Simone Biles and ADHD: how an athlete in treatment applies for authorization to compete and who may read the medical report

By Ramon Martins Andrade, attorney (OAB/RJ 188.374)

English translation of an article first published in Portuguese: read the original.

On 13 September 2016, three weeks after the close of the Rio Games, the World Anti-Doping Agency (WADA) attributed to a Russian cyber-espionage group known as Fancy Bears the intrusion into one of its databases and the online publication of therapeutic use exemption records of American athletes, among them the gymnast Simone Biles, winner of four gold medals in Rio. The same day, USA Gymnastics issued a statement saying that Biles had applied for and obtained the exemption and that, “by virtue of the TUE, Biles has not broken any drug-testing regulations, including at the Olympic Games in Rio”; the international federation, the United States Olympic Committee and the US anti-doping agency (USADA) confirmed it. The athlete herself wrote on social media, as recorded by the Associated Press and by theGrio: “I have ADHD and I have taken medicine for it since I was a kid.” She said she believed in clean sport, had always followed the rules and would continue to do so. And she added: “Having ADHD, and taking medicine for it is nothing to be ashamed of.”

The account is hers, and it ends there: this article does not reproduce any leaked document, does not name the medication and asserts nothing about the athlete’s doctors or treatment beyond what she herself made public. No rule was broken. Something else happened, and it is the subject of this article: a medical file handed to a system that promised strict confidentiality ended up on the internet without its owner having chosen to disclose it. Two years later, on 4 October 2018, the United States Department of Justice made public, in Pittsburgh, an indictment of seven officers of the Russian military intelligence service (GRU), accused of hacking American and international anti-doping agencies and of releasing medical information on about 250 athletes after the 2016 Games; these are accusations, not convictions. Two questions remain for the Brazilian athlete with ADHD: is a prescription enough to compete? And who reads the medical report?

ADHD in elite sport: what science has measured

Attention-deficit/hyperactivity disorder is one of the most studied neurodevelopmental conditions. The benchmark meta-regression for children and adolescents, conducted by a Brazilian group (Polanczyk, de Lima, Horta, Biederman and Rohde, American Journal of Psychiatry, 2007), pooled 102 studies with 171,756 participants from every region of the world and arrived at a pooled prevalence of 5.29%. In adults, the systematic review by Song and colleagues (Journal of Global Health, 2021) estimated a prevalence of 2.58% for persistent ADHD, with onset in childhood, and of 6.76% for symptomatic ADHD, which, adjusted to the 2020 world population, corresponds to about 140 million and 366 million adults, respectively.

In sport, the reference is the set of papers the International Olympic Committee published in 2019 in the British Journal of Sports Medicine. The consensus statement on mental health in elite athletes (Reardon and colleagues, 2019) starts from two findings: mental health symptoms and disorders are common among elite athletes and cannot be separated from physical health, and diagnosis must distinguish character traits typical of the elite athlete from dysfunctional psychosocial adaptations. The narrative review on ADHD that accompanied the consensus (Han, McDuff, Thompson, Hitchcock, Reardon and Hainline, 2019) estimated that prevalence among student and elite athletes may be 7% to 8%, possibly higher in certain sports, and noted that the symptoms and characteristics of the disorder influence the very choice of a sporting career. Appropriate management, it concluded, matters for safety and for performance, with pharmacological and psychosocial options.

In August 2026, the IOC published an update of that statement (Reardon and colleagues, British Journal of Sports Medicine, 2026), built on a systematic review and the Delphi method. The text recommends routine screening with validated instruments, states that treatment may include psychotherapy, medication and other modalities suited to the context, and concludes that, with appropriate support and treatment, many athletes with mental health symptoms and disorders can continue to train and compete safely. In a companion paper, the same journal adapts the recommendations to low- and middle-income countries, a category that includes Brazil (Castaldelli-Maia and colleagues, 2026). Treating an athlete’s ADHD is health care, not a performance shortcut; the surprise usually comes from the rules.

A prescription is not an exemption: two regimes that do not replace each other

In Brazil, an athlete being treated with a stimulant lives under two control regimes at once. The first is a health regime. Methylphenidate and lisdexamfetamine are listed in List A3 of Annex I to Portaria SVS/MS 344/1998 (the Ministry of Health ordinance on controlled substances), the list of psychotropic substances “subject to the ‘A’ Prescription Notification”, as updated by RDC Anvisa 473/2021 (a resolution of Anvisa, the Brazilian health regulatory agency); since RDC 873/2024, that notification is valid “throughout the National Territory, for a period of 30 (thirty) days”. In pharmacovigilance alert GGMON 10/2025, Anvisa confirms the indications of these medicines for ADHD in children over 6, adolescents and adults.

The second regime is sporting and answers a different question: may the substance be used by someone who competes? WADA’s 2026 Prohibited List places stimulants in class S6, among the substances prohibited in competition; lisdexamfetamine appears in S6.A, among the non-specified stimulants, and methylphenidate in S6.B, among the specified ones, a distinction that weighs on the sanction and is examined in the article on doping caused by prescribed medication (in Portuguese). “In competition” has a definition of its own: unless a different period has been approved for the sport, it runs from 11:59 p.m. on the day before a competition in which the athlete is entered until the end of that competition and of the sample collection.

In the recommendations of the French agency (AFLD), reproduced by a federation in that country, the confusion is summed up in a sentence addressed to athletes: do not confuse a prescription with a TUE. The same material adds, in the opposite direction, that the exemption does not replace the prescription. WADA’s own international standard says the same thing from the other side: granting a TUE does not assess whether the substance is the most clinically appropriate or safe, nor whether its use is lawful in every jurisdiction. The prescription legitimizes the treatment before the health authorities; the exemption legitimizes the presence of the substance in the anti-doping test. The athlete needs both.

