In addition, in selected cases, reports may be made for purposes of treating a bona fide medical emergency under section 2.51. Finally, where a civil or criminal investigation of a particular individual is envisioned, it may be necessary to obtain an appropriate court order under section 2.64 or 2.65 of the regulations.

As we understand it, New York law requires that physicians and institutions report cases of communicable disease to the local health officer, who in turn is required to report the information to the State Department of Health. Your letter states that the purpose of such reporting is to enable State and local health officials to "investigate cases of communicable disease and take whatever action is necessary and appropriate to deter the spread of a communicable disease." In this regard, you indicate that in at least two cases alcohol abuse facilities have refused to cooperate with "communicable disease investigations" based on the Federal confidentiality regulations. Because of your concern that the Federal law impedes the implementation of State reporting requirements, you have sought our advice on the matter.

We have recently responded to a similar inquiry from the State of Oklahoma on HIV reporting and are enclosing a copy of our reply for your review. We advised in that situation that HIV reports may be made to Oklahoma public health officials as audit or evaluation disclosures under 42 C.F.R. § 2.53 if the purpose of such reports was to increase the knowledge of the incidence and prevalence of HIV and for health planning purposes. We also suggested, and now conclude, that under appropriate circumstances such reports could also be made for purposes of research under section 2.52. Finally, we advised that such reports could be made with the patient's written consent under sections 2.31 and 2.33 of the regulations. In this regard, we enclosed an opinion to Beth Israel Medical Center in New York City which discusses making venereal disease reports under State law either with written patient consent or by deletion of alcohol or drug abuse identifying information from the report. See 42 C.F.R. § 2.12(a)(1)(I) and (e)(3) and 2.13(c)(1).

In the Oklahoma opinion, we concluded that HIV reports made for purposes of audit or evaluation could be redisclosed back to the alcohol or drug abuse program from which the information was obtained and could otherwise be used for contact tracing purposes if the identity of the infected individual remained anonymous. However, we should emphasize that both the authorizing legislation and the regulations would otherwise generally prohibit the redisclosure of alcohol or drug abuse patient identities where the original disclosure was made for purposes of research, audit, or evaluation. 42 U.S.C. § 290dd–3; 42 U.S.C. § 290ee–3; 42 C.F.R. §§ 2.52(a)(2)(ii) and (b) and 2.53(d).

Thus, it is unclear to us whether the type of "communicable disease investigations" to which you refer in your letter could be carried out under section 2.52 or 2.53 of the regulations. In particular, it is our view that if the purpose of the initial report to public health officials is to investigate an alcohol or drug abuse patient for purposes of civil or criminal sanctions the report could not be made as a disclosure for purposes of research, audit, or evaluation. In those circumstances, the report would need to be authorized with written patient consent or a court order under 42 C.F.R. § 2.64 or 2.65. With respect to section 2.65, we note, however, that it only authorizes disclosures for purposes of criminally investigating or prosecuting an alcohol or drug abuse patient in cases of "extremely serious" crimes. 42 C.F.R. § 2.65(d)(1).

In your letter, you have particularly sought our advice on whether the authority in section 2.51 for disclosing alcohol or drug abuse patient records in cases of a bona fide medical emergency would permit communicable disease reports. We have advised under prior regulations that a positive venereal disease test did not constitute a bona fide medical emergency under the authorizing legislation and regulations because the need for medical treatment of the infected individual was not sufficiently immediate to consider it an emergency and, thereby, to justify bypassing the normal procedures for obtaining a written consent or a court order. However, as the revised regulations provide that the medical emergency which justifies the disclosure could be a threat to the health of "any individual" and not just the patient (42 C.F.R. § 2.51(a); 48 Fed. Reg. 38767, August 25, 1983) and in recognition of the varying seriousness of different diseases, we now conclude that the incidence of venereal and other communicable diseases should be assessed on an individual basis to determine whether they constitute a bona fide medical emergency for which a disclosure could be made under section 2.51.

To justify such a disclosure, it is necessary to determine that the information would be disclosed to "medical personnel" for the purpose of treating a condition which poses an "immediate threat" to the health of any individual and which requires "immediate medical intervention." 42 C.F.R. § 2.51(a). Furthermore, the alcohol or drug abuse program making the disclosure is required to document the circumstances surrounding the disclosure, including the medical personnel to whom the disclosure was made and the nature of the emergency. 42 C.F.R. § 2.51(c).

Because of the nature of these determinations and the documentation required, we believe that a medical emergency disclosure would normally have to be made on a case-by-case basis. Thus, we do not find that it constitutes a general authority for making communicable disease reports. In addition, while the authorizing legislation and regulations do not contain a prohibition on redisclosure as is done for research, audit, and evaluation disclosures (42 U.S.C. § 290dd–3(b)(2)(A); 42 U.S.C. § 290ee–3(b)(2)(A); 42 C.F.R. § 2.51), they do prohibit use of the information to criminally investigate or prosecute the alcohol or drug abuse patient absent the appropriate court order. 42 U.S.C. § 290dd–3(c); 42 U.S.C. § 290ee–3(c); 42 C.F.R. § 2.12(d)(1). Thus, once again we are unsure whether this authority would permit the type of "communicable disease investigations" you envision.

In summary, subject to the constraints discussed above, we conclude that communicable disease reports may be made by alcohol and drug abuse treatment programs under New York law by deletion of alcohol or drug abuse information from the report, with written patient consent, for purposes of research, audit, or evaluation, to medical personnel in cases of a bona fide medical emergency, or pursuant to an authorizing court order. If you have any further questions, you may wish to discuss them directly with Chris Pascal of my staff who advises the Department on the Federal confidentiality laws. If you wish to contact him, he may be reached at 301–443–1212.

Sincerely,

Susan K. Zagame
Acting General Counsel
Office of the Secretary
Department of Health and Human Services
Washington, D.C. 20201

Enclosures

bcc: Dr. Pickens
Sandy Garcia
Barbara McGarey
Verla Neslund
Dr. Jones, CDC
Aaron Handler, IHS
Robert Allen, Ph.D., VA

REPORTING OF POSITIVE FINDINGS OF VENEREAL DISEASE IN HOSPITAL PATIENTS WITHOUT IDENTIFYING THEM AS RECIPIENTS OF METHADONE MAINTENANCE TREATMENT (2.11(p)(3); 2.11(j))

To Mr. Karten, Beth Israel Medical Center, New York, NY

You request an opinion on whether, consistent with the "Confidentiality of Alcohol and Drug Abuse Patient Records" regulations, 42 CFR Part 2, Beth Israel Medical Center may report to local health authorities positive venereal disease results of hospital patients enrolled in a Methadone Maintenance Treatment Program (MMTP), if those patients are not identified in any way as MMTP patients.

It is our opinion that the confidentiality regulations permit Beth Israel Medical Center (BIMC) to report, without patient consent, to local health authorities positive venereal disease results of BIMC patients who are enrolled in a Methadone Maintenance Treatment Program, if the patients are not identified in any way to the health authorities as MMTP patients.

BIMC is a voluntary hospital which operates a Methadone Maintenance Treatment Program. Under section 11.03 of New York City's Health Code, the hospital is required to report all patients with positive findings of venereal disease to local health authorities. Due to the possible conflict between the confidentiality regulations which restrict disclosure of drug abuse patient records and local health laws which require disclosure to health authorities of the identity of all patients with positive venereal disease results, the Division of Methadone Monitoring, Food and Drug Administration, has recommended that as part of their intake procedure drug abuse treatment programs, including MMTP, routinely obtain patient consent to release identifying information in cases of positive findings of venereal disease.

You have indicated dissatisfaction with this method of releasing positive venereal disease results of MMTP patients, expressing concern that seeking consent at intake for disclosure of patient identifying information under such circumstances will be perceived as coercive by prospective patients, and thus render the consent involuntary. As an alternative, Beth Israel Medical Center has proposed to report the positive venereal disease results of its MMTP patients by identifying them as BIMC patients without indicating that they are MMTP patients. In you inquiry, you have asked us whether this proposed method of reporting is allowed under the confidentiality regulations.

