Whether an entity seeking to conduct an audit or evaluation is permitted to do so is a matter that each vendor must resolve under the federal regulations discussed below.

I. The HIPAA Privacy Rule Section 165.512 of the HIPAA privacy rule sets forth “[u]ses and disclosures for which an authorization or opportunity to agree or object [by the patient] is not required.” 45 C.F.R. § 165.512. Among such allowed disclosures are those for “health oversight activities”:

• (d) Standard: Uses and disclosures for health oversight activities.
• (1) Permitted disclosures. A covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of:
  • (i) The health care system;
  • (ii) Government benefit programs for which health information is relevant to
  • beneficiary eligibility;
  • (iii) Entities subject to government regulatory programs for which health
  • information is necessary for determining compliance with program standards; or
  • (iv) Entities subject to civil rights laws for which health information is necessary for determining compliance. Id. § 164.512(d).

The privacy rule defines “health oversight agency” as follows: Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is authorized by law to
oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant. Id. at 164.512 (emphasis added). Notwithstanding that it is a non-governmental entity, CARF would qualify as a “health oversight agency” if either the probation office grants it oversight authority or the probation office authorizes the vendor to grant CARF
oversight authority. Of course, CARF would have to be otherwise “authorized by law to oversee the health care system.” Presumably, state laws in the districts where CARF has conducted audits authorize CARF to oversee treatment facilities. Thus, the privacy rule allows health care providers (which are “covered entities”) to disclose protected health information to “health oversight agenc[ies] for oversight activities authorized by law.” This could potentially include state, federal,
or nonprofits such as CARF. Whether an entity qualifies as a health oversight agency, however, is an issue for each vendor to resolve under § 164.512 and state law.

II. The Drug Treatment Confidentiality Regulations Section 2.53 of the drug treatment confidentiality regulations allows federal, state, and local governmental agencies to review treatment records if authorized by law to regulate the vendor's activities. 42 C.F.R. § 2.53(a)(1)(i). In addition “a quality improvement organization performing a utilization or quality control review” or an entity “determined by the program director to be qualified to conduct [] audit or evaluation activities” may
review treatment records. Id. § 2.53(a)(1)(ii) & (a)(2). If the vendor determines that any of the foregoing entities are authorized to have access to treatment records under § 2.53(a), the reviewing entity must “agree[] in writing to comply with the limitations on redisclosure and use in [§ 2.53(d)].”

Section 2.53(d) essentially limits an auditor to disclosing and using treatment information that was disclosed during an audit to notify the treatment provider of the auditor's evaluation. Section 2.53(d) also provides for disclosure and use to investigate or prosecute a program, or a person holding the records, if the agency obtains a court order under 42 C.F.R. § 2.66. In sum, the HIPAA privacy rule allows auditors to have access to records if they are employed by a “health oversight agency” and they are performing “oversight activities authorized by law.” The drug treatment confidentiality regulations also allow access so long as a § 2.53 compliant form is signed by the auditor who qualifies under § 2.53(a). Attached is a draft form demonstrating what the drug treatment confidentiality regulations would require an auditor to sign before receiving access to drug treatment records. Vendors should currently be using a form similar to this. The regulations do not specify that such a form need be completed for each file reviewed. Rather, they state that when an auditor reviews “patient records,” she must sign a written agreement to comply with the § 2.53 limits on disclosure. [This is interpreted] as simply requiring one written agreement for each audit or review of multiple records. A sample release form for these purposes can be found on this website in the Vendor Forms section.

No. You are correct that your BPA requires in section section C that, “The vendor shall segregate defendant/offender files from other vendor records.” This separation is required only for the actual treatment files, not the clients themselves. The vendor, may place federal supervisees in group counseling sessions with other non-federal clients. For example, a cognitive-behavioral treatment group of federal and state clients would be appropriate under this contract. The vendor should, however, check with other contracted agencies to ensure those agencies are in agreement with such a “mixed” group. The vendor would also be cautioned about placing federal supervisees in a group with non-criminal justice clients.