The international rules: four criteria, retroactivity and the 2027 standard

The therapeutic use exemption originates in the World Anti-Doping Code and is detailed in the International Standard for Therapeutic Use Exemptions (ISTUE), which is mandatory for all signatories. In the version in force until 31 December 2026, art. 4.2 requires the athlete to show, on the balance of probabilities, four cumulative conditions: that the substance is needed to treat a diagnosed medical condition supported by relevant clinical evidence; that the therapeutic use will not produce any enhancement of performance beyond a return to the athlete’s normal state of health; that there is no reasonable permitted therapeutic alternative; and that the need does not result from prior use, without an exemption, of a prohibited substance. The official comment adds that the physician must explain why the chosen treatment is the most appropriate, and that it is not always necessary to try and fail with the alternatives first.

On 5 December 2025 WADA approved a new version of the standard, which enters into force on 1 January 2027. The official comparison of the two versions shows that the first criterion now deals only with the diagnosis (the athlete has a diagnosed medical condition supported by relevant clinical evidence); that the indication for the treatment and the absence of a permitted alternative move up to second place, with a comment stating that it may not be necessary to try and fail with alternatives; and that the data protection standard to which the ISTUE refers is renamed the International Standard for Data Protection. For ADHD, the file is worth what it demonstrates about the diagnosis, not the authority of whoever signs it.

There is also a little-known rule. The standard allows a retroactive application in listed cases, among them that of an athlete who used out of competition, for therapeutic reasons, a substance prohibited only in competition, which is exactly the case of stimulants; in that situation, the anti-doping organization must permit the application. The official comment, however, warns that meeting the condition does not guarantee approval and strongly recommends that such athletes keep a medical file ready.

Brazil: from the Pelé Act to the General Sports Act, and what the ABCD requires

The Brazilian structure has had a statutory basis since 2016. Lei 13.322/2016 inserted into Lei 9.615/1998 (the Pelé Act) art. 48-B, which defines the Autoridade Brasileira de Controle de Dopagem (ABCD, the Brazilian Doping Control Authority) as the national anti-doping organization, and art. 55-A, which created the Justiça Desportiva Antidopagem (the Anti-Doping Sports Justice), with a tribunal and a prosecution office “endowed with autonomy and independence”. The Lei Geral do Esporte (Lei 14.597/2023, the General Sports Act) reproduced and updated this design in its section on the prevention and control of doping. Art. 174 provides that doping control aims to guarantee doping-free competitions, “to promote the preservation of health” and to preserve equality among competitors, and requires institutions to observe the World Code. Art. 175, IV, grants the ABCD the exclusive power “to issue therapeutic use exemptions, respecting the powers of international organizations provided for in the World Anti-Doping Code”.

In practice, the ABCD’s TUE page (in Portuguese) lists the four criteria of art. 4.2 of the ISTUE and asks for the diagnosis “clearly described”, the name of the medicine and of the substance, the dose, the route and the duration of treatment, with tests and reports proving the diagnosis and the need. The assessment falls to the Comissão de Autorização de Uso Terapêutico (CAUT, the Therapeutic Use Exemption Committee), made up of independent physicians (art. 99 of the Código Brasileiro Antidopagem, the Brazilian Anti-Doping Code), which has up to 21 calendar days to decide. For athletes who are not of international level, art. 98 requires the application to be filed no less than thirty days before the competition; a refusal may be appealed to the CAUT Appeal Panel within fifteen days (arts. 101 and 102). The exemption is valid on the terms on which it was granted: a change of dose, route, duration or frequency requires contacting the ABCD and may require a new application, and renewal must be requested at least 30 days before expiry. In ADHD, where dose adjustment is routine, this detail matters.

The international dimension completes the picture. A TUE granted by the ABCD does not require formal recognition by another national organization (art. 105 of the Brazilian Code), but § 1 excludes from that rule international-level athletes and those competing in an international event, for whom the exemption is valid only if recognized by the international federation or by the major event organizer; absent automatic recognition, the athlete must apply for it (§ 2). An international-level athlete applies directly to his or her federation (art. 100). The ABCD states that checking recognition is the athlete’s responsibility. An athlete with a national TUE who is called up for a competition abroad may arrive there without an effective exemption.

There is also the question of access to treatment, which amateur athletes know well. The ADHD protocol of the SUS (Brazil’s public health system) has not incorporated methylphenidate or lisdexamfetamine, after Conitec (the national committee on the incorporation of health technologies) found the evidence weak and the budget impact high (Reports nos. 601 and 610, 2021), a subject covered in the article on Venvanse and Ritalin in the SUS (in Portuguese). For those who depend on the public system, the detailed report the CAUT requires has to be drawn from a care pathway that is often fragmented.

The medical report is sensitive data and has a defined recipient

A TUE application gathers exactly the kind of information the law protects most. At the international level, the ISTUE requires the application to be handled in accordance with the principles of strict medical confidentiality (art. 9.3): committee members, consulted experts and staff sign confidentiality agreements and must keep confidential all medical information and all details of the application, including the names of the physicians. Art. 9.5 limits its use: the information serves to assess the application and for any investigation of a possible anti-doping rule violation. The International Standard for the Protection of Privacy and Personal Information (ISPPPI, 2021 version) classifies health data as sensitive personal information and requires organizations to apply a higