As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Registry statusNARA & DoD
MarkingHLTH
Organizational index groupPrivacy
Updated2026-05-15
This page exposes extracted CUI registry and authority analysis as crawlable text. The interactive explorer remains the operational workspace for filtering, comparison, and voice-agent aligned study.
As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy"
None listed
Examples
No corresponding field
Records of the identity, diagnosis, prognosis,or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (including education, training, treatment, rehabilitation,or research) relating to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia
Registry date
July 29, 2025
2026-05-15
Authority analysis
Authority title
Registry authority evidence compiled; primary authority text analysis pending
Authorities
Multiple registry authorities
Source currency
NARA last reviewed: July 29, 2025 | DoD detail accessed: 2026-05-15
How the authority operates
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
Trigger conditions
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Covered information
Records of the identity, diagnosis, prognosis,or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (including education, training, treatment, rehabilitation,or research) relating to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia
Registry-described information: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD-described information: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy"
DoD Registry
None listed
Authority analysis
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Basic or Specified
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
5 CFR 293, Subpart E (293.501, 293.504. 293. 505): 5 CFR 293, Subpart E (293.501, 293.504. 293. 505) | status: Basic (provisional) | banner: CUI
(see also 5 CFR 293.106 and 5 CFR 297.401 already on Registry: (see also 5 CFR 293.106 and 5 CFR 297.401 already on Registry | status: Specified Basic | banner: under "Personnel Records" under "General Privacy"
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Page 711 TITLE 18—CRIMES AND CRIMINAL PROCEDURE § 3486
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: (C) A subpoena issued under subparagraph (A) with respect to a provider of electronic commu- nication service or remote computing service, in an investigation of a Federal offense involving the sexual exploitation or abuse of children shall not extend beyond— (i) requiring that provider to disclose the in- formation specified in section 2703(c)(2), which may be relevant to an authorized law enforce- ment inquiry; or (ii) requiring a custodian of the records of that provider to give testimony concerning the production and authentication of such records or information.
Extracted authority condition: L. 108–21 substituted ‘‘the information specified in section 2703(c)(2)’’ for ‘‘the name, address, local and long distance telephone toll billing records, telephone number or other sub- scriber number or identity, and length of service of a subscriber to or customer of such service and the types of services the subscriber or customer utilized’’. 2000—Pub.
Extracted authority condition: (B) Except as provided in subparagraph (C), a subpoena issued under subparagraph (A) may re- quire— (i) the production of any records or other things relevant to the investigation; and (ii) testimony by the custodian of the things required to be produced concerning the pro- duction and authenticity of those things.
Extracted authority condition: (8) If no case or proceeding arises from the production of records or other things pursuant to this section within a reasonable time after those records or things are produced, the agency to which those records or things were delivered shall, upon written demand made by the person producing those records or things, return them to that person, except where the production re- quired was only of copies rather than originals.
Extracted authority condition: (e) L IMITATION ONUSE.—(1) Health information about an individual that is disclosed under this section may not be used in, or disclosed to any person for use in, any administrative, civil, or criminal action or investigation directed against the individual who is the subject of the information unless the action or investigation arises out of and is directly related to receipt of health care or payment for health care or action involving a fraudulent claim related to health; or if authorized by an appropriate order of a court of competent jurisdiction, granted after application showing good cause therefor.
Safeguarding and dissemination controls
NARA registry control evidence: status Specified; banner marking CUI//SP-HLTH.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: (e) L IMITATION ONUSE.—(1) Health information about an individual that is disclosed under this section may not be used in, or disclosed to any person for use in, any administrative, civil, or criminal action or investigation directed against the individual who is the subject of the information unless the action or investigation arises out of and is directly related to receipt of health care or payment for health care or action involving a fraudulent claim related to health; or if authorized by an appropriate order of a court of competent jurisdiction, granted after application showing good cause therefor.
Extracted authority control: (3) Upon the granting of such order, the court, in determining the extent to which any disclo- sure of all or any part of any record is nec- essary, shall impose appropriate safeguards against unauthorized disclosure.
Extracted authority control: (C) A subpoena issued under subparagraph (A) with respect to a provider of electronic commu- nication service or remote computing service, in an investigation of a Federal offense involving the sexual exploitation or abuse of children shall not extend beyond— (i) requiring that provider to disclose the in- formation specified in section 2703(c)(2), which may be relevant to an authorized law enforce- ment inquiry; or (ii) requiring a custodian of the records of that provider to give testimony concerning the production and authentication of such records or information.
Extracted authority control: (1) read as fol- lows: ‘‘In any investigation relating to any act or ac- tivity involving a Federal health care offense, or any act or activity involving a Federal offense relating to the sexual exploitation or other abuse of children, the Attorney General or the Attorney General’s designee may issue in writing and cause to be served a sub- poena— ‘‘(A) requiring the production of any records (in- cluding any books, papers, documents, electronic media, or other objects or tangible things), which may be relevant to an authorized law enforcement in- quiry, that a person or legal entity may possess or have care, custody, or control; or ‘‘(B) requiring a custodian of records to give testi- mony concerning the production and authentication of such records.’’ Subsec.
Extracted authority control: L. 105–314 substituted ‘‘Administrative subpoenas in Federal health care investigations’’ for ‘‘Authorized investigative demand procedures’’ in sec- tion catchline.
Extracted authority control: (d) I MMUNITYFROMCIVILLIABILITY.—Notwith- standing any Federal, State, or local law, any person, including officers, agents, and employ- ees, receiving a subpoena under this section, who complies in good faith with the subpoena and thus produces the materials sought, shall not be liable in any court of any State or the United States to any customer or other person for such production or for nondisclosure of that production to the customer.
Authority excerpts
Most relevant extracted authority passage
(e) L IMITATION ONUSE.—(1) Health information about an individual that is disclosed under this section may not be used in, or disclosed to any person for use in, any administrative, civil, or criminal action or investigation directed against the individual who is the subject of the information unless the action or investigation arises out of and is directly related to receipt of health care or payment for health care or action involving a fraudulent claim related to health; or if authorized by an appropriate order of a court of competent jurisdiction, granted after application showing good cause therefor.
Extracted authority passage 2
(3) Upon the granting of such order, the court, in determining the extent to which any disclo- sure of all or any part of any record is nec- essary, shall impose appropriate safeguards against unauthorized disclosure.
Extracted authority passage 3
(C) A subpoena issued under subparagraph (A) with respect to a provider of electronic commu- nication service or remote computing service, in an investigation of a Federal offense involving the sexual exploitation or abuse of children shall not extend beyond— (i) requiring that provider to disclose the in- formation specified in section 2703(c)(2), which may be relevant to an authorized law enforce- ment inquiry; or (ii) requiring a custodian of the records of that provider to give testimony concerning the production and authentication of such records or information.
Extracted authority passage 4
(1) read as fol- lows: ‘‘In any investigation relating to any act or ac- tivity involving a Federal health care offense, or any act or activity involving a Federal offense relating to the sexual exploitation or other abuse of children, the Attorney General or the Attorney General’s designee may issue in writing and cause to be served a sub- poena— ‘‘(A) requiring the production of any records (in- cluding any books, papers, documents, electronic media, or other objects or tangible things), which may be relevant to an authorized law enforcement in- quiry, that a person or legal entity may possess or have care, custody, or control; or ‘‘(B) requiring a custodian of records to give testi- mony concerning the production and authentication of such records.’’ Subsec.
Extracted authority passage 5
L. 105–314 substituted ‘‘Administrative subpoenas in Federal health care investigations’’ for ‘‘Authorized investigative demand procedures’’ in sec- tion catchline.
Extracted authority passage 6
L. 108–21 substituted ‘‘the information specified in section 2703(c)(2)’’ for ‘‘the name, address, local and long distance telephone toll billing records, telephone number or other sub- scriber number or identity, and length of service of a subscriber to or customer of such service and the types of services the subscriber or customer utilized’’. 2000—Pub.
18 USC 4247(e)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 18 USC 4247(e). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 18 USC 4247(e) | status: Basic | banner: CUI
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Page 851 TITLE 18—CRIMES AND CRIMINAL PROCEDURE § 4247
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
18 USC 4247(e) | status: Basic | banner: CUI
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: Such videotape record shall be submitted to the court along with the periodic report.
Extracted authority condition: (e) P ERIODICREPORT ANDINFORMATIONRE- QUIREMENTS.—(1) The director of the facility in which a person is committed pursuant to— (A) section 4241 shall prepare semiannual re- ports; or (B) section 4243, 4244, 4245, 4246, or 4248 shall prepare annual reports concerning the mental condition of the person and containing recom- mendations concerning the need for his con- tinued commitment.
Extracted authority condition: L. 105–33, title XI, § 11721, Aug. 5, 1997, 111 Stat. 786, provided that: ‘‘Except as otherwise provided in this title [enacting section 138 of former Title 40, Pub- lic Buildings, Property, and Works, amending this sec- tion, section 4247 of this title, section 1063 of Title 20, Education, section 225b of Title 24, Hospitals and Asy- lums, sections 6103 and 7213 of Title 26, Internal Reve- nue Code, sections 715 and 6501 of Title 31, Money and Finance, sections 71f and 138 of former Title 40, and sec- tions 13723 and 14407 of Title 42, The Public Health and Welfare, enacting provisions set out as a note under section 6103 of Title 26, and amending provisions set out as a note under section 4201 of this title], the provisions of this title shall take effect on the later of October 1, 1997, or the day the District of Columbia Financial Re- sponsibility and Management Assistance Authority certifies that the financial plan and budget for the Dis- trict government for fiscal year 1998 meet the require- ments of section 201(c)(1) of the District of Columbia Financial Responsibility and Management Assistance Act of 1995 [Pub.
Extracted authority condition: (c) P SYCHIATRIC ORPSYCHOLOGICALREPORTS.— A psychiatric or psychological report ordered pursuant to this chapter shall be prepared by the examiner designated to conduct the psy- chiatric or psychological examination, shall be filed with the court with copies provided to the counsel for the person examined and to the at- torney for the Government, and shall include— (1) the person’s history and present symp- toms; (2) a description of the psychiatric, psycho- logical, and medical tests that were employed and their results; (3) the examiner’s findings; and (4) the examiner’s opinions as to diagnosis, prognosis, and— (A) if the examination is ordered under section 4241, whether the person is suffering from a mental disease or defect rendering him mentally incompetent to the extent that he is unable to understand the nature and consequences of the proceedings against him or to assist properly in his defense; (B) if the examination is ordered under section 4242, whether the person was insane at the time of the offense charged; (C) if the examination is ordered under section 4243 or 4246, whether the person is suffering from a mental disease or defect as a result of which his release would create a substantial risk of bodily injury to another person or serious damage to property of an- other; (D) if the examination is ordered under section 4248,...
Extracted authority condition: (C) drug, alcohol, and sex offender treat- ment programs, and other treatment pro- grams that will assist the individual in over- coming a psychological or physical depend- ence or any condition that makes the indi- vidual dangerous to others; and (D) organized physical sports and recre- ation programs; (2) ‘‘suitable facility’’ means a facility that is suitable to provide care or treatment given the nature of the offense and the characteris- tics of the defendant; (3) ‘‘State’’ includes the District of Colum- bia; (4) ‘‘bodily injury’’ includes sexual abuse; (5) ‘‘sexually dangerous person’’ means a person who has engaged or attempted to en- gage in sexually violent conduct or child mo- lestation and who is sexually dangerous to others; and (6) ‘‘sexually dangerous to others’’ with re- spect 1 a person, means that the person suffers from a serious mental illness, abnormality, or disorder as a result of which he would have se- rious difficulty in refraining from sexually violent conduct or child molestation if re- leased.
Extracted authority condition: Except with the prior ap- proval of the court, the Secret Service shall not use or disclose the information in these copies for any purpose other than carrying out protective duties under section 3056(a) of this title.’’ 1984—Pub.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: Except with the prior ap- proval of the court, the Secret Service shall not use or disclose the information in these copies for any purpose other than carrying out protective duties under section 3056(a) of this title.’’ 1984—Pub.
Extracted authority control: L. 105–33, title XI, § 11721, Aug. 5, 1997, 111 Stat. 786, provided that: ‘‘Except as otherwise provided in this title [enacting section 138 of former Title 40, Pub- lic Buildings, Property, and Works, amending this sec- tion, section 4247 of this title, section 1063 of Title 20, Education, section 225b of Title 24, Hospitals and Asy- lums, sections 6103 and 7213 of Title 26, Internal Reve- nue Code, sections 715 and 6501 of Title 31, Money and Finance, sections 71f and 138 of former Title 40, and sec- tions 13723 and 14407 of Title 42, The Public Health and Welfare, enacting provisions set out as a note under section 6103 of Title 26, and amending provisions set out as a note under section 4201 of this title], the provisions of this title shall take effect on the later of October 1, 1997, or the day the District of Columbia Financial Re- sponsibility and Management Assistance Authority certifies that the financial plan and budget for the Dis- trict government for fiscal year 1998 meet the require- ments of section 201(c)(1) of the District of Columbia Financial Responsibility and Management Assistance Act of 1995 [Pub.
Extracted authority control: Except with the prior approval of the court, the Se- cret Service shall not use or disclose the infor- mation in these copies for any purpose other than carrying out protective duties under sec- tion 3056(a) of this title.
Extracted authority control: The court shall order the discharge of the person or, on motion of the attorney for the Government or on its own motion, shall hold a hearing, conducted pursuant to the provisions of section 4247(d), to determine whether he should be released.
Extracted authority control: If, after the hearing, the court finds by a preponderance of the evidence that the person has recovered from his mental disease or defect to such an extent that— (1) his release would no longer create a sub- stantial risk of bodily injury to another per- son or serious damage to property of another, the court shall order that he be immediately discharged; or (2) his conditional release under a prescribed regimen of medical, psychiatric, or psycho- logical care or treatment would no longer cre- ate a substantial risk of bodily injury to an- other person or serious damage to property of another, the court shall— (A) order that he be conditionally dis- charged under a prescribed regimen of medi- cal, psychiatric, or psychological care or treatment that has been prepared for him, that has been certified to the court as appro- priate by the director of the facility in which he is committed, and that has been found by the court to be appropriate; and (B) order, as an explicit condition of re- lease, that he comply with the prescribed regimen of medical, psychiatric, or psycho- logical care or treatment.
Extracted authority control: (i) A UTHORITY ANDRESPONSIBILITY OF THEAT- TORNEYGENERAL.—The Attorney General— (A) may contract with a State, a political subdivision, a locality, or a private agency for the confinement, hospitalization, care, or treatment of, or the provision of services to, a person committed to his custody pursuant to this chapter; (B) may apply for the civil commitment, pursuant to State law, of a person committed to his custody pursuant to section 4243, 4246, or 4248; (C) shall, before placing a person in a facility pursuant to the provisions of section 4241, 4243, 4244, 4245, 4246, or 4248, consider the suitability of the facility’s rehabilitation programs in meeting the needs of the person; and (D) shall consult with the Secretary of the Department of Health and Human Services in the general implementation of the provisions of this chapter and in the establishment of standards for facilities used in the implemen- tation of this chapter.
