SAMHSA and its agents are bound, not by HIPAA, but by two other Federal laws:

• Section 501(n) of the Public Health Service Act (42 U.S.C. 290aa)
• Sections 512 and 513 of the Confidential Information Protection and Statistical Efficiency Act of 2002 (P.L. 107-347).

These Federal laws prohibit SAMHSA from using identifiable information for any purpose other than the purpose for which it was collected, without the consent of the establishment or individual providing the information.

SAMHSA collects DAWN data for public health surveillance, to produce statistics to monitor drug-related morbidity and mortality at the local and national levels. SAMHSA may use identifiable data only for these purposes. Data are released only in de-identified form, and information is published only in aggregate form.

Unlawful disclosures by employees of SAMHSA or its contractors are subject to stiff penalties — up to 5 years in prison and fines of up to $250,000.