It is our opinion that BIMC's proposed method of reporting positive venereal disease results is consistent with the confidentiality regulations.¹ 42 CFR § 2.13(a) states that "[r]ecords to which this part applies shall be confidential and may be disclosed only as authorized by this part ...." 42 CFR § 2.11(p) states:

"The following types of communications do not constitute disclosures of records:

"(3) Communications of information which includes neither patient identifying information nor identifying numbers assigned by the program to patients."²

Read together, these two provisions of the regulations provide that communications of information which include neither patient identifying information nor identifying numbers assigned by the program to patients are not disclosures of records subject to the restrictions of 42 CFR Part 2. Thus, BIMC may report the positive venereal disease results of its MMTP patients without patient consent, if the reports do not disclose "patient identifying information" or "identifying numbers assigned by the program to patients."

Section 2.11(j) of the regulations defines "patient identifying information", in pertinent part, as "... information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information." Furthermore, "patient" is defined, in pertinent part, by §2.11(i) as "any individual ... who has applied for or been given diagnosis or treatment for drug abuse or alcohol abuse ...." (Emphasis added.) Thus, we conclude that "patient identifying information" as used in 42CFR§2.11(p)(3) refers to information which can be used to identify a patient, with reasonable accuracy and speed, as an "individual ... who has applied for or been given diagnosis or treatment for drug abuse or alcohol abuse." Accordingly, when reporting its patients' positive venereal disease results, if BIMC does not identify a patient as having applied for or been given diagnosis or treatment for drug or alcohol abuse nor provide his or her program identifying number, it is not making a disclosure of a record for purposes of the regulations.

This conclusion is consistent with 42 CFR § 2.13(f) which provides that:

"The presence of any in-patient in a medical facility for the treatment of drug or alcohol abuse may be acknowledged to callers and visitors with his written consent. Without such consent, the presence of any in-patient or resident in a facility for the treatment of a variety of conditions may be acknowledged if done in such a way as not to indicate that the patient is being treated for drug or alcohol abuse." (Emphasis added.)

Since Beth Israel Medical Center is a "voluntary hospital" which, we presume, treats a variety of conditions, it qualifies under section 2.13(f) as a facility that may report the presence of a drug or alcohol abuse patient in its facility without the patient's consent if this reporting is done "in such a way as not to indicate that the patient is being treated for drug or alcohol abuse."

In summary, we conclude that BIMC may report, without patient consent, the positive venereal disease results of its MMTP patients to local health authorities, if these patients are not identified as MMTP patients in accord with the provisions of 42 CFR §§ 2.11(p)(3) and 2.13(f).

¹We note that we do not find anything legally incorrect in the Division of Methadone Monitoring's recommendation that patient consent to disclosure of positive venereal disease results be routinely obtained at intake. This recommendation is consistent with our prior advice. Letter, GH (Greene) to Young, July 18, 1977 (DF #25B).

²For a general discussion of 42 CFR § 2.11(p)(3), see, letter, GH (Edelman) to Ichord, May 17, 1977 (DF #25B).

September 2, 1988

John Harkess, M.D.
Assistant State Epidemiologist
Oklahoma State Department of Health
P.O. Box 53551
1000 N.E. Tenth
Oklahoma City, Oklahoma 73152

Re: Disclosure of HIV Records to State Health Department Under 42 C.F.R. Part 2—GH Ref. #88–1776 (DF#92, #25B)

Dear Dr. Harkess:

We are responding to your letter of July 12, 1988, and our subsequent phone conservation in which you requested legal advice on the disclosure of HIV information from drug abuse treatment records subject to 42C.F.R.Part 2 to the Oklahoma State Department of Health. This disclosure is now required in Oklahoma under a change in State law which makes HIV infection a reportable disease. Okla. Stat. tit. 63, § 1–503 (1981) (an emergency rule was adopted Jan. 20, 1988, by the Oklahoma State Board of Health adding HIV to the list of reportable diseases).

As we understand it, the procedure for reporting HIV infections to the health department is as follows. The infected person's name and birthdate is reported, although no address is included. The health department uses this information to increase its knowledge of the incidence and prevalence of the disease and for health planning purposes. It also will use this information internally to eliminate double-counting of HIV cases (where reports on the same person are received from more than one source) and to contact the infected person to offer services, such as HIV counseling and assistance with contact notification. Although HIV reports may be made in other instances as well, most reports involving drug abusers are expected as a result of a State health department initiative which offers drug abuse patients HIV testing with informed consent and pre- and post-test counseling. Your legal questions concern how the Federal confidentiality regulations for drug abuse treatment programs, 42C.F.R. Part 2, affect compliance with Oklahoma's HIV reporting requirement and the health department's use of this information once received.