Extracted authority control: Civil commitment of a sexually dangerous person (a) I NSTITUTION OFPROCEEDINGS.—In relation to a person who is in the custody of the Bureau of Prisons, or who has been committed to the custody of the Attorney General pursuant to section 4241(d), or against whom all criminal charges have been dismissed solely for reasons relating to the mental condition of the person, the Attorney General or any individual author- ized by the Attorney General or the Director of the Bureau of Prisons may certify that the per- son is a sexually dangerous person, and transmit the certificate to the clerk of the court for the district in which the person is confined.
Authority excerpts
Most relevant extracted authority passage
Except with the prior ap- proval of the court, the Secret Service shall not use or disclose the information in these copies for any purpose other than carrying out protective duties under section 3056(a) of this title.’’ 1984—Pub.
Extracted authority passage 2
L. 105–33, title XI, § 11721, Aug. 5, 1997, 111 Stat. 786, provided that: ‘‘Except as otherwise provided in this title [enacting section 138 of former Title 40, Pub- lic Buildings, Property, and Works, amending this sec- tion, section 4247 of this title, section 1063 of Title 20, Education, section 225b of Title 24, Hospitals and Asy- lums, sections 6103 and 7213 of Title 26, Internal Reve- nue Code, sections 715 and 6501 of Title 31, Money and Finance, sections 71f and 138 of former Title 40, and sec- tions 13723 and 14407 of Title 42, The Public Health and Welfare, enacting provisions set out as a note under section 6103 of Title 26, and amending provisions set out as a note under section 4201 of this title], the provisions of this title shall take effect on the later of October 1, 1997, or the day the District of Columbia Financial Re- sponsibility and Management Assistance Authority certifies that the financial plan and budget for the Dis- trict government for fiscal year 1998 meet the require- ments of section 201(c)(1) of the District of Columbia Financial Responsibility and Management Assistance Act of 1995 [Pub.
Extracted authority passage 3
Except with the prior approval of the court, the Se- cret Service shall not use or disclose the infor- mation in these copies for any purpose other than carrying out protective duties under sec- tion 3056(a) of this title.
Extracted authority passage 4
The court shall order the discharge of the person or, on motion of the attorney for the Government or on its own motion, shall hold a hearing, conducted pursuant to the provisions of section 4247(d), to determine whether he should be released.
Extracted authority passage 5
If, after the hearing, the court finds by a preponderance of the evidence that the person has recovered from his mental disease or defect to such an extent that— (1) his release would no longer create a sub- stantial risk of bodily injury to another per- son or serious damage to property of another, the court shall order that he be immediately discharged; or (2) his conditional release under a prescribed regimen of medical, psychiatric, or psycho- logical care or treatment would no longer cre- ate a substantial risk of bodily injury to an- other person or serious damage to property of another, the court shall— (A) order that he be conditionally dis- charged under a prescribed regimen of medi- cal, psychiatric, or psychological care or treatment that has been prepared for him, that has been certified to the court as appro- priate by the director of the facility in which he is committed, and that has been found by the court to be appropriate; and (B) order, as an explicit condition of re- lease, that he comply with the prescribed regimen of medical, psychiatric, or psycho- logical care or treatment.
Extracted authority passage 6
Such videotape record shall be submitted to the court along with the periodic report.
42 USC 242m(d)
Listed by: NARA Registry, DoD Registry, Related authorities
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Page 139 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 242m
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: L. 95–83, title III, § 315, Aug. 1, 1977, 91 Stat. 398, provided that the Secretary of Health, Education, and Welfare arrange through the National Academy of Sci- ences or other nonprofit private groups or associations, for a study to determine opportunities for broadened Federal program activities in areas of international health, which study was to consider biomedical and be- havioral research, health services research, health pro- fessions education, immunization and public health ac- tivities, and other areas that might improve our and other nations’ capacities to prevent, diagnose, control, or cure disease, and to organize and deliver effective and efficient health services, with an interim report on such study completed no later than Oct. 1, 1977 and a final report completed no later than Jan. 1, 1978 and both reports submitted to the Secretary, the Commit- tee on Human Resources of the Senate, and the Com- mittee on Interstate and Foreign Commerce of the House of Representatives. § 242m.
Extracted authority condition: L. 100–177, title I, § 106(c), Dec. 1, 1987, 101 Stat. 989, provided that: ‘‘The amendments made by sub- sections (a) and (b) [amending this section and section 242p of this title] shall apply to reports and profiles re- quired to be submitted after November 1, 1987.’’ M INEWORKERSSTUDY; REPORTCOMPLETED ANDSUB- MITTEDNOLATERTHAN30 MONTHSAFTERNOVEM- BER9, 1978 Pub.
Extracted authority condition: (d) Information; publication restrictions No information, if an establishment or person supplying the information or described in it is identifiable, obtained in the course of activities undertaken or supported under section 242b, 242k, or 242l of this title may be used for any purpose other than the purpose for which it was supplied unless such establishment or person has consented (as determined under regulations of the Secretary) to its use for such other pur- pose; and in the case of information obtained in the course of health statistical or epidemiolog- ical activities under section 242b or 242k of this title, such information may not be published or released in other form if the particular estab- lishment or person supplying the information or described in it is identifiable unless such estab- lishment or person has consented (as determined under regulations of the Secretary) to its publi- cation or release in other form.
Extracted authority condition: L. 101–239, § 6103(e)(4)(D), substituted ‘‘section 242b, 242k, or 242l of this title’’ for ‘‘section 242b, 242c, 242k, 242l, or 242n of this title’’, struck out ‘‘(1)’’ after ‘‘for such other purpose; and’’, and sub- stituted ‘‘publication or release in other form.’’ for ‘‘publication or release in other form, and (2) in the case of information obtained in the course of health services research, evaluations, or demonstrations under section 242b or 242c of this title or in the course of health care technology activities under section 242n of this title, such information may not be published or re- leased in other form if the person who supplied the in- formation or who is described in it is identifiable un- less such person has consented (as determined under regulations of the Secretary) to its publication or re- lease in other form.’’ Subsec.
Extracted authority condition: Health conferences; publication of health educational information (a) A conference of the health authorities in and among the several States shall be called an- nually by the Secretary.
Extracted authority condition: (b) From time to time the Secretary shall issue information related to public health, in the form of publications or otherwise, for the use of the public, and shall publish weekly re- ports of health conditions in the United States and other countries and other pertinent health information for the use of persons and institu- tions concerned with health services.
Safeguarding and dissemination controls
NARA registry control evidence: status Specified; banner marking CUI//SP-HLTH.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: (d) Information; publication restrictions No information, if an establishment or person supplying the information or described in it is identifiable, obtained in the course of activities undertaken or supported under section 242b, 242k, or 242l of this title may be used for any purpose other than the purpose for which it was supplied unless such establishment or person has consented (as determined under regulations of the Secretary) to its use for such other pur- pose; and in the case of information obtained in the course of health statistical or epidemiolog- ical activities under section 242b or 242k of this title, such information may not be published or released in other form if the particular estab- lishment or person supplying the information or described in it is identifiable unless such estab- lishment or person has consented (as determined under regulations of the Secretary) to its publi- cation or release in other form.
Extracted authority control: L. 93–353, title I, § 107(b), July 23, 1974, 88 Stat. 371, provided that: ‘‘The authorizations of appropria- tions provided by section 308(i) of the Public Health Service Act [42 U.S.C. 242m(i)] is extended for the fiscal year ending June 30, 1977, in the amounts authorized for the preceding fiscal year unless before June 30, 1976, Congress has passed legislation repealing this sub- section.’’ § 242n.
Extracted authority control: (c) Development and dissemination of statistics The Secretary shall take such action as may be necessary to assure that statistics developed under sections 242b and 242k of this title are of high quality, timely, comprehensive as well as specific, standardized, and adequately analyzed and indexed, and shall publish, make available, and disseminate such statistics on as wide a basis as is practicable.
Extracted authority control: L. 101–239, § 6103(e)(4)(G)(i), struck out at end ‘‘Except as provided in subsection (d) of this section, the Secretary may not restrict the publication and dissemination of data from, and results of projects undertaken by, centers supported under section 242c(d) of this title.’’ Subsec.
Authority excerpts
Most relevant extracted authority passage
(d) Information; publication restrictions No information, if an establishment or person supplying the information or described in it is identifiable, obtained in the course of activities undertaken or supported under section 242b, 242k, or 242l of this title may be used for any purpose other than the purpose for which it was supplied unless such establishment or person has consented (as determined under regulations of the Secretary) to its use for such other pur- pose; and in the case of information obtained in the course of health statistical or epidemiolog- ical activities under section 242b or 242k of this title, such information may not be published or released in other form if the particular estab- lishment or person supplying the information or described in it is identifiable unless such estab- lishment or person has consented (as determined under regulations of the Secretary) to its publi- cation or release in other form.
Extracted authority passage 3
L. 93–353, title I, § 107(b), July 23, 1974, 88 Stat. 371, provided that: ‘‘The authorizations of appropria- tions provided by section 308(i) of the Public Health Service Act [42 U.S.C. 242m(i)] is extended for the fiscal year ending June 30, 1977, in the amounts authorized for the preceding fiscal year unless before June 30, 1976, Congress has passed legislation repealing this sub- section.’’ § 242n.
Extracted authority passage 4
(c) Development and dissemination of statistics The Secretary shall take such action as may be necessary to assure that statistics developed under sections 242b and 242k of this title are of high quality, timely, comprehensive as well as specific, standardized, and adequately analyzed and indexed, and shall publish, make available, and disseminate such statistics on as wide a basis as is practicable.
Extracted authority passage 5
L. 101–239, § 6103(e)(4)(G)(i), struck out at end ‘‘Except as provided in subsection (d) of this section, the Secretary may not restrict the publication and dissemination of data from, and results of projects undertaken by, centers supported under section 242c(d) of this title.’’ Subsec.
Extracted authority passage 6
L. 95–83, title III, § 315, Aug. 1, 1977, 91 Stat. 398, provided that the Secretary of Health, Education, and Welfare arrange through the National Academy of Sci- ences or other nonprofit private groups or associations, for a study to determine opportunities for broadened Federal program activities in areas of international health, which study was to consider biomedical and be- havioral research, health services research, health pro- fessions education, immunization and public health ac- tivities, and other areas that might improve our and other nations’ capacities to prevent, diagnose, control, or cure disease, and to organize and deliver effective and efficient health services, with an interim report on such study completed no later than Oct. 1, 1977 and a final report completed no later than Jan. 1, 1978 and both reports submitted to the Secretary, the Commit- tee on Human Resources of the Senate, and the Com- mittee on Interstate and Foreign Commerce of the House of Representatives. § 242m.
38 USC 7332(a)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 38 USC 7332(a). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 38 USC 7332(a) | status: Basic | banner: CUI | sanctions: 38 USC 5705
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Page 951 TITLE 38—VETERANS’ BENEFITS § 7332
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: Page 952 TITLE 38—VETERANS’ BENEFITS § 7332 (C)(i) In the case of any record which is maintained in connection with the perform- ance of any program or activity relating to in- fection with the human immunodeficiency virus, to a Federal, State, or local public- health authority charged under Federal or State law with the protection of the public health, and to which Federal or State law re- quires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law.
Extracted authority condition: (f)(1) Notwithstanding subsection (a) but sub- ject to paragraph (2), a physician or a profes- sional counselor may disclose information or records indicating that a patient or subject is infected with the human immunodeficiency virus if the disclosure is made to (A) the spouse of the patient or subject, or (B) to an individual whom the patient or subject has, during the process of professional counseling or of testing to determine whether the patient or subject is infected with such virus, identified as being a sexual partner of such patient or subject.
Extracted authority condition: Confidentiality of certain medical records (a)(1) Records of the identity, diagnosis, prog- nosis, or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (includ- ing education, training, treatment, rehabilita- tion, or research) relating to drug abuse, alco- holism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia which is carried out by or for the De- partment under this title shall, except as pro- vided in subsections (e) and (f), be confidential, and (section 5701 of this title to the contrary notwithstanding) such records may be disclosed only for the purposes and under the circum- stances expressly authorized under subsection (b).
Extracted authority condition: (2) An evaluation of the effectiveness of the Veterans Health Administration in improving the quality of health care provided to veter- ans, without increasing the costs incurred for such health care by the Federal Government or veterans, including relevant information for each medical center and Veterans Inte- grated Service Network of the Department set forth separately.
Extracted authority condition: (e) The prohibitions of this section shall not prevent any interchange of records— (1) within and among those components of the Department furnishing health care to vet- erans, or determining eligibility for benefits under this title; or (2) between such components furnishing health care to veterans and the Armed Forces.
Extracted authority condition: Regulations (a) Regulations prescribed by the Secretary under section 7331 of this title, section 7332 of this title with respect to the confidentiality of alcohol and drug abuse medical records, and sec- tion 7333 of this title with respect to alcohol or drug abusers shall, to the maximum extent fea- sible consistent with other provisions of this title, make applicable the regulations described in subsection (b) to the conduct of research and to the provision of hospital care, nursing home care, domiciliary care, and medical services under this title.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: Page 952 TITLE 38—VETERANS’ BENEFITS § 7332 (C)(i) In the case of any record which is maintained in connection with the perform- ance of any program or activity relating to in- fection with the human immunodeficiency virus, to a Federal, State, or local public- health authority charged under Federal or State law with the protection of the public health, and to which Federal or State law re- quires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law.
Extracted authority control: Confidentiality of certain medical records (a)(1) Records of the identity, diagnosis, prog- nosis, or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (includ- ing education, training, treatment, rehabilita- tion, or research) relating to drug abuse, alco- holism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia which is carried out by or for the De- partment under this title shall, except as pro- vided in subsections (e) and (f), be confidential, and (section 5701 of this title to the contrary notwithstanding) such records may be disclosed only for the purposes and under the circum- stances expressly authorized under subsection (b).
Extracted authority control: Regulations (a) Regulations prescribed by the Secretary under section 7331 of this title, section 7332 of this title with respect to the confidentiality of alcohol and drug abuse medical records, and sec- tion 7333 of this title with respect to alcohol or drug abusers shall, to the maximum extent fea- sible consistent with other provisions of this title, make applicable the regulations described in subsection (b) to the conduct of research and to the provision of hospital care, nursing home care, domiciliary care, and medical services under this title.
