Confidentiality of patient records.

§ 408. Confidentiality of patient records. (a) Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any drug abuse prevention function authorized or assisted under any provision of this Act or any Act amended by this Act shall be confidential and may be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b) of this section. (b) (1) If the patient, with respect to whom any given record referred to in subsection (a) of this section is maintained, gives his written consent, the content of such record may be disclosed (A) to medical personnel for the purpose of diagnosis or treatment of the patient, and (B) to governmental personnel for the purpose of obtaining benefits to which the patient is entitled. (2) If the patient, with respect to whom any given record referred to in subsection (a) of this section is maintained, does not give his written consent, the content of such record may be disclosed as follows: (A) To medical personnel to the extent necessary to meet a bona fide medical emergency. (B) To qualified personnel for the purpose, of conducting scientific research, management or financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual patient in any report of such research, audit, or evaluation, or otherwise disclose patient identities in any manner. (C) If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor. In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure. (c) Except as authorized by a court order granted under subsection (b)(2)(C) of this section, no record referred to in subsection (a) may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient. (d) The prohibitions of this section continue to apply to records concerning any individual who has been a patient, irrespective of whether or when he ceases to be a patient. (e) Except as authorized under subsection (b) of this section, any person who discloses the contents of any record referred to in subsection (a) shall be fined not more than $500 in the case of a first offense, and not more than $5,000 in the case of each subsequent offense.