We have previously advised that identifiable HIV records may be disclosed from drug abuse treatment programs to public health authorities without patient consent to the extent that the information is needed to research the causation of AIDS, to conduct epidemiological studies or health program planning, or to evaluate the incidence and treatment of the disease.¹ Although the regulatory provisions on which this prior advice was based have changed, we believe that HIV reports may be made by drug abuse treatment programs to the Oklahoma health department without patient consent under 42 C.F.R. 2.53 as a disclosure for the purposes of audit or evaluation.² Although section 2.52 which authorizes disclosures for research activities could also be used for making HIV reports to the health department, it requires the researcher to obtain an independent review of the research protocol for purposes of protecting the research subjects before any drug abuse records may be disclosed. 42 C.F.R. 2.52(a)(3) (as amended by 52 F.R. 41997, Nov. 2, 1987).³ Thus, it might be unsuitable for the type of mandatory HIV reporting envisioned here.⁴ In any event, reliance on section 2.52 does not appear necessary as disclosures to the health department could be made under section 2.53. Although 2.53 authorizes the initial disclosure of HIV information to the health department, the health department may not identify any individual patient in any report of its audit or evaluation activities or otherwise redisclose information except back to the program from which it was obtained. 42 C.F.R. 2.53(d); 42 U.S.C. § 290ee–3(b)(2)(B).⁵

This limited authority to make redisclosures would permit the State health authority to contact the drug abuse treatment program that made the HIV report to offer counseling and contact notification services to the HIV infected individual. It would also permit the public health authority to notify the sexual and needle contacts of the HIV individual because, as we understand it, such notification keeps the name of the infected person anonymous, thus exempting this communication of information from the meaning of disclosure under the regulations. 42 C.F.R. 2.11 ("disclosure"); 42 C.F.R. 2.12(a)(1)(I).⁶ However, there is no explicit authorization in the regulations for contacting the HIV infected individual directly if the individual is no longer at the drug abuse program. We previously advised under the prior regulations that we did not believe the confidentiality protections were intended to restrict disclosures to the patient of information in his or her records of which the patient was already aware.⁷ We find that this position continues to be sound under the revised regulations and, accordingly, conclude that the State health authority may contact the HIV infected individual directly to offer counseling and contact notification services. However, in doing so, the authority must ensure that it does not disclose information that would identify the individual as a drug abuse patient to others.

In addition to the nonconsensual disclosures which may be made for purposes of research, audit, or evaluation, HIV reports may be made to public health authorities with written patient consent. The use of written patient consent has a number of advantages, including placing the patient on notice of the existence of the State HIV reporting law and ensuring that the State health department may make all disclosures necessary to fulfill their contact notification responsibilities.

In obtaining the patient's consent, the confidentiality regulations require that a special consent form must be used and that any needed redisclosures must be expressly permitted. 42 C.F.R. 2.31 and 2.32. Because HIV testing on drug abusers in Oklahoma will largely be performed with patient consent at drug abuse treatment programs, it may be convenient to obtain the patient's written consent to disclosure at the same time consent to the HIV test is obtained. Since the confidentiality regulations themselves and Oklahoma law provide for confidentiality of the HIV report, those individuals who wish to be tested would presumably be willing to consent to disclosure of the HIV information to the State health authority. Nevertheless, in those cases where consent was not obtained, the HIV information could be reported for purposes of research, audit, or evaluation as previously discussed.

In summary, we believe that the reports of HIV infection required under Oklahoma law may be made in compliance with the Federal confidentiality laws for drug abuse treatment records, 42 U.S.C. § 290ee–3 and 42C.F.R. Part 2, either with written patient consent or, without such consent, as a disclosure for purposes of research, audit, or evaluation.

We hope this information has been helpful. Please let me know if you have any further questions.

