Federal law protects the confidentiality of patient records of persons treated for drug abuse, including those with AIDS. These regulations protect both oral and written information about the patient. Disclosures of information are permitted with patient consent, if needed to meet a medical emergency, for purposes of research or evaluation, and by court order. Disclosure of AIDS status to protect the health and safety of clinical and laboratory personnel may be made without consent, but confidentiality must still be protected. In addition, State and local laws may either require or restrict disclosure of information on AIDS patients. Breaches of confidentiality may be punishable by criminal liability and civil and punitive damages. In addition, release of erroneous information could result in a defamation suit and attendant liability. If a program diagnoses an AIDS-positive person, it has a legal responsibility to inform the patient of the diagnosis. A duty to warn endangered third parties also may exist. Programs have a duty to practice sound medicine and observe acceptable standards of care; thus, programs should adopt practices suitable to management of AIDS patients. Special precautions may be needed for the treatment of minors with AIDS. Federal and State and local laws also may prohibit discrimination in access to treatment and employment based on handicap. Finally, confidentiality, privacy, and consent issues must be considered by programs conducting research; and special considerations apply in the management of dying and incompetent patients. 16 notes and 6 references.