Extracted authority control: (2)(A) A disclosure under paragraph (1) may be made only if the physician or counselor, after making reasonable efforts to counsel and en- courage the patient or subject to provide the in- formation to the spouse or sexual partner, rea- sonably believes that the patient or subject will not provide the information to the spouse or sexual partner and that the disclosure is nec- essary to protect the health of the spouse or sex- ual partner.
Extracted authority control: Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure.
Extracted authority control: (c) Except as authorized by a court order granted under subsection (b)(2)(D), no record re- ferred to in subsection (a) may be used to initi- ate or substantiate any criminal charges against, or to conduct any investigation of, a pa- tient or subject.
Extracted authority control: (g) Any person who violates any provision of this section or any regulation issued pursuant to this section shall be fined, in the case of a first offense, up to the maximum amount provided under section 5701(f) of this title for a first of- fense under that section and, in the case of a subsequent offense, up to the maximum amount provided under section 5701(f) of this title for a subsequent offense under that section.
Authority excerpts
Most relevant extracted authority passage
Page 952 TITLE 38—VETERANS’ BENEFITS § 7332 (C)(i) In the case of any record which is maintained in connection with the perform- ance of any program or activity relating to in- fection with the human immunodeficiency virus, to a Federal, State, or local public- health authority charged under Federal or State law with the protection of the public health, and to which Federal or State law re- quires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law.
Extracted authority passage 2
Confidentiality of certain medical records (a)(1) Records of the identity, diagnosis, prog- nosis, or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (includ- ing education, training, treatment, rehabilita- tion, or research) relating to drug abuse, alco- holism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia which is carried out by or for the De- partment under this title shall, except as pro- vided in subsections (e) and (f), be confidential, and (section 5701 of this title to the contrary notwithstanding) such records may be disclosed only for the purposes and under the circum- stances expressly authorized under subsection (b).
Extracted authority passage 3
Regulations (a) Regulations prescribed by the Secretary under section 7331 of this title, section 7332 of this title with respect to the confidentiality of alcohol and drug abuse medical records, and sec- tion 7333 of this title with respect to alcohol or drug abusers shall, to the maximum extent fea- sible consistent with other provisions of this title, make applicable the regulations described in subsection (b) to the conduct of research and to the provision of hospital care, nursing home care, domiciliary care, and medical services under this title.
Extracted authority passage 4
(2)(A) A disclosure under paragraph (1) may be made only if the physician or counselor, after making reasonable efforts to counsel and en- courage the patient or subject to provide the in- formation to the spouse or sexual partner, rea- sonably believes that the patient or subject will not provide the information to the spouse or sexual partner and that the disclosure is nec- essary to protect the health of the spouse or sex- ual partner.
Extracted authority passage 5
Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure.
Extracted authority passage 6
(f)(1) Notwithstanding subsection (a) but sub- ject to paragraph (2), a physician or a profes- sional counselor may disclose information or records indicating that a patient or subject is infected with the human immunodeficiency virus if the disclosure is made to (A) the spouse of the patient or subject, or (B) to an individual whom the patient or subject has, during the process of professional counseling or of testing to determine whether the patient or subject is infected with such virus, identified as being a sexual partner of such patient or subject.
38 USC 5705
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 38 USC 5705. DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 38 USC 5705 | status: Basic | banner: CUI | sanctions: 38 USC 5705
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Page 866 TITLE 38—VETERANS’ BENEFITS § 5705
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: Confidentiality of medical quality-assur- ance records (a) Records and documents created by the De- partment as part of a medical quality-assurance program (other than reports submitted pursuant to section 7311(g) 1 of this title) are confidential and privileged and may not be disclosed to any person or entity except as provided in sub- section (b) of this section.
Extracted authority condition: (C) To a criminal or civil law enforcement governmental agency or instrumentality charged under applicable law with the protec- tion of the public health or safety, if a quali- fied representative of such agency or instru- mentality makes a written request that such record or document be provided for a purpose authorized by law.
Extracted authority condition: (2) The name of and other identifying informa- tion regarding any individual patient or em- ployee of the Department, or any other individ- ual associated with the Department for purposes of a medical quality-assurance program, con- tained in a record or document described in sub- section (a) of this section shall be deleted from any record or document before any disclosure made under this subsection if disclosure of such name and identifying information would con- stitute a clearly unwarranted invasion of per- sonal privacy.
Extracted authority condition: (6) Nothing in this section shall be construed as authorizing or requiring withholding from any person or entity the disclosure of statistical information regarding Department health-care programs (including such information as aggre- gate morbidity and mortality rates associated with specific activities at individual Depart- ment health-care facilities) that does not im- plicitly or explicitly identify individual patients or employees of the Department, or individuals who participated in the conduct of a medical quality-assurance review.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: Confidentiality of medical quality-assur- ance records (a) Records and documents created by the De- partment as part of a medical quality-assurance program (other than reports submitted pursuant to section 7311(g) 1 of this title) are confidential and privileged and may not be disclosed to any person or entity except as provided in sub- section (b) of this section.
Extracted authority control: (6) Nothing in this section shall be construed as authorizing or requiring withholding from any person or entity the disclosure of statistical information regarding Department health-care programs (including such information as aggre- gate morbidity and mortality rates associated with specific activities at individual Depart- ment health-care facilities) that does not im- plicitly or explicitly identify individual patients or employees of the Department, or individuals who participated in the conduct of a medical quality-assurance review.
Extracted authority control: (C) To a criminal or civil law enforcement governmental agency or instrumentality charged under applicable law with the protec- tion of the public health or safety, if a quali- fied representative of such agency or instru- mentality makes a written request that such record or document be provided for a purpose authorized by law.
Extracted authority control: (3) No person or entity to whom a record or document has been disclosed under this sub- section shall make further disclosure of such record or document except for a purpose pro- vided in this subsection.
Extracted authority control: (4) Nothing in this section shall be construed as authority to withhold any record or docu- ment from a committee of either House of Con- gress or any joint committee of Congress, if such record or document pertains to any matter within the jurisdiction of such committee or joint committee.
Extracted authority control: (e) Any person who, knowing that a document or record is a document or record described in subsection (a) of this section, willfully discloses such record or document except as provided for in subsection (b) of this section shall be fined not more than $5,000 in the case of a first offense and not more than $20,000 in the case of a subse- quent offense.
Authority excerpts
Most relevant extracted authority passage
Confidentiality of medical quality-assur- ance records (a) Records and documents created by the De- partment as part of a medical quality-assurance program (other than reports submitted pursuant to section 7311(g) 1 of this title) are confidential and privileged and may not be disclosed to any person or entity except as provided in sub- section (b) of this section.
Extracted authority passage 2
(6) Nothing in this section shall be construed as authorizing or requiring withholding from any person or entity the disclosure of statistical information regarding Department health-care programs (including such information as aggre- gate morbidity and mortality rates associated with specific activities at individual Depart- ment health-care facilities) that does not im- plicitly or explicitly identify individual patients or employees of the Department, or individuals who participated in the conduct of a medical quality-assurance review.
Extracted authority passage 3
(C) To a criminal or civil law enforcement governmental agency or instrumentality charged under applicable law with the protec- tion of the public health or safety, if a quali- fied representative of such agency or instru- mentality makes a written request that such record or document be provided for a purpose authorized by law.
Extracted authority passage 4
(3) No person or entity to whom a record or document has been disclosed under this sub- section shall make further disclosure of such record or document except for a purpose pro- vided in this subsection.
Extracted authority passage 5
(4) Nothing in this section shall be construed as authority to withhold any record or docu- ment from a committee of either House of Con- gress or any joint committee of Congress, if such record or document pertains to any matter within the jurisdiction of such committee or joint committee.
Extracted authority passage 6
(2) The name of and other identifying informa- tion regarding any individual patient or em- ployee of the Department, or any other individ- ual associated with the Department for purposes of a medical quality-assurance program, con- tained in a record or document described in sub- section (a) of this section shall be deleted from any record or document before any disclosure made under this subsection if disclosure of such name and identifying information would con- stitute a clearly unwarranted invasion of per- sonal privacy.
Related authority evidence: 42 USC 12112(d) | status: Basic | banner: CUI | sanctions: 42 USC 12188
Extracted authority meaning
None listed
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Specified; banner marking CUI//SP-HLTH.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
42 USC 1320d-2 note(b)(Public Law 104-191, Section 264)
Related authority evidence: 42 USC 1320d-2 note(b)(Public Law 104-191, Section 264) | status: Basic | banner: CUI | sanctions: 42 USC 1320d-5 42 USC 1320d-6(b)
Extracted authority meaning
None listed
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
42 USC 15044(c)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 42 USC 15044(c). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 42 USC 15044(c) | status: Basic | banner: CUI
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Page 7785 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 15044
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
42 USC 15044(c) | status: Basic | banner: CUI
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: (c) Record In this section, the term ‘‘record’’ includes— (1) a report prepared or received by any staff at any location at which services, supports, or other assistance is provided to individuals with developmental disabilities; (2) a report prepared by an agency or staff person charged with investigating reports of incidents of abuse or neglect, injury, or death occurring at such location, that describes such incidents and the steps taken to investigate such incidents; and (3) a discharge planning record.
Extracted authority condition: (c) Disclosure of information For purposes of any periodic audit, report, or evaluation required under this part, the Sec- retary shall not require an entity carrying out a program to disclose the identity of, or any other personally identifiable information related to, any individual requesting assistance under such program.
Extracted authority condition: The comments received in response to the public comment so- licitation notice shall be included in the onsite visit report.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: (b) American Indian consortium Upon application to the Secretary, an Amer- ican Indian consortium established to provide protection and advocacy services under this part, shall receive funding pursuant to section 15042(a)(6) of this title to provide the services.
Extracted authority control: The Protection and Advocacy for Mentally Ill Indi- viduals Act of 1986, referred to in subsec.
Extracted authority control: L. 99–319 was renamed the Protection and Ad- vocacy for Individuals with Mental Illness Act by Pub.
Authority excerpts
Extracted authority passage 3
(b) American Indian consortium Upon application to the Secretary, an Amer- ican Indian consortium established to provide protection and advocacy services under this part, shall receive funding pursuant to section 15042(a)(6) of this title to provide the services.
Extracted authority passage 4
The Protection and Advocacy for Mentally Ill Indi- viduals Act of 1986, referred to in subsec.
Extracted authority passage 5
L. 99–319 was renamed the Protection and Ad- vocacy for Individuals with Mental Illness Act by Pub.
Extracted authority passage 6
(c) Record In this section, the term ‘‘record’’ includes— (1) a report prepared or received by any staff at any location at which services, supports, or other assistance is provided to individuals with developmental disabilities; (2) a report prepared by an agency or staff person charged with investigating reports of incidents of abuse or neglect, injury, or death occurring at such location, that describes such incidents and the steps taken to investigate such incidents; and (3) a discharge planning record.
42 USC 290dd-2(a)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 42 USC 290dd-2(a). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 42 USC 290dd-2(a) | status: Basic | banner: CUI | sanctions: 42 USC 290dd-2(f)
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Page 772 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 290dd–2
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: (h) Application to Department of Veterans Af- fairs The Secretary of Veterans Affairs, acting through the Under Secretary for Health, shall, to the maximum feasible extent consistent with their responsibilities under title 38, prescribe regulations making applicable the regulations prescribed by the Secretary of Health and Human Services under subsection (g) to records maintained in connection with the provision of hospital care, nursing home care, domiciliary care, and medical services under such title 38 to veterans suffering from substance abuse.
Extracted authority condition: Confidentiality of records (a) Requirement Records of the identity, diagnosis, prognosis, or treatment of any patient which are main- tained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treat- ment, rehabilitation, or research, which is con- ducted, regulated, or directly or indirectly as- sisted by any department or agency of the United States shall, except as provided in sub- section (e), be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b).
Extracted authority condition: (e) Nonapplicability The prohibitions of this section do not apply to any interchange of records— (1) within the Uniformed Services or within those components of the Department of Veter- ans Affairs furnishing health care to veterans; or (2) between such components and the Uni- formed Services.
Extracted authority condition: (2) Method for disclosure Whether or not the patient, with respect to whom any given record referred to in sub- section (a) is maintained, gives written con- sent, the content of such record may be dis- closed as follows: (A) To medical personnel to the extent necessary to meet a bona fide medical emer- gency.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: Confidentiality of records (a) Requirement Records of the identity, diagnosis, prognosis, or treatment of any patient which are main- tained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treat- ment, rehabilitation, or research, which is con- ducted, regulated, or directly or indirectly as- sisted by any department or agency of the United States shall, except as provided in sub- section (e), be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b).
Extracted authority control: Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appro- priate safeguards against unauthorized dis- closure.
Extracted authority control: (c) Use of records in criminal proceedings Except as authorized by a court order granted under subsection (b)(2)(C), no record referred to in subsection (a) may be used to initiate or sub- stantiate any criminal charges against a patient or to conduct any investigation of a patient.
Extracted authority control: L. 102–321 amended section generally, substitut- ing provisions relating to confidentiality of records for provisions relating to admission of alcohol abusers and alcoholics to general hospitals and outpatient facili- ties. 1983—Pub.
Extracted authority control: (f) Penalties Any person who violates any provision of this section or any regulation issued pursuant to this section shall be fined in accordance with title 18.
Authority excerpts
Most relevant extracted authority passage
Confidentiality of records (a) Requirement Records of the identity, diagnosis, prognosis, or treatment of any patient which are main- tained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treat- ment, rehabilitation, or research, which is con- ducted, regulated, or directly or indirectly as- sisted by any department or agency of the United States shall, except as provided in sub- section (e), be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b).
Extracted authority passage 2
Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appro- priate safeguards against unauthorized dis- closure.
Extracted authority passage 3
(c) Use of records in criminal proceedings Except as authorized by a court order granted under subsection (b)(2)(C), no record referred to in subsection (a) may be used to initiate or sub- stantiate any criminal charges against a patient or to conduct any investigation of a patient.
Extracted authority passage 4
L. 102–321 amended section generally, substitut- ing provisions relating to confidentiality of records for provisions relating to admission of alcohol abusers and alcoholics to general hospitals and outpatient facili- ties. 1983—Pub.
Extracted authority passage 6
(h) Application to Department of Veterans Af- fairs The Secretary of Veterans Affairs, acting through the Under Secretary for Health, shall, to the maximum feasible extent consistent with their responsibilities under title 38, prescribe regulations making applicable the regulations prescribed by the Secretary of Health and Human Services under subsection (g) to records maintained in connection with the provision of hospital care, nursing home care, domiciliary care, and medical services under such title 38 to veterans suffering from substance abuse.
Related authority evidence: 5 CFR 293, Subpart E (293.501, 293.504. 293. 505) | status: Basic (provisional) | banner: CUI
Extracted authority meaning
None listed
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
5 CFR 293, Subpart E (293.501, 293.504. 293. 505) | status: Basic (provisional) | banner: CUI
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic (provisional); banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
(see also 5 CFR 293.106 and 5 CFR 297.401 already on Registry
Listed by: NARA Registry, Related authorities
Designation evidence
NARA authority row: (see also 5 CFR 293.106 and 5 CFR 297.401 already on Registry | status: Specified Basic | banner: under "Personnel Records" under "General Privacy".