Sincerely,

Chris B. Pascal, Legal Advisor
Alcohol, Drug Abuse, and Mental Health Administration
Public Health Division
Department of Health and Human Services
Room 4A-53 Parklawn Bldg.
5600 Fishers Lane
Rockville, MD 20857

bcc: Dr. Pickens Gene Matthews
Verla Neslund Sandy Garcia
Barbara McGarey Bill Quinlin
Dr. Allen, VA Dick Riseberg
John Holliday

¹Memorandum, GH (Pascal) to NIDA (Gardner), Nov. 3, 1983 (DF #25B); See also, C. Pascal, "Selected Legal Issues About AIDS for Drug Abuse Treatment Programs," Journal of Psychoactive Drugs, Vol. 19, P. 2, Jan.–Mar. 1987.

²Although revised section 2.53 refers to an evaluation or audit activity encompassing a "review of records on program premises" (which is not envisioned here since the program will transmit the information to the State), we do not believe this is intended as a limitation on the type of audit and evaluation activities which could be conducted but rather as a description of perhaps its most common form. In this regard, we do not find that there was any intention during the revision of the regulations to restrict disclosures for audit or evaluation activities to an on-site review of records and note that the definition of "program evaluation" in the prior regulations was much broader in scope than the evaluation of an individual alcohol or drug abuse program. See 52F.R. 21800, 21801, June 9, 1987; 42 C.F.R. 2.11(f)(2) and (g)(2) (1986) (prior regulations). Accordingly, we conclude that an HIV report to the Oklahoma State Health Department may be made as a nonconsensual disclosure for purposes of audit or evaluation under 42 C.F.R. 2.53 and 42 U.S.C. § 290ee–3(b)(2)(B).

It is interesting to note that the authority of the Veterans Administration for protection of alcohol and drug abuse patient records (which is modeled after the Department of Health and Human Services authority discussed here) was recently amended to add HIV records to the confidentiality protections and to give explicit authority for disclosing the HIV records to State or local public health authorities without consent. 38 U.S.C. 4132(b)(2)(C), as amended by section 121 of Pub. L. 100–322, the "Veterans' Benefits and Services Act of 1988," enacted May 20, 1988.

³We have doubts that the provisions of section 2.52 requiring a research protocol and its independent review are intended to apply to the type of non-experimental research contemplated here, i.e., tracking the causation and incidence of disease. In this regard, the prior regulations did not restrict the meaning of "scientific research" in any way and there is no indication that the Department intended to change this position in the revised regulations. 42 C.F.R. 2.52(a), 2.52–1(n), and 2.53(c)(1986); 48F.R.38765,38766, Aug. 25, 1983; 52 F.R. 21800, 21801, June 9, 1987. This suggests that the conduct of research which does not include a formal research protocol would not be barred by section 2.52 nor would it be subject to the protocol review requirements. However, we need not formally resolve this issue because we believe that the type of reporting required by the State health department falls within the scope of disclosures for purposes of audit or evaluation as discussed above.

⁴We note, however, that, even assuming the research protocol provisions of section 2.52 apply, certain Federally sponsored HIV testing, such as that performed under the national seroprevalence survey, has received Institutional Review Board approval and, thus, would comply with these provisions.

⁵Section 2.53(a) requires the person performing the audit or evaluation activity to agree in writing to abide by the prohibitions on redisclosure. We believe the State health department may comply with this provision by simply adopting a written policy to this effect and notifying the pertinent drug abuse providers of its existence.

⁶We note that the Veterans Administration statute discussed in Note 2 also provides for nonconsensual notification of a positive finding of HIV to the infected person's spouse or sexual partner. 38 U.S.C. 4132(f). This is consistent with recommendation 9–36 of the Report of the Presidential Commission on the Human Immuno-deficiency Virus, p. 129 (June 1988).

⁷In Opinion 77–14, we advised that "neither the confidentiality statutes, 21 U.S.C. § 1175 and 42 U.S.C. 4582, nor the regulations, are intended to restrict the communication to a patient of limited information, necessary for purposes of bill collection, which he knows by reason of his participation in the program...." We believe this same analysis would apply to a disclosure to the patient of his HIV status by the State health department in those cases in which the patient has already received the information from the program.