[Code of Federal Regulations]
[Title 42, Volume 1, Parts 1 to 399]
[Revised as of October 1, 2000]
From the U.S. Government Printing Office via GPO Access
[CITE: 42CFR2.53]

[Page 21-22]
 
                         TITLE 42--PUBLIC HEALTH
 
                    CHAPTER I--PUBLIC HEALTH SERVICE,
                        DEPARTMENT OF HEALTH AND
                             HUMAN SERVICES
 
PART 2--CONFIDENTIALITY OF ALCOHOL AND DRUG ABUSE PATIENT RECORDS--Table of Contents
 
             Subpart D--Disclosures Without Patient Consent
 
Sec. 2.53  Audit and evaluation activities.

    (a) Records not copied or removed. If patient records are not copied 
or removed, patient identifying information may be disclosed in the 
course of a review of records on program premises to any person who 
agrees in writing to comply with the limitations on redisclosure and use 
in paragraph (d) of this section and who:
    (1) Performs the audit or evaluation activity on behalf of:
    (i) Any Federal, State, or local governmental agency which provides 
financial assistance to the program or is

[[Page 22]]

authorized by law to regulate its activities; or
    (ii) Any private person which provides financial assistance to the 
program, which is a third party payer covering patients in the program, 
or which is a peer review organization performing a utilization or 
quality control review; or
    (2) Is determined by the program director to be qualified to conduct 
the audit or evaluation activities.
    (b) Copying or removal of records. Records containing patient 
identifying information may be copied or removed from program premises 
by any person who:
    (1) Agrees in writing to:
    (i) Maintain the patient identifying information in accordance with 
the security requirements provided in Sec. 2.16 of these regulations (or 
more stringent requirements);
    (ii) Destroy all the patient identifying information upon completion 
of the audit or evaluation; and
    (iii) Comply with the limitations on disclosure and use in paragraph 
(d) of this section; and
    (2) Performs the audit or evaluation activity on behalf of:
    (i) Any Federal, State, or local governmental agency which provides 
financial assistance to the program or is authorized by law to regulate 
its activities; or
    (ii) Any private person which provides financial assistance to the 
program, which is a third part payer covering patients in the program, 
or which is a peer review organization performing a utilization or 
quality control review.
    (c) Medicare or Medicaid audit or evaluation. (1) For purposes of 
Medicare or Medicaid audit or evaluation under this section, audit or 
evaluation includes a civil or administrative investigation of the 
program by any Federal, State, or local agency responsible for oversight 
of the Medicare or Medicaid program and includes administrative 
enforcement, against the program by the agency, of any remedy authorized 
by law to be imposed as a result of the findings of the investigation.
    (2) Consistent with the definition of program in Sec. 2.11, program 
includes an employee of, or provider of medical services under, the 
program when the employee or provider is the subject of a civil 
investigation or administrative remedy, as those terms are used in 
paragraph (c)(1) of this section.
    (3) If a disclosure to a person is authorized under this section for 
a Medicare or Medicaid audit or evaluation, including a civil 
investigation or administrative remedy, as those terms are used in 
paragraph (c)(1) of this section, then a peer review organization which 
obtains the information under paragraph (a) or (b) may disclose the 
information to that person but only for purposes of Medicare or Medicaid 
audit or evaluation.
    (4) The provisions of this paragraph do not authorize the agency, 
the program, or any other person to disclose or use patient identifying 
information obtained during the audit or evaluation for any purposes 
other than those necessary to complete the Medicare or Medicaid audit or 
evaluation activity as specified in this paragraph.
    (d) Limitations on disclosure and use. Except as provided in 
paragraph (c) of this section, patient identifying information disclosed 
under this section may be disclosed only back to the program from which 
it was obtained and used only to carry out an audit or evaluation 
purpose or to investigate or prosecute criminal or other activities, as 
authorized by a court order entered under Sec. 2.66 of these 
regulations.