Related authority evidence: (see also 5 CFR 293.106 and 5 CFR 297.401 already on Registry | status: Specified Basic | banner: under "Personnel Records" under "General Privacy"
Extracted authority meaning
None listed
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
(see also 5 CFR 293.106 and 5 CFR 297.401 already on Registry | status: Specified Basic | banner: under "Personnel Records" under "General Privacy"
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Specified Basic; banner marking under "Personnel Records" under "General Privacy".
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Specified; banner marking CUI//SP-HLTH.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Specified; banner marking CUI//SP-HLTH.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
42 CFR 2.1(a)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 42 CFR 2.1(a). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 42 CFR 2.1(a) | status: Basic | banner: CUI | sanctions: 42 CFR 2.1(f)
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
SUBCHAPTER A—GENERAL PROVISIONS
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: (a) Disclosure authorization Records of the identity, diagnosis, prog- nosis, or treatment of any patient which are maintained in connection with the perform- ance of any drug abuse prevention function conducted, regulated, or directly or indi- rectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confiden- tial and be disclosed only for the purposes and under the circumstances expressly au- thorized under subsection (b) of this section.
Extracted authority condition: (e) Armed Forces and Veterans’ Administra- tion; interchange of records; report of suspected child abuse and neglect to State or local au- thorities The prohibitions of this section do not apply to any interchange of records— (1) within the Armed Forces or witrhin those components of the Veterans’ Adminis- tration furnishing health care to veterans, or (2) between such components and the Armed Forces.
Extracted authority condition: 2.65 Procedures and criteria for orders au- thorizing disclosure and use of records to criminally investigate or prosecute pa- tients.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: Upon the granting of such order, the court, in determining the ex- tent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure.
Extracted authority control: (c) Prohibition against use of record in mak- ing criminal charges or investigation of patient Except as authorized by a court order granted under subsection (b)(2)(C) of this sec- tion, no record referred to in subsection (a) of this section may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient.
Extracted authority control: (g) Regulations; interagency consultations; definitions, safeguards, and procedures, includ- ing procedures and criteria for issuance and scope of orders Except as provided in subsection (h) of this section, the Secretary, after consultation with the Administrator of Veterans’ Affairs and the heads of other Federal departments and agencies substantially affected thereby, shall prescribe regulations to carry out the purposes of this section.
Extracted authority control: The restrictions of these regulations upon the disclosure and use of alcohol
Extracted authority control: (f) Penalty for first and subsequent offenses Any person who violates any provision of this section or any regulation issued pursu- ant to this section shall be fined not more than $500 in the case of a first offense, and not nore than $5,000 in the case of each sub- sequent offense.
Extracted authority control: 2.35 Disclosures to elements of the criminal justice system which have referred pa- tients.
Authority excerpts
Extracted authority passage 2
Upon the granting of such order, the court, in determining the ex- tent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure.
Extracted authority passage 3
(c) Prohibition against use of record in mak- ing criminal charges or investigation of patient Except as authorized by a court order granted under subsection (b)(2)(C) of this sec- tion, no record referred to in subsection (a) of this section may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient.
Extracted authority passage 4
(g) Regulations; interagency consultations; definitions, safeguards, and procedures, includ- ing procedures and criteria for issuance and scope of orders Except as provided in subsection (h) of this section, the Secretary, after consultation with the Administrator of Veterans’ Affairs and the heads of other Federal departments and agencies substantially affected thereby, shall prescribe regulations to carry out the purposes of this section.
Extracted authority passage 5
The restrictions of these regulations upon the disclosure and use of alcohol
Extracted authority passage 6
(a) Disclosure authorization Records of the identity, diagnosis, prog- nosis, or treatment of any patient which are maintained in connection with the perform- ance of any drug abuse prevention function conducted, regulated, or directly or indi- rectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confiden- tial and be disclosed only for the purposes and under the circumstances expressly au- thorized under subsection (b) of this section.
42 CFR 2.12(a)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 42 CFR 2.12(a). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 42 CFR 2.12(a) | status: Basic | banner: CUI | sanctions: 42 CFR 2.1(f)
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
purpose of the regulations in this part,
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: The restriction on use of information to initiate or substantiate any criminal charges against a patient or to conduct any criminal investigation of a patient (42 U.S.C. 290dd–2(c)) applies to any infor- mation, whether or not recorded, which is drug abuse information obtained by a federally assisted drug abuse program after March 20, 1972 (part 2 program), or is alcohol abuse information ob- tained by a federally assisted alcohol abuse program after May 13, 1974 (part 2 program); or if obtained before the pertinent date, is maintained by a part 2 program after that date as part of an ongoing treatment episode which ex- tends past that date; for the purpose of treating a substance use disorder, mak- ing a diagnosis for the treatment, or making a referral for the treatment.
Extracted authority condition: The restrictions on dis- closure in the regulations in this part apply to: (A) Third-party payers with regard to records disclosed to them by part 2 pro- grams or under § 2.31(a)(4)(iii)(A); (B) Entities having direct adminis- trative control over part 2 programs with regard to information that is sub- ject to the regulations in this part communicated to them by the part 2 program under paragraph (c)(3) of this section; and (C) Individuals or entities who re- ceive patient records directly from a part 2 program or other lawful holder of patient identifying information and who are notified of the prohibition on re-disclosure in accordance with § 2.32.
Extracted authority condition: For ex- ample, if a federal court placed an indi- vidual in a private for-profit program and made a payment to the program on behalf of that individual, that patient’s record would not be covered by the reg- ulations in this part unless the pro- gram itself received federal assistance as defined by paragraph (b) of this sec- tion.
Extracted authority condition: The restriction on the use of any information subject to the regula- tions in this part to initiate or sub- stantiate any criminal charges against a patient or to conduct any criminal investigation of a patient applies to any person who obtains that informa- tion from a part 2 program, regardless of the status of the person obtaining the information or whether the infor- mation was obtained in accordance with the regulations in this part.
Extracted authority condition: The restrictions on disclosure and use in the regulations in this part apply whether or not the part 2 program or other lawful holder of the patient iden- tifying information believes that the person seeking the information already has it, has other means of obtaining it, is a law enforcement agency or official or other government official, has ob- tained a subpoena, or asserts any other justification for a disclosure or use which is not permitted by the regula- tions in this part.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: The following are not cov- ered by the regulations in this part: (i) Diagnosis which is made solely for the purpose of providing evidence for use by law enforcement agencies or of- ficials; or (ii) A diagnosis of drug overdose or alcohol intoxication which clearly shows that the individual involved does not have a substance use disorder (e.g., involuntary ingestion of alcohol or drugs or reaction to a prescribed dos- age of one or more drugs). § 2.13 Confidentiality restrictions and safeguards.
Extracted authority control: Information obtained by under- cover agents or informants (see § 2.17) or through patient access (see § 2.23) is subject to the restriction on use.
Extracted authority control: The restrictions on disclosure in the regulations in this part apply to any information, whether or not re- corded, which: (i) Would identify a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person; and (ii) Is drug abuse information ob- tained by a federally assisted drug abuse program after March 20, 1972 (part 2 program), or is alcohol abuse in- formation obtained by a federally as- sisted alcohol abuse program after May 13, 1974 (part 2 program); or if obtained before the pertinent date, is main- tained by a part 2 program after that date as part of an ongoing treatment episode which extends past that date; for the purpose of treating a substance use disorder, making a diagnosis for that treatment, or making a referral for that treatment.
Extracted authority control: The restrictions on disclosure in the regula- tions in this part do not apply to com- munications between a part 2 program and a qualified service organization of information needed by the qualified service organization to provide services to the program.
Extracted authority control: The restrictions on dis- closure in the regulations in this part apply to: (A) Third-party payers with regard to records disclosed to them by part 2 pro- grams or under § 2.31(a)(4)(iii)(A); (B) Entities having direct adminis- trative control over part 2 programs with regard to information that is sub- ject to the regulations in this part communicated to them by the part 2 program under paragraph (c)(3) of this section; and (C) Individuals or entities who re- ceive patient records directly from a part 2 program or other lawful holder of patient identifying information and who are notified of the prohibition on re-disclosure in accordance with § 2.32.
Extracted authority control: The patient records sub- ject to the regulations in this part may be disclosed or used only as permitted by the regulations in this part and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any federal, state, or local authority.
Extracted authority control: I (10–1–18 Edition) § 2.12 and use for civil or criminal pro- ceedings which may arise out of the re- port of suspected child abuse and ne- glect.
Authority excerpts
Most relevant extracted authority passage
The following are not cov- ered by the regulations in this part: (i) Diagnosis which is made solely for the purpose of providing evidence for use by law enforcement agencies or of- ficials; or (ii) A diagnosis of drug overdose or alcohol intoxication which clearly shows that the individual involved does not have a substance use disorder (e.g., involuntary ingestion of alcohol or drugs or reaction to a prescribed dos- age of one or more drugs). § 2.13 Confidentiality restrictions and safeguards.
Extracted authority passage 2
Information obtained by under- cover agents or informants (see § 2.17) or through patient access (see § 2.23) is subject to the restriction on use.
Extracted authority passage 3
The restrictions on disclosure in the regulations in this part apply to any information, whether or not re- corded, which: (i) Would identify a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person; and (ii) Is drug abuse information ob- tained by a federally assisted drug abuse program after March 20, 1972 (part 2 program), or is alcohol abuse in- formation obtained by a federally as- sisted alcohol abuse program after May 13, 1974 (part 2 program); or if obtained before the pertinent date, is main- tained by a part 2 program after that date as part of an ongoing treatment episode which extends past that date; for the purpose of treating a substance use disorder, making a diagnosis for that treatment, or making a referral for that treatment.
Extracted authority passage 4
The restrictions on disclosure in the regula- tions in this part do not apply to com- munications between a part 2 program and a qualified service organization of information needed by the qualified service organization to provide services to the program.
Extracted authority passage 5
The restrictions on dis- closure in the regulations in this part apply to: (A) Third-party payers with regard to records disclosed to them by part 2 pro- grams or under § 2.31(a)(4)(iii)(A); (B) Entities having direct adminis- trative control over part 2 programs with regard to information that is sub- ject to the regulations in this part communicated to them by the part 2 program under paragraph (c)(3) of this section; and (C) Individuals or entities who re- ceive patient records directly from a part 2 program or other lawful holder of patient identifying information and who are notified of the prohibition on re-disclosure in accordance with § 2.32.
Extracted authority passage 6
The restriction on use of information to initiate or substantiate any criminal charges against a patient or to conduct any criminal investigation of a patient (42 U.S.C. 290dd–2(c)) applies to any infor- mation, whether or not recorded, which is drug abuse information obtained by a federally assisted drug abuse program after March 20, 1972 (part 2 program), or is alcohol abuse information ob- tained by a federally assisted alcohol abuse program after May 13, 1974 (part 2 program); or if obtained before the pertinent date, is maintained by a part 2 program after that date as part of an ongoing treatment episode which ex- tends past that date; for the purpose of treating a substance use disorder, mak- ing a diagnosis for the treatment, or making a referral for the treatment.
42 CFR 2.13(c)
Listed by: NARA Registry, DoD Registry, Related authorities
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
erage. These regulations cover any
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: An inquiring party may be provided a copy of the regula- tions in this part and advised that they restrict the disclosure of substance use disorder patient records, but may not be told affirmatively that the regula- tions restrict the disclosure of the records of an identified patient.
Extracted authority condition: The restrictions on disclosure and use in the regulations in this part apply whether or not the part 2 program or other lawful holder of the patient iden- tifying information believes that the person seeking the information already has it, has other means of obtaining it, is a law enforcement agency or official or other government official, has ob- tained a subpoena, or asserts any other justification for a disclosure or use which is not permitted by the regula- tions in this part.
Extracted authority condition: The patient records sub- ject to the regulations in this part may be disclosed or used only as permitted by the regulations in this part and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any federal, state, or local authority.
Extracted authority condition: (2) Any answer to a request for a dis- closure of patient records which is not permissible under the regulations in this part must be made in a way that will not affirmatively reveal that an identified individual has been, or is being, diagnosed or treated for a sub- stance use disorder.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI//SP-HLTH.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: The following are not cov- ered by the regulations in this part: (i) Diagnosis which is made solely for the purpose of providing evidence for use by law enforcement agencies or of- ficials; or (ii) A diagnosis of drug overdose or alcohol intoxication which clearly shows that the individual involved does not have a substance use disorder (e.g., involuntary ingestion of alcohol or drugs or reaction to a prescribed dos- age of one or more drugs). § 2.13 Confidentiality restrictions and safeguards.
Extracted authority control: Any disclosure made under the regula- tions in this part must be limited to that information which is necessary to carry out the purpose of the disclosure.
Extracted authority control: The restrictions on disclosure and use in the regulations in this part apply whether or not the part 2 program or other lawful holder of the patient iden- tifying information believes that the person seeking the information already has it, has other means of obtaining it, is a law enforcement agency or official or other government official, has ob- tained a subpoena, or asserts any other justification for a disclosure or use which is not permitted by the regula- tions in this part.
Extracted authority control: (1) Under this paragraph (d), patient requests: (i) Must be made in writing; and (ii) Are limited to disclosures made within the past two years; (2) Under this paragraph (d), the enti- ty named on the consent form that dis- closes information pursuant to a pa- tient’s general designation (the entity that serves as an intermediary, as de- scribed in § 2.31(a)(4)(iii)(B)) must: (i) Respond in 30 or fewer days of re- ceipt of the written request; and (ii) Provide, for each disclosure, the name(s) of the entity(-ies) to which the disclosure was made, the date of the disclosure, and a brief description of
Extracted authority control: This restriction in- cludes, but is not limited to, any dis- closure of patient identifying informa- tion to the parent or guardian of a minor patient for the purpose of ob- taining financial reimbursement.
Extracted authority control: The patient records sub- ject to the regulations in this part may be disclosed or used only as permitted by the regulations in this part and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any federal, state, or local authority.
Authority excerpts
Most relevant extracted authority passage
The following are not cov- ered by the regulations in this part: (i) Diagnosis which is made solely for the purpose of providing evidence for use by law enforcement agencies or of- ficials; or (ii) A diagnosis of drug overdose or alcohol intoxication which clearly shows that the individual involved does not have a substance use disorder (e.g., involuntary ingestion of alcohol or drugs or reaction to a prescribed dos- age of one or more drugs). § 2.13 Confidentiality restrictions and safeguards.
Extracted authority passage 2
Any disclosure made under the regula- tions in this part must be limited to that information which is necessary to carry out the purpose of the disclosure.
Extracted authority passage 3
The restrictions on disclosure and use in the regulations in this part apply whether or not the part 2 program or other lawful holder of the patient iden- tifying information believes that the person seeking the information already has it, has other means of obtaining it, is a law enforcement agency or official or other government official, has ob- tained a subpoena, or asserts any other justification for a disclosure or use which is not permitted by the regula- tions in this part.
Extracted authority passage 4
(1) Under this paragraph (d), patient requests: (i) Must be made in writing; and (ii) Are limited to disclosures made within the past two years; (2) Under this paragraph (d), the enti- ty named on the consent form that dis- closes information pursuant to a pa- tient’s general designation (the entity that serves as an intermediary, as de- scribed in § 2.31(a)(4)(iii)(B)) must: (i) Respond in 30 or fewer days of re- ceipt of the written request; and (ii) Provide, for each disclosure, the name(s) of the entity(-ies) to which the disclosure was made, the date of the disclosure, and a brief description of
Extracted authority passage 5
This restriction in- cludes, but is not limited to, any dis- closure of patient identifying informa- tion to the parent or guardian of a minor patient for the purpose of ob- taining financial reimbursement.
Extracted authority passage 6
An inquiring party may be provided a copy of the regula- tions in this part and advised that they restrict the disclosure of substance use disorder patient records, but may not be told affirmatively that the regula- tions restrict the disclosure of the records of an identified patient.
42 CFR 2.16(a)
Listed by: NARA Registry, DoD Registry, Related authorities
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
to the regulations in this part. If a
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: These formal policies and pro- cedures must address: (1) Paper records, including: (i) Transferring and removing such records; (ii) Destroying such records, includ- ing sanitizing the hard copy media as- sociated with the paper printouts, to render the patient identifying informa- tion non-retrievable; (iii) Maintaining such records in a se- cure room, locked file cabinet, safe, or other similar container, or storage fa- cility when not in use; (iv) Using and accessing workstations, secure rooms, locked file cabinets, safes, or other similar con- tainers, and storage facilities that use or store such information; and (v) Rendering patient identifying in- formation non-identifiable in a manner that creates a very low risk of re-iden- tification (e.g., removing direct identi- fiers).
Extracted authority condition: (2) Electronic records, including: (i) Creating, receiving, maintaining, and transmitting such records; (ii) Destroying such records, includ- ing sanitizing the electronic media on which such records are stored, to render the patient identifying informa- tion non-retrievable; (iii) Using and accessing electronic records or other electronic media con- taining patient identifying informa- tion; and (iv) Rendering the patient identi- fying information non-identifiable in a manner that creates a very low risk of re-identification (e.g., removing direct identifiers).
Extracted authority condition: No information obtained by an under- cover agent or informant, whether or not that undercover agent or inform- ant is placed in a part 2 program pursu- ant to an authorizing court order, may be used to criminally investigate or prosecute any patient. § 2.18 Restrictions on the use of identi- fication cards.
Extracted authority condition: This section does not prohibit a person from requiring patients to use or carry cards or other identification objects on the premises of a part 2 program. § 2.19 Disposition of records by discon- tinued programs.
Safeguarding and dissemination controls
NARA registry control evidence: status Specified; banner marking CUI//SP-HLTH.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: (a) The part 2 program or other law- ful holder of patient identifying infor- mation must have in place formal poli- cies and procedures to reasonably pro- tect against unauthorized uses and dis- closures of patient identifying informa- tion and to protect against reasonably anticipated threats or hazards to the security of patient identifying infor- mation.
Extracted authority control: Except as specifically authorized by a court order granted under § 2.67, no part 2 program may knowingly employ, or en- roll as a patient, any undercover agent or informant.
Extracted authority control: These formal policies and pro- cedures must address: (1) Paper records, including: (i) Transferring and removing such records; (ii) Destroying such records, includ- ing sanitizing the hard copy media as- sociated with the paper printouts, to render the patient identifying informa- tion non-retrievable; (iii) Maintaining such records in a se- cure room, locked file cabinet, safe, or other similar container, or storage fa- cility when not in use; (iv) Using and accessing workstations, secure rooms, locked file cabinets, safes, or other similar con- tainers, and storage facilities that use or store such information; and (v) Rendering patient identifying in- formation non-identifiable in a manner that creates a very low risk of re-iden- tification (e.g., removing direct identi- fiers).
Extracted authority control: (2) Electronic records, including: (i) Creating, receiving, maintaining, and transmitting such records; (ii) Destroying such records, includ- ing sanitizing the electronic media on which such records are stored, to render the patient identifying informa- tion non-retrievable; (iii) Using and accessing electronic records or other electronic media con- taining patient identifying informa- tion; and (iv) Rendering the patient identi- fying information non-identifiable in a manner that creates a very low risk of re-identification (e.g., removing direct identifiers).
Extracted authority control: No information obtained by an under- cover agent or informant, whether or not that undercover agent or inform- ant is placed in a part 2 program pursu- ant to an authorizing court order, may be used to criminally investigate or prosecute any patient. § 2.18 Restrictions on the use of identi- fication cards.
Authority excerpts
Most relevant extracted authority passage
(a) The part 2 program or other law- ful holder of patient identifying infor- mation must have in place formal poli- cies and procedures to reasonably pro- tect against unauthorized uses and dis- closures of patient identifying informa- tion and to protect against reasonably anticipated threats or hazards to the security of patient identifying infor- mation.
Extracted authority passage 2
Except as specifically authorized by a court order granted under § 2.67, no part 2 program may knowingly employ, or en- roll as a patient, any undercover agent or informant.
Extracted authority passage 3
These formal policies and pro- cedures must address: (1) Paper records, including: (i) Transferring and removing such records; (ii) Destroying such records, includ- ing sanitizing the hard copy media as- sociated with the paper printouts, to render the patient identifying informa- tion non-retrievable; (iii) Maintaining such records in a se- cure room, locked file cabinet, safe, or other similar container, or storage fa- cility when not in use; (iv) Using and accessing workstations, secure rooms, locked file cabinets, safes, or other similar con- tainers, and storage facilities that use or store such information; and (v) Rendering patient identifying in- formation non-identifiable in a manner that creates a very low risk of re-iden- tification (e.g., removing direct identi- fiers).
Extracted authority passage 4
(2) Electronic records, including: (i) Creating, receiving, maintaining, and transmitting such records; (ii) Destroying such records, includ- ing sanitizing the electronic media on which such records are stored, to render the patient identifying informa- tion non-retrievable; (iii) Using and accessing electronic records or other electronic media con- taining patient identifying informa- tion; and (iv) Rendering the patient identi- fying information non-identifiable in a manner that creates a very low risk of re-identification (e.g., removing direct identifiers).
Extracted authority passage 5
No information obtained by an under- cover agent or informant, whether or not that undercover agent or inform- ant is placed in a part 2 program pursu- ant to an authorizing court order, may be used to criminally investigate or prosecute any patient. § 2.18 Restrictions on the use of identi- fication cards.
Extracted authority passage 6
This section does not prohibit a person from requiring patients to use or carry cards or other identification objects on the premises of a part 2 program. § 2.19 Disposition of records by discon- tinued programs.
42 CFR 2.2(a)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 42 CFR 2.2(a). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 42 CFR 2.2(a) | status: Basic | banner: CUI | sanctions: 42 CFR 2.2(f)
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
rectly assisted by any department or agency
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: (a) Disclosure authorization Records of the identity, diagnosis, prog- nosis, or treatment of any patient which are maintained in connection with the perform- ance of any drug abuse prevention function conducted, regulated, or directly or indi- rectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confiden- tial and be disclosed only for the purposes and under the circumstances expressly au- thorized under subsection (b) of this section.
Extracted authority condition: CONFIDENTIALITY OF PATIENT RECORDS (a) Disclosure authorization Records of the identity, diagnosis, prog- nosis, or treatment of any patient which are maintained in connection with the perform- ance of any program or activity relating to alcoholism or alcohol abuse education, train- ing, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confidential and be disclosed only for the purposes and under the circumstances ex- pressly authorized under subsection (b) of this section.
Extracted authority condition: (e) Armed Forces and Veterans’ Administra- tion; interchange of records; report of suspected child abuse and neglect to State or local au- thorities The prohibitions of this section do not apply to any interchange of records— (1) within the Armed Forces or witrhin those components of the Veterans’ Adminis- tration furnishing health care to veterans, or (2) between such components and the Armed Forces.
Extracted authority condition: (e) Armed Forces and Veterans’ Administra- tion; interchange of record of suspected child abuse and neglect to State or local authorities The prohibitions of this section do not apply to any interchange of records— (1) within the Armed Forces or within those components of the Veterans’ Adminis- tration furnishing health care to veterans, or (2) between such components and the Armed Forces.
Extracted authority condition: 11 Public Health Service, HHS § 2.2 abuse patient records were initially au- thorized by section 333 of the Com- prehensive Alcohol Abuse and Alco- holism Prevention, Treatment, and Re- habilitation Act of 1970 (42 U.S.C.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: CONFIDENTIALITY OF PATIENT RECORDS (a) Disclosure authorization Records of the identity, diagnosis, prog- nosis, or treatment of any patient which are maintained in connection with the perform- ance of any program or activity relating to alcoholism or alcohol abuse education, train- ing, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confidential and be disclosed only for the purposes and under the circumstances ex- pressly authorized under subsection (b) of this section.
Extracted authority control: Upon the granting of such order, the court, in determining the ex- tent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure.
Extracted authority control: (c) Prohibition against use of record in mak- ing criminal charges or investigation of patient Except as authorized by a court order granted under subsection (b)(2)(C) of this sec- tion, no record referred to in subsection (a) of this section may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient.
Extracted authority control: (g) Regulations; interagency consultations; definitions, safeguards, and procedures, includ- ing procedures and criteria for issuance and scope of orders Except as provided in subsection (h) of this section, the Secretary, after consultation with the Administrator of Veterans’ Affairs and the heads of other Federal departments and agencies substantially affected thereby, shall prescribe regulations to carry out the purposes of this section.
Extracted authority control: The restrictions of these regulations upon the disclosure and use of alcohol
Extracted authority control: (f) Penalty for first and subsequent offenses Any person who violates any provision of this section or any regulation issued pursu- ant to this section shall be fined not more than $500 in the case of a first offense, and not nore than $5,000 in the case of each sub- sequent offense.
Authority excerpts
Most relevant extracted authority passage
CONFIDENTIALITY OF PATIENT RECORDS (a) Disclosure authorization Records of the identity, diagnosis, prog- nosis, or treatment of any patient which are maintained in connection with the perform- ance of any program or activity relating to alcoholism or alcohol abuse education, train- ing, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confidential and be disclosed only for the purposes and under the circumstances ex- pressly authorized under subsection (b) of this section.
Extracted authority passage 2
Upon the granting of such order, the court, in determining the ex- tent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure.
Extracted authority passage 3
(c) Prohibition against use of record in mak- ing criminal charges or investigation of patient Except as authorized by a court order granted under subsection (b)(2)(C) of this sec- tion, no record referred to in subsection (a) of this section may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient.
Extracted authority passage 4
(g) Regulations; interagency consultations; definitions, safeguards, and procedures, includ- ing procedures and criteria for issuance and scope of orders Except as provided in subsection (h) of this section, the Secretary, after consultation with the Administrator of Veterans’ Affairs and the heads of other Federal departments and agencies substantially affected thereby, shall prescribe regulations to carry out the purposes of this section.
Extracted authority passage 5
The restrictions of these regulations upon the disclosure and use of alcohol
Extracted authority passage 6
(a) Disclosure authorization Records of the identity, diagnosis, prog- nosis, or treatment of any patient which are maintained in connection with the perform- ance of any drug abuse prevention function conducted, regulated, or directly or indi- rectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confiden- tial and be disclosed only for the purposes and under the circumstances expressly au- thorized under subsection (b) of this section.
42 CFR 2.21(b)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 42 CFR 2.21(b). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 42 CFR 2.21(b) | status: Basic | banner: CUI | sanctions: 42 CFR 2.2(f)
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
tions in this part (42 U.S.C. 290dd–2)
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: In this written summary, the part 2 program also may include information con- cerning state law and any of the part 2 program’s policies that are not incon- sistent with state and federal law on the subject of confidentiality of sub- stance use disorder patient records.
Extracted authority condition: The written summary of the fed- eral law and regulations must include: (1) A general description of the lim- ited circumstances under which a part 2 program may acknowledge that an individual is present or disclose outside the part 2 program information identi- fying a patient as having or having had a substance use disorder; (2) A statement that violation of the federal law and regulations by a part 2 program is a crime and that suspected violations may be reported to appro- priate authorities consistent with § 2.4, along with contact information; (3) A statement that information re- lated to a patient’s commission of a crime on the premises of the part 2 pro- gram or against personnel of the part 2 program is not protected; (4) A statement that reports of sus- pected child abuse and neglect made under state law to appropriate state or local authorities are not protected; and (5) A citation to the federal law and regulations.
Extracted authority condition: There may be concurrent coverage of patient identifying information by the regulations in this part and by admin- istrative action taken under section 502(c) of the Controlled Substances Act (21 U.S.C. 872(c) and the implementing regulations at 21 CFR part 1316); or sec- tion 301(d) of the Public Health Service Act (42 U.S.C. 241(d) and the imple- menting regulations at 42 CFR part 2a).
Extracted authority condition: At the time of ad- mission to a part 2 program or, in the case that a patient does not have ca- pacity upon admission to understand his or her medical status, as soon thereafter as the patient attains such capacity, each part 2 program shall: (1) Communicate to the patient that federal law and regulations protect the confidentiality of substance use dis- order patient records; and (2) Give to the patient a summary in writing of the federal law and regula- tions.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: At the time of ad- mission to a part 2 program or, in the case that a patient does not have ca- pacity upon admission to understand his or her medical status, as soon thereafter as the patient attains such capacity, each part 2 program shall: (1) Communicate to the patient that federal law and regulations protect the confidentiality of substance use dis- order patient records; and (2) Give to the patient a summary in writing of the federal law and regula- tions.
Extracted authority control: In this written summary, the part 2 program also may include information con- cerning state law and any of the part 2 program’s policies that are not incon- sistent with state and federal law on the subject of confidentiality of sub- stance use disorder patient records.
Extracted authority control: These research privilege statutes con- fer on the Secretary of Health and Human Services and on the Attorney General, respectively, the power to au- thorize researchers conducting certain types of research to withhold from all persons not connected with the re- search the names and other identifying information concerning individuals who are the subjects of the research.
Extracted authority control: These regulations restrict the disclosure and use of information about patients, while administrative action taken under the research privilege statutes and implementing regulations protects a person engaged in applicable research from being compelled to disclose any identifying characteristics of the indi- viduals who are the subjects of that re- search.
Extracted authority control: The written summary of the fed- eral law and regulations must include: (1) A general description of the lim- ited circumstances under which a part 2 program may acknowledge that an individual is present or disclose outside the part 2 program information identi- fying a patient as having or having had a substance use disorder; (2) A statement that violation of the federal law and regulations by a part 2 program is a crime and that suspected violations may be reported to appro- priate authorities consistent with § 2.4, along with contact information; (3) A statement that information re- lated to a patient’s commission of a crime on the premises of the part 2 pro- gram or against personnel of the part 2 program is not protected; (4) A statement that reports of sus- pected child abuse and neglect made under state law to appropriate state or local authorities are not protected; and (5) A citation to the federal law and regulations.
Extracted authority control: If a disclosure per- mitted under the regulations in this part is prohibited under state law, nei- ther the regulations in this part nor the authorizing statute may be con- strued to authorize any violation of that state law.
Authority excerpts
Most relevant extracted authority passage
At the time of ad- mission to a part 2 program or, in the case that a patient does not have ca- pacity upon admission to understand his or her medical status, as soon thereafter as the patient attains such capacity, each part 2 program shall: (1) Communicate to the patient that federal law and regulations protect the confidentiality of substance use dis- order patient records; and (2) Give to the patient a summary in writing of the federal law and regula- tions.
Extracted authority passage 2
In this written summary, the part 2 program also may include information con- cerning state law and any of the part 2 program’s policies that are not incon- sistent with state and federal law on the subject of confidentiality of sub- stance use disorder patient records.
Extracted authority passage 3
These research privilege statutes con- fer on the Secretary of Health and Human Services and on the Attorney General, respectively, the power to au- thorize researchers conducting certain types of research to withhold from all persons not connected with the re- search the names and other identifying information concerning individuals who are the subjects of the research.
Extracted authority passage 4
These regulations restrict the disclosure and use of information about patients, while administrative action taken under the research privilege statutes and implementing regulations protects a person engaged in applicable research from being compelled to disclose any identifying characteristics of the indi- viduals who are the subjects of that re- search.
Extracted authority passage 5
The written summary of the fed- eral law and regulations must include: (1) A general description of the lim- ited circumstances under which a part 2 program may acknowledge that an individual is present or disclose outside the part 2 program information identi- fying a patient as having or having had a substance use disorder; (2) A statement that violation of the federal law and regulations by a part 2 program is a crime and that suspected violations may be reported to appro- priate authorities consistent with § 2.4, along with contact information; (3) A statement that information re- lated to a patient’s commission of a crime on the premises of the part 2 pro- gram or against personnel of the part 2 program is not protected; (4) A statement that reports of sus- pected child abuse and neglect made under state law to appropriate state or local authorities are not protected; and (5) A citation to the federal law and regulations.
Extracted authority passage 6
There may be concurrent coverage of patient identifying information by the regulations in this part and by admin- istrative action taken under section 502(c) of the Controlled Substances Act (21 U.S.C. 872(c) and the implementing regulations at 21 CFR part 1316); or sec- tion 301(d) of the Public Health Service Act (42 U.S.C. 241(d) and the imple- menting regulations at 42 CFR part 2a).
45 CFR 164.306(a)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 45 CFR 164.306(a). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 45 CFR 164.306(a) | status: Basic | banner: CUI
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Department of Health and Human Services § 164.306
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
45 CFR 164.306(a) | status: Basic | banner: CUI
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: A covered entity or business associate must review and modify the security measures imple- mented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and up- date documentation of such security measures in accordance with § 164.316(b)(2)(iii). [68 FR 8376, Feb. 20, 2003; 68 FR 17153, Apr. 8, 2003; 78 FR 5693, Jan. 25, 2013] § 164.308 Administrative safeguards.
Extracted authority condition: Implement procedures to regularly review records of information system activity, such as audit logs, ac- cess reports, and security incident tracking reports.
Extracted authority condition: Covered enti- ties and business associates must do the following: (1) Ensure the confidentiality, integ- rity, and availability of all electronic protected health information the cov- ered entity or business associate cre- ates, receives, maintains, or transmits.
Extracted authority condition: Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business asso- ciate.
Extracted authority condition: Technical safeguards means the tech- nology and the policy and procedures for its use that protect electronic pro- tected health information and control access to it.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: A covered entity or business associate must review and modify the security measures imple- mented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and up- date documentation of such security measures in accordance with § 164.316(b)(2)(iii). [68 FR 8376, Feb. 20, 2003; 68 FR 17153, Apr. 8, 2003; 78 FR 5693, Jan. 25, 2013] § 164.308 Administrative safeguards.
Extracted authority control: Covered enti- ties and business associates must do the following: (1) Ensure the confidentiality, integ- rity, and availability of all electronic protected health information the cov- ered entity or business associate cre- ates, receives, maintains, or transmits.
Extracted authority control: Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business asso- ciate.
Extracted authority control: Technical safeguards means the tech- nology and the policy and procedures for its use that protect electronic pro- tected health information and control access to it.
Extracted authority control: Implement procedures for termi- nating access to electronic protected health information when the employ- ment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section.
Extracted authority control: Apply appropriate sanctions against work- force members who fail to comply with the security policies and procedures of the covered entity or business asso- ciate.
Extracted authority control: Implement policies and proce- dures to prevent, detect, contain, and correct security violations.
Authority excerpts
Most relevant extracted authority passage
A covered entity or business associate must review and modify the security measures imple- mented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and up- date documentation of such security measures in accordance with § 164.316(b)(2)(iii). [68 FR 8376, Feb. 20, 2003; 68 FR 17153, Apr. 8, 2003; 78 FR 5693, Jan. 25, 2013] § 164.308 Administrative safeguards.
Extracted authority passage 2
Covered enti- ties and business associates must do the following: (1) Ensure the confidentiality, integ- rity, and availability of all electronic protected health information the cov- ered entity or business associate cre- ates, receives, maintains, or transmits.
Extracted authority passage 3
Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business asso- ciate.
Extracted authority passage 4
Technical safeguards means the tech- nology and the policy and procedures for its use that protect electronic pro- tected health information and control access to it.
Extracted authority passage 5
Implement procedures for termi- nating access to electronic protected health information when the employ- ment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section.
Extracted authority passage 6
Implement procedures to regularly review records of information system activity, such as audit logs, ac- cess reports, and security incident tracking reports.
Related authority evidence: 45 CFR 164.310(a)(1) | status: Basic | banner: CUI
Extracted authority meaning
None listed
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
45 CFR 164.310(a)(1) | status: Basic | banner: CUI
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
45 CFR 164.502(a)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 45 CFR 164.502(a). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 45 CFR 164.502(a) | status: Basic | banner: CUI
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
45 CFR Subtitle A (10–1–18 Edition) § 164.502
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
45 CFR 164.502(a) | status: Basic | banner: CUI
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: 1318 45 CFR Subtitle A (10–1–18 Edition) § 164.502 (ii) For research purposes pursuant to § 164.512(i) or § 164.514(e), where the only remuneration received by the covered entity or business associate is a rea- sonable cost-based fee to cover the cost to prepare and transmit the protected health information for such purposes; (iii) For treatment and payment pur- poses pursuant to § 164.506(a); (iv) For the sale, transfer, merger, or consolidation of all or part of the cov- ered entity and for related due dili- gence as described in paragraph (6)(iv) of the definition of health care oper- ations and pursuant to § 164.506(a); (v) To or by a business associate for activities that the business associate undertakes on behalf of a covered enti- ty, or on behalf of a business associate in the case of a subcontractor, pursu- ant to §§ 164.502(e) and 164.504(e), and the only remuneration provided is by the covered entity to the business asso- ciate, or by the business associate to the subcontractor, if applicable, for the performance of such activities; (vi) To an individual, when requested under § 164.524 or § 164.528; (vii) Required by law as permitted under § 164.512(a); and (viii) For any other purpose per- mitted by and in accordance with the applicable requirements of this sub- part,...
Extracted authority condition: The requirements of this subpart do not apply to information that has been de-identified in accordance with the applicable requirements of § 164.514, provided that: (i) Disclosure of a code or other means of record identification designed to enable coded or otherwise de-identi- fied information to be re-identified constitutes disclosure of protected health information; and (ii) If de-identified information is re- identified, a covered entity may use or disclose such re-identified information only as permitted or required by this subpart.
Extracted authority condition: A covered entity is per- mitted to use or disclose protected health information as follows: (i) To the individual; (ii) For treatment, payment, or health care operations, as permitted by and in compliance with § 164.506; (iii) Incident to a use or disclosure otherwise permitted or required by this subpart, provided that the covered en- tity has complied with the applicable requirements of §§ 164.502(b), 164.514(d), and 164.530(c) with respect to such oth- erwise permitted or required use or dis- closure; (iv) Except for uses and disclosures prohibited under § 164.502(a)(5)(i), pursu- ant to and in compliance with a valid authorization under § 164.508; (v) Pursuant to an agreement under, or as otherwise permitted by, § 164.510; and
Extracted authority condition: (B) For purposes of this paragraph, sale of protected health information means: (1) Except as provided in paragraph (a)(5)(ii)(B)(2) of this section, a disclo- sure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indi- rectly receives remuneration from or on behalf of the recipient of the pro- tected health information in exchange for the protected health information.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: If under applica- ble law a parent, guardian, or other person acting in loco parentis has au- thority to act on behalf of an indi- vidual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation, except that such person may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information per- taining to a health care service, if: (A) The minor consents to such health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been ob- tained; and the minor has not re- quested that such person be treated as the personal representative; (B) The minor may lawfully obtain such health care service without the consent of a parent, guardian, or other person acting in loco parentis, and the minor, a court, or another person au- thorized by law consents to such health care service; or (C) A parent, guardian, or other per- son acting in loco parentis assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service.
Extracted authority control: A covered entity that has agreed to a restriction pursu- ant to § 164.522(a)(1) may not use or dis- close the protected health information covered by the restriction in violation of such restriction, except as otherwise provided in § 164.522(a).
Extracted authority control: (ii) Notwithstanding the provisions of paragraph (g)(3)(i) of this section: (A) If, and to the extent, permitted or required by an applicable provision of State or other law, including applica- ble case law, a covered entity may dis- close, or provide access in accordance with § 164.524 to, protected health infor- mation about an unemancipated minor to a parent, guardian, or other person acting in loco parentis; (B) If, and to the extent, prohibited by an applicable provision of State or other law, including applicable case law, a covered entity may not disclose, or provide access in accordance with § 164.524 to, protected health informa- tion about an unemancipated minor to a parent, guardian, or other person act- ing in loco parentis; and
Extracted authority control: A covered entity is per- mitted to use or disclose protected health information as follows: (i) To the individual; (ii) For treatment, payment, or health care operations, as permitted by and in compliance with § 164.506; (iii) Incident to a use or disclosure otherwise permitted or required by this subpart, provided that the covered en- tity has complied with the applicable requirements of §§ 164.502(b), 164.514(d), and 164.530(c) with respect to such oth- erwise permitted or required use or dis- closure; (iv) Except for uses and disclosures prohibited under § 164.502(a)(5)(i), pursu- ant to and in compliance with a valid authorization under § 164.508; (v) Pursuant to an agreement under, or as otherwise permitted by, § 164.510; and
Extracted authority control: 1318 45 CFR Subtitle A (10–1–18 Edition) § 164.502 (ii) For research purposes pursuant to § 164.512(i) or § 164.514(e), where the only remuneration received by the covered entity or business associate is a rea- sonable cost-based fee to cover the cost to prepare and transmit the protected health information for such purposes; (iii) For treatment and payment pur- poses pursuant to § 164.506(a); (iv) For the sale, transfer, merger, or consolidation of all or part of the cov- ered entity and for related due dili- gence as described in paragraph (6)(iv) of the definition of health care oper- ations and pursuant to § 164.506(a); (v) To or by a business associate for activities that the business associate undertakes on behalf of a covered enti- ty, or on behalf of a business associate in the case of a subcontractor, pursu- ant to §§ 164.502(e) and 164.504(e), and the only remuneration provided is by the covered entity to the business asso- ciate, or by the business associate to the subcontractor, if applicable, for the performance of such activities; (vi) To an individual, when requested under § 164.524 or § 164.528; (vii) Required by law as permitted under § 164.512(a); and (viii) For any other purpose per- mitted by and in accordance with the applicable requirements of this sub- part,...
Extracted authority control: A covered en- tity is not considered to have violated the requirements of this subpart if a member of its workforce who is the vic- tim of a criminal act discloses pro- tected health information to a law en- forcement official, provided that: (i) The protected health information disclosed is about the suspected perpe- trator of the criminal act; and (ii) The protected health information disclosed is limited to the information listed in § 164.512(f)(2)(i). [65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53267, Aug. 14, 2002; 78 FR 5696, Jan. 25, 2013]
Authority excerpts
Most relevant extracted authority passage
If under applica- ble law a parent, guardian, or other person acting in loco parentis has au- thority to act on behalf of an indi- vidual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation, except that such person may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information per- taining to a health care service, if: (A) The minor consents to such health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been ob- tained; and the minor has not re- quested that such person be treated as the personal representative; (B) The minor may lawfully obtain such health care service without the consent of a parent, guardian, or other person acting in loco parentis, and the minor, a court, or another person au- thorized by law consents to such health care service; or (C) A parent, guardian, or other per- son acting in loco parentis assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service.
Extracted authority passage 2
A covered entity that has agreed to a restriction pursu- ant to § 164.522(a)(1) may not use or dis- close the protected health information covered by the restriction in violation of such restriction, except as otherwise provided in § 164.522(a).
Extracted authority passage 3
(ii) Notwithstanding the provisions of paragraph (g)(3)(i) of this section: (A) If, and to the extent, permitted or required by an applicable provision of State or other law, including applica- ble case law, a covered entity may dis- close, or provide access in accordance with § 164.524 to, protected health infor- mation about an unemancipated minor to a parent, guardian, or other person acting in loco parentis; (B) If, and to the extent, prohibited by an applicable provision of State or other law, including applicable case law, a covered entity may not disclose, or provide access in accordance with § 164.524 to, protected health informa- tion about an unemancipated minor to a parent, guardian, or other person act- ing in loco parentis; and
Extracted authority passage 4
A covered entity is per- mitted to use or disclose protected health information as follows: (i) To the individual; (ii) For treatment, payment, or health care operations, as permitted by and in compliance with § 164.506; (iii) Incident to a use or disclosure otherwise permitted or required by this subpart, provided that the covered en- tity has complied with the applicable requirements of §§ 164.502(b), 164.514(d), and 164.530(c) with respect to such oth- erwise permitted or required use or dis- closure; (iv) Except for uses and disclosures prohibited under § 164.502(a)(5)(i), pursu- ant to and in compliance with a valid authorization under § 164.508; (v) Pursuant to an agreement under, or as otherwise permitted by, § 164.510; and
Extracted authority passage 5
1318 45 CFR Subtitle A (10–1–18 Edition) § 164.502 (ii) For research purposes pursuant to § 164.512(i) or § 164.514(e), where the only remuneration received by the covered entity or business associate is a rea- sonable cost-based fee to cover the cost to prepare and transmit the protected health information for such purposes; (iii) For treatment and payment pur- poses pursuant to § 164.506(a); (iv) For the sale, transfer, merger, or consolidation of all or part of the cov- ered entity and for related due dili- gence as described in paragraph (6)(iv) of the definition of health care oper- ations and pursuant to § 164.506(a); (v) To or by a business associate for activities that the business associate undertakes on behalf of a covered enti- ty, or on behalf of a business associate in the case of a subcontractor, pursu- ant to §§ 164.502(e) and 164.504(e), and the only remuneration provided is by the covered entity to the business asso- ciate, or by the business associate to the subcontractor, if applicable, for the performance of such activities; (vi) To an individual, when requested under § 164.524 or § 164.528; (vii) Required by law as permitted under § 164.512(a); and (viii) For any other purpose per- mitted by and in accordance with the applicable requirements of this sub- part,...
Extracted authority passage 6
The requirements of this subpart do not apply to information that has been de-identified in accordance with the applicable requirements of § 164.514, provided that: (i) Disclosure of a code or other means of record identification designed to enable coded or otherwise de-identi- fied information to be re-identified constitutes disclosure of protected health information; and (ii) If de-identified information is re- identified, a covered entity may use or disclose such re-identified information only as permitted or required by this subpart.
45 CFR 164.508(a)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 45 CFR 164.508(a). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 45 CFR 164.508(a) | status: Basic | banner: CUI
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Department of Health and Human Services § 164.508
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
45 CFR 164.508(a) | status: Basic | banner: CUI
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: (i) Notwith- standing any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in § 164.501 of this subpart.
Extracted authority condition: 1327 Department of Health and Human Services § 164.508 condition the provision to an indi- vidual of treatment, payment, enroll- ment in the health plan, or eligibility for benefits on the provision of an au- thorization, except: (i) A covered health care provider may condition the provision of re- search-related treatment on provision of an authorization for the use or dis- closure of protected health information for such research under this section; (ii) A health plan may condition en- rollment in the health plan or eligi- bility for benefits on provision of an authorization requested by the health plan prior to an individual’s enroll- ment in the health plan, if: (A) The authorization sought is for the health plan’s eligibility or enroll- ment determinations relating to the individual or for its underwriting or risk rating determinations; and (B) The authorization is not for a use or disclosure of psychotherapy notes under paragraph (a)(2) of this section; and (iii) A covered entity may condition the provision of health care that is solely for the purpose of creating pro- tected health information for disclo- sure to a third party on provision of an authorization for the disclosure of the protected health information to such third party.
Extracted authority condition: (4) A covered entity may disclose pro- tected health information to another covered entity for health care oper- ations activities of the entity that re- ceives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being re- quested, the protected health informa- tion pertains to such relationship, and the disclosure is: (i) For a purpose listed in paragraph (1) or (2) of the definition of health care operations; or (ii) For the purpose of health care fraud and abuse detection or compli- ance.
Extracted authority condition: A covered entity may use or disclose protected health information, provided that the individual is informed in ad- vance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure, in ac- cordance with the applicable require- ments of this section.
Extracted authority condition: (2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authoriza- tion, under § 164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: 1327 Department of Health and Human Services § 164.508 condition the provision to an indi- vidual of treatment, payment, enroll- ment in the health plan, or eligibility for benefits on the provision of an au- thorization, except: (i) A covered health care provider may condition the provision of re- search-related treatment on provision of an authorization for the use or dis- closure of protected health information for such research under this section; (ii) A health plan may condition en- rollment in the health plan or eligi- bility for benefits on provision of an authorization requested by the health plan prior to an individual’s enroll- ment in the health plan, if: (A) The authorization sought is for the health plan’s eligibility or enroll- ment determinations relating to the individual or for its underwriting or risk rating determinations; and (B) The authorization is not for a use or disclosure of psychotherapy notes under paragraph (a)(2) of this section; and (iii) A covered entity may condition the provision of health care that is solely for the purpose of creating pro- tected health information for disclo- sure to a third party on provision of an authorization for the disclosure of the protected health information to such third party.
Extracted authority control: (2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authoriza- tion, under § 164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart.
Extracted authority control: (i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of:
Extracted authority control: (i) Notwith- standing any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in § 164.501 of this subpart.
Extracted authority control: If a covered entity seeks an authorization from an individual for a use or disclosure of protected health information, the cov- ered entity must provide the individual with a copy of the signed authoriza- tion. [67 FR 53268, Aug. 14, 2002, as amended at 78 FR 5699, Jan. 25, 2013] § 164.510 Uses and disclosures requir- ing an opportunity for the indi- vidual to agree or to object.
Extracted authority control: (ii) If the marketing involves finan- cial remuneration, as defined in para- graph (3) of the definition of marketing at § 164.501, to the covered entity from a third party, the authorization must state that such remuneration is in- volved.
Authority excerpts
Most relevant extracted authority passage
1327 Department of Health and Human Services § 164.508 condition the provision to an indi- vidual of treatment, payment, enroll- ment in the health plan, or eligibility for benefits on the provision of an au- thorization, except: (i) A covered health care provider may condition the provision of re- search-related treatment on provision of an authorization for the use or dis- closure of protected health information for such research under this section; (ii) A health plan may condition en- rollment in the health plan or eligi- bility for benefits on provision of an authorization requested by the health plan prior to an individual’s enroll- ment in the health plan, if: (A) The authorization sought is for the health plan’s eligibility or enroll- ment determinations relating to the individual or for its underwriting or risk rating determinations; and (B) The authorization is not for a use or disclosure of psychotherapy notes under paragraph (a)(2) of this section; and (iii) A covered entity may condition the provision of health care that is solely for the purpose of creating pro- tected health information for disclo- sure to a third party on provision of an authorization for the disclosure of the protected health information to such third party.
Extracted authority passage 2
(2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authoriza- tion, under § 164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart.
Extracted authority passage 3
(i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of:
Extracted authority passage 4
(i) Notwith- standing any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in § 164.501 of this subpart.
Extracted authority passage 5
If a covered entity seeks an authorization from an individual for a use or disclosure of protected health information, the cov- ered entity must provide the individual with a copy of the signed authoriza- tion. [67 FR 53268, Aug. 14, 2002, as amended at 78 FR 5699, Jan. 25, 2013] § 164.510 Uses and disclosures requir- ing an opportunity for the indi- vidual to agree or to object.
Extracted authority passage 6
(4) A covered entity may disclose pro- tected health information to another covered entity for health care oper- ations activities of the entity that re- ceives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being re- quested, the protected health informa- tion pertains to such relationship, and the disclosure is: (i) For a purpose listed in paragraph (1) or (2) of the definition of health care operations; or (ii) For the purpose of health care fraud and abuse detection or compli- ance.
Related authority evidence: 45 CFR 164.530(c) | status: Basic | banner: CUI | sanctions: 45 CFR 164.530(e)
Extracted authority meaning
None listed
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Specified; banner marking CUI//SP-HLTH.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Safeguarding and dissemination controls
NARA registry control evidence: status Specified; banner marking CUI//SP-HLTH.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
29 CFR 1630.16(c)(3)
Listed by: NARA Registry, DoD Registry, Related authorities
DoD authority row: 29 CFR 1630.16(c)(3). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: 29 CFR 1630.16(c)(3) | status: Basic | banner: CUI
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
minor. For purposes of this section,
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
NARA category scope used with this authority: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
29 CFR 1630.16(c)(3) | status: Basic | banner: CUI
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: XIV (7–1–18 Edition) § 1630.16 charge of discrimination by an indi- vidual claiming coverage under the ‘‘regarded as’’ prong of the definition of disability that the impairment is (in the case of an actual impairment) or would be (in the case of a perceived im- pairment) ‘‘transitory and minor.’’ To establish this defense, a covered entity must demonstrate that the impairment is both ‘‘transitory’’ and ‘‘minor.’’ Whether the impairment at issue is or would be ‘‘transitory and minor’’ is to be determined objectively.
Extracted authority condition: Any information regarding the medical condition or his- tory of any employee or applicant ob- tained from a test to determine the il- legal use of drugs, except information regarding the illegal use of drugs, is subject to the requirements of § 1630.14(b) (2) and (3) of this part.
Extracted authority condition: (Copies may be obtained from Center for Infectious Diseases, Centers for Disease Control, 1600 Clifton Road, NE., Mailstop C09, Atlanta, GA 30333.) If an individual with a disability is dis- abled by one of the infectious or com- municable diseases included on this list, and if the risk of transmitting the disease associated with the handling of food cannot be eliminated by reason- able accommodation, a covered entity may refuse to assign or continue to as- sign such individual to a job involving food handling.
Extracted authority condition: Thus, the administration of such drug tests by a covered entity to its job ap- plicants or employees is not a violation of § 1630.13 of this part.
Extracted authority condition: For purposes of this section, ‘‘transitory’’ is defined as lasting or ex- pected to last six months or less.
Safeguarding and dissemination controls
NARA registry control evidence: status Basic; banner marking CUI.
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: Any information regarding the medical condition or his- tory of any employee or applicant ob- tained from a test to determine the il- legal use of drugs, except information regarding the illegal use of drugs, is subject to the requirements of § 1630.14(b) (2) and (3) of this part.
Extracted authority control: This part does not preempt, modify, or amend any State, county, or local law, ordinance or regulation applicable to food handling which: (i) Is in accordance with the list, re- ferred to in paragraph (e)(1) of this sec- tion, of infectious or communicable diseases and the modes of trans- missibility published by the Secretary of Health and Human Services; and (ii) Is designed to protect the public health from individuals who pose a sig- nificant risk to the health or safety of others, where that risk cannot be eliminated by reasonable accommoda- tion.
Extracted authority control: Discrimination on the basis of disability persists in critical areas such as housing, public accommodations, education, transportation, communication, recreation, institutionalization, health services, voting, access to public services, and employment. 42 U.S.C. 12101(a)(3).
Extracted authority control: Thus, the administration of such drug tests by a covered entity to its job ap- plicants or employees is not a violation of § 1630.13 of this part.
Authority excerpts
Most relevant extracted authority passage
Any information regarding the medical condition or his- tory of any employee or applicant ob- tained from a test to determine the il- legal use of drugs, except information regarding the illegal use of drugs, is subject to the requirements of § 1630.14(b) (2) and (3) of this part.
Extracted authority passage 2
This part does not preempt, modify, or amend any State, county, or local law, ordinance or regulation applicable to food handling which: (i) Is in accordance with the list, re- ferred to in paragraph (e)(1) of this sec- tion, of infectious or communicable diseases and the modes of trans- missibility published by the Secretary of Health and Human Services; and (ii) Is designed to protect the public health from individuals who pose a sig- nificant risk to the health or safety of others, where that risk cannot be eliminated by reasonable accommoda- tion.
Extracted authority passage 3
Discrimination on the basis of disability persists in critical areas such as housing, public accommodations, education, transportation, communication, recreation, institutionalization, health services, voting, access to public services, and employment. 42 U.S.C. 12101(a)(3).
Extracted authority passage 4
XIV (7–1–18 Edition) § 1630.16 charge of discrimination by an indi- vidual claiming coverage under the ‘‘regarded as’’ prong of the definition of disability that the impairment is (in the case of an actual impairment) or would be (in the case of a perceived im- pairment) ‘‘transitory and minor.’’ To establish this defense, a covered entity must demonstrate that the impairment is both ‘‘transitory’’ and ‘‘minor.’’ Whether the impairment at issue is or would be ‘‘transitory and minor’’ is to be determined objectively.
Extracted authority passage 5
(Copies may be obtained from Center for Infectious Diseases, Centers for Disease Control, 1600 Clifton Road, NE., Mailstop C09, Atlanta, GA 30333.) If an individual with a disability is dis- abled by one of the infectious or com- municable diseases included on this list, and if the risk of transmitting the disease associated with the handling of food cannot be eliminated by reason- able accommodation, a covered entity may refuse to assign or continue to as- sign such individual to a job involving food handling.
Extracted authority passage 6
Thus, the administration of such drug tests by a covered entity to its job ap- plicants or employees is not a violation of § 1630.13 of this part.
42 USC 1320d-2(d)(2) and note(b)(Public Law 104-191 Section 264)
Listed by: DoD Registry, Related authorities
Designation evidence
DoD authority row: 42 USC 1320d-2(d)(2) and note(b)(Public Law 104-191 Section 264). DoD lists this citation for the category; this DoD detail page does not display a separate Basic/Specified field.
Related authority evidence: DoD lists this authority for the category; the linked authority text is extracted below when available.
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Registry designation for this category is Specified + Basic + Basic (provisional) + Specified Basic with banner CUI.
Extracted authority meaning
Page 2351 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 1320d–2
Registry designation context: Specified + Basic + Basic (provisional) + Specified Basic, CUI. The linked authority text contains category-scope or applicability language that helps determine when the information falls within this CUI category. The linked authority text contains disclosure, access, protection, release, dissemination, or distribution-control language relevant to handling. The linked authority text contains violation, penalty, sanction, or enforcement language that may affect consequences for mishandling.
Operating conditions
DoD category scope used with this authority: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD lists this authority for the category; the linked authority text is extracted below when available.
NARA registry status: Specified + Basic + Basic (provisional) + Specified Basic. Per-authority NARA status values: Specified, Basic, Basic (provisional), Specified Basic. NARA banner marking evidence: CUI, CUI//SP-HLTH, under "Personnel Records" under "General Privacy". The registry evidence is preserved here; detailed primary-law or regulation text analysis remains pending for this category.
NARA category scope: As per 42 USC 1320d(4), "health information" means any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
DoD category scope: Any information, whether oral or recorded in any form or medium, that (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Extracted authority condition: L. 104–191] (42 U.S.C. 1320d–2 note). ‘‘(b) G UIDANCE.— ‘‘(1) I SSUANCE.—In carrying out subsection (a), not later than 1 year after the date of enactment of this section [Dec. 13, 2016], the Secretary shall issue guid- ance clarifying the circumstances under which, con- sistent with regulations promulgated under section 264(c) of the Health Insurance Portability and Ac- countability Act of 1996, a health care provider or covered entity may use or disclose protected health information. ‘‘(2) C IRCUMSTANCES ADDRESSED.—The guidance is- sued under this section shall address circumstances including those that— ‘‘(A) require the consent of the patient; ‘‘(B) require providing the patient with an oppor- tunity to object; ‘‘(C) are based on the exercise of professional judgment regarding whether the patient would ob- ject when the opportunity to object cannot prac- ticably be provided because of the incapacity of the patient or an emergency treatment circumstance; and ‘‘(D) are determined, based on the exercise of pro- fessional judgment, to be in the best interest of the patient when the patient is not present or other- wise incapacitated. ‘‘(3) C OMMUNICATION WITH FAMILY MEMBERS AND CAREGIVERS.—In addressing the circumstances de- scribed in paragraph (2),...
Extracted authority condition: L. 104–191, title II, § 264, Aug. 21, 1996, 110 Stat. 2033, provided that: ‘‘(a) I NGENERAL.—Not later than the date that is 12 months after the date of the enactment of this Act [Aug. 21, 1996], the Secretary of Health and Human Services shall submit to the Committee on Labor and Human Resources and the Committee on Finance of the Senate and the Committee on Commerce and the Com- mittee on Ways and Means of the House of Representa- tives detailed recommendations on standards with re- spect to the privacy of individually identifiable health information. ‘‘(b) S UBJECTS FORRECOMMENDATIONS.—The recom- mendations under subsection (a) shall address at least the following: ‘‘(1) The rights that an individual who is a subject of individually identifiable health information should have. ‘‘(2) The procedures that should be established for the exercise of such rights. ‘‘(3) The uses and disclosures of such information that should be authorized or required. ‘‘(c) R EGULATIONS.— ‘‘(1) IN GENERAL.—If legislation governing standards with respect to the privacy of individually identifi- able health information transmitted in connection with the transactions described in section 1173(a) of the Social Security Act [42 U.S.C. 1320d–2(a)] (as added by section 262) is not enacted by the date that is 36 months after the date of the enactment of this Act [Aug. 21, 1996],...
Extracted authority condition: A, title II, § 2063, Dec. 13, 2016, 130 Stat. 1080, provided that: ‘‘(a) G UIDANCERELATED TOREMOTEACCESS.—Not later than 1 year after the date of enactment of this Act [Dec. 13, 2016], the Secretary of Health and Human Services (referred to in this section as the ‘Secretary’) shall issue guidance clarifying that subparagraph (B) of section 164.512(i)(1)(ii) of part 164 of the Rule (prohibit- ing the removal of protected health information by a researcher) does not prohibit remote access to health information by a researcher for such purposes as de- scribed in section 164.512(i)(1)(ii) of part 164 of the Rule so long as— ‘‘(1) at a minimum, security and privacy safe- guards, consistent with the requirements of the Rule, are maintained by the covered entity and the re- searcher; and ‘‘(2) the protected health information is not copied or otherwise retained by the researcher. ‘‘(b) G UIDANCERELATED TOSTREAMLININGAUTHORIZA- TION.—Not later than 1 year after the date of enact- ment of this Act, the Secretary shall issue guidance on the following: ‘‘(1) A UTHORIZATION FOR USE AND DISCLOSURE OF HEALTH INFORMATION.—Clarification of the circum- stances under which the authorization for the use or disclosure of protected health information, with re- spect to an individual,...
Extracted authority condition: L. 104–191] (42 U.S.C. 1320d–2 note) and such part C, of the protected health information of patients seeking or undergoing mental or substance use disorder treat- ment. ‘‘(2) A model program and materials for training pa- tients and their families regarding their rights to protect and obtain information under the standards and regulations specified in paragraph (1). ‘‘(b) P ERIODICUPDATES.—The Secretary shall— ‘‘(1) periodically review and update the model pro- grams and materials identified or developed under subsection (a); and ‘‘(2) disseminate the updated model programs and materials to the individuals described in subsection (a). ‘‘(c) C OORDINATION.—The Secretary shall carry out this section in coordination with the Director of the Of- fice for Civil Rights within the Department of Health and Human Services, the Assistant Secretary for Men- tal Health and Substance Use, the Administrator of the Health Resources and Services Administration, and the heads of other relevant agencies within the Department of Health and Human Services. ‘‘(d) I NPUT OFCERTAINENTITIES.—In identifying, re- viewing, or updating the model programs and materials under subsections (a) and (b), the Secretary shall so- licit the input of relevant national, State, and local as- sociations; medical societies; licensing boards;...
No DoD required dissemination control is listed on the registry page. Apply approved limited dissemination controls only when required or permitted by the designating agency or governing authority.
Use the registry assertions, NARA authority rows, DoD authorities, DoD policies, warning statements, required dissemination controls, and examples first. Where the cited authority does not specify a handling detail, apply CUI Basic safeguards and dissemination rules so long as they do not conflict with the authority or agency-specific controls.
Extracted authority control: L. 104–191] (42 U.S.C. 1320d–2 note) and such part C, of the protected health information of patients seeking or undergoing mental or substance use disorder treat- ment. ‘‘(2) A model program and materials for training pa- tients and their families regarding their rights to protect and obtain information under the standards and regulations specified in paragraph (1). ‘‘(b) P ERIODICUPDATES.—The Secretary shall— ‘‘(1) periodically review and update the model pro- grams and materials identified or developed under subsection (a); and ‘‘(2) disseminate the updated model programs and materials to the individuals described in subsection (a). ‘‘(c) C OORDINATION.—The Secretary shall carry out this section in coordination with the Director of the Of- fice for Civil Rights within the Department of Health and Human Services, the Assistant Secretary for Men- tal Health and Substance Use, the Administrator of the Health Resources and Services Administration, and the heads of other relevant agencies within the Department of Health and Human Services. ‘‘(d) I NPUT OFCERTAINENTITIES.—In identifying, re- viewing, or updating the model programs and materials under subsections (a) and (b), the Secretary shall so- licit the input of relevant national, State, and local as- sociations; medical societies; licensing boards;...
Extracted authority control: (2) Safeguards Each person described in section 1320d–1(a) of this title who maintains or transmits health information shall maintain reasonable and appropriate administrative, technical, and physical safeguards— (A) to ensure the integrity and confiden- tiality of the information; (B) to protect against any reasonably an- ticipated— (i) threats or hazards to the security or integrity of the information; and (ii) unauthorized uses or disclosures of the information; and (C) otherwise to ensure compliance with this part by the officers and employees of such person.
Extracted authority control: L. 104–191] (42 U.S.C. 1320d–2 note). ‘‘(b) G UIDANCE.— ‘‘(1) I SSUANCE.—In carrying out subsection (a), not later than 1 year after the date of enactment of this section [Dec. 13, 2016], the Secretary shall issue guid- ance clarifying the circumstances under which, con- sistent with regulations promulgated under section 264(c) of the Health Insurance Portability and Ac- countability Act of 1996, a health care provider or covered entity may use or disclose protected health information. ‘‘(2) C IRCUMSTANCES ADDRESSED.—The guidance is- sued under this section shall address circumstances including those that— ‘‘(A) require the consent of the patient; ‘‘(B) require providing the patient with an oppor- tunity to object; ‘‘(C) are based on the exercise of professional judgment regarding whether the patient would ob- ject when the opportunity to object cannot prac- ticably be provided because of the incapacity of the patient or an emergency treatment circumstance; and ‘‘(D) are determined, based on the exercise of pro- fessional judgment, to be in the best interest of the patient when the patient is not present or other- wise incapacitated. ‘‘(3) C OMMUNICATION WITH FAMILY MEMBERS AND CAREGIVERS.—In addressing the circumstances de- scribed in paragraph (2),...
Extracted authority control: L. 104–191, title II, § 264, Aug. 21, 1996, 110 Stat. 2033, provided that: ‘‘(a) I NGENERAL.—Not later than the date that is 12 months after the date of the enactment of this Act [Aug. 21, 1996], the Secretary of Health and Human Services shall submit to the Committee on Labor and Human Resources and the Committee on Finance of the Senate and the Committee on Commerce and the Com- mittee on Ways and Means of the House of Representa- tives detailed recommendations on standards with re- spect to the privacy of individually identifiable health information. ‘‘(b) S UBJECTS FORRECOMMENDATIONS.—The recom- mendations under subsection (a) shall address at least the following: ‘‘(1) The rights that an individual who is a subject of individually identifiable health information should have. ‘‘(2) The procedures that should be established for the exercise of such rights. ‘‘(3) The uses and disclosures of such information that should be authorized or required. ‘‘(c) R EGULATIONS.— ‘‘(1) IN GENERAL.—If legislation governing standards with respect to the privacy of individually identifi- able health information transmitted in connection with the transactions described in section 1173(a) of the Social Security Act [42 U.S.C. 1320d–2(a)] (as added by section 262) is not enacted by the date that is 36 months after the date of the enactment of this Act [Aug. 21, 1996],...
Extracted authority control: In order to pro- vide greater protections to patients’ privacy, the De- partment of Health and Human Services is issuing final regulations concerning the confidentiality of individ- ually identifiable health information under the Health Insurance Portability and Accountability Act of 1996 [Pub.
Extracted authority control: B, title XI, § 11003, Dec. 13, 2016, 130 Stat. 1270, provided that: ‘‘(a) I NGENERAL.—The Secretary [of Health and Human Services], acting through the Director of the Office for Civil Rights, shall ensure that health care providers, professionals, patients and their families, and others involved in mental or substance use disorder treatment have adequate, accessible, and easily com- prehensible resources relating to appropriate uses and disclosures of protected health information under the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 [Pub.
Authority excerpts
Most relevant extracted authority passage
L. 104–191] (42 U.S.C. 1320d–2 note) and such part C, of the protected health information of patients seeking or undergoing mental or substance use disorder treat- ment. ‘‘(2) A model program and materials for training pa- tients and their families regarding their rights to protect and obtain information under the standards and regulations specified in paragraph (1). ‘‘(b) P ERIODICUPDATES.—The Secretary shall— ‘‘(1) periodically review and update the model pro- grams and materials identified or developed under subsection (a); and ‘‘(2) disseminate the updated model programs and materials to the individuals described in subsection (a). ‘‘(c) C OORDINATION.—The Secretary shall carry out this section in coordination with the Director of the Of- fice for Civil Rights within the Department of Health and Human Services, the Assistant Secretary for Men- tal Health and Substance Use, the Administrator of the Health Resources and Services Administration, and the heads of other relevant agencies within the Department of Health and Human Services. ‘‘(d) I NPUT OFCERTAINENTITIES.—In identifying, re- viewing, or updating the model programs and materials under subsections (a) and (b), the Secretary shall so- licit the input of relevant national, State, and local as- sociations; medical societies; licensing boards;...
Extracted authority passage 2
(2) Safeguards Each person described in section 1320d–1(a) of this title who maintains or transmits health information shall maintain reasonable and appropriate administrative, technical, and physical safeguards— (A) to ensure the integrity and confiden- tiality of the information; (B) to protect against any reasonably an- ticipated— (i) threats or hazards to the security or integrity of the information; and (ii) unauthorized uses or disclosures of the information; and (C) otherwise to ensure compliance with this part by the officers and employees of such person.
Extracted authority passage 3
L. 104–191] (42 U.S.C. 1320d–2 note). ‘‘(b) G UIDANCE.— ‘‘(1) I SSUANCE.—In carrying out subsection (a), not later than 1 year after the date of enactment of this section [Dec. 13, 2016], the Secretary shall issue guid- ance clarifying the circumstances under which, con- sistent with regulations promulgated under section 264(c) of the Health Insurance Portability and Ac- countability Act of 1996, a health care provider or covered entity may use or disclose protected health information. ‘‘(2) C IRCUMSTANCES ADDRESSED.—The guidance is- sued under this section shall address circumstances including those that— ‘‘(A) require the consent of the patient; ‘‘(B) require providing the patient with an oppor- tunity to object; ‘‘(C) are based on the exercise of professional judgment regarding whether the patient would ob- ject when the opportunity to object cannot prac- ticably be provided because of the incapacity of the patient or an emergency treatment circumstance; and ‘‘(D) are determined, based on the exercise of pro- fessional judgment, to be in the best interest of the patient when the patient is not present or other- wise incapacitated. ‘‘(3) C OMMUNICATION WITH FAMILY MEMBERS AND CAREGIVERS.—In addressing the circumstances de- scribed in paragraph (2),...
Extracted authority passage 4
L. 104–191, title II, § 264, Aug. 21, 1996, 110 Stat. 2033, provided that: ‘‘(a) I NGENERAL.—Not later than the date that is 12 months after the date of the enactment of this Act [Aug. 21, 1996], the Secretary of Health and Human Services shall submit to the Committee on Labor and Human Resources and the Committee on Finance of the Senate and the Committee on Commerce and the Com- mittee on Ways and Means of the House of Representa- tives detailed recommendations on standards with re- spect to the privacy of individually identifiable health information. ‘‘(b) S UBJECTS FORRECOMMENDATIONS.—The recom- mendations under subsection (a) shall address at least the following: ‘‘(1) The rights that an individual who is a subject of individually identifiable health information should have. ‘‘(2) The procedures that should be established for the exercise of such rights. ‘‘(3) The uses and disclosures of such information that should be authorized or required. ‘‘(c) R EGULATIONS.— ‘‘(1) IN GENERAL.—If legislation governing standards with respect to the privacy of individually identifi- able health information transmitted in connection with the transactions described in section 1173(a) of the Social Security Act [42 U.S.C. 1320d–2(a)] (as added by section 262) is not enacted by the date that is 36 months after the date of the enactment of this Act [Aug. 21, 1996],...
Extracted authority passage 5
In order to pro- vide greater protections to patients’ privacy, the De- partment of Health and Human Services is issuing final regulations concerning the confidentiality of individ- ually identifiable health information under the Health Insurance Portability and Accountability Act of 1996 [Pub.
Extracted authority passage 6
A, title II, § 2063, Dec. 13, 2016, 130 Stat. 1080, provided that: ‘‘(a) G UIDANCERELATED TOREMOTEACCESS.—Not later than 1 year after the date of enactment of this Act [Dec. 13, 2016], the Secretary of Health and Human Services (referred to in this section as the ‘Secretary’) shall issue guidance clarifying that subparagraph (B) of section 164.512(i)(1)(ii) of part 164 of the Rule (prohibit- ing the removal of protected health information by a researcher) does not prohibit remote access to health information by a researcher for such purposes as de- scribed in section 164.512(i)(1)(ii) of part 164 of the Rule so long as— ‘‘(1) at a minimum, security and privacy safe- guards, consistent with the requirements of the Rule, are maintained by the covered entity and the re- searcher; and ‘‘(2) the protected health information is not copied or otherwise retained by the researcher. ‘‘(b) G UIDANCERELATED TOSTREAMLININGAUTHORIZA- TION.—Not later than 1 year after the date of enact- ment of this Act, the Secretary shall issue guidance on the following: ‘‘(1) A UTHORIZATION FOR USE AND DISCLOSURE OF HEALTH INFORMATION.—Clarification of the circum- stances under which the authorization for the use or disclosure of protected health information, with re- spect to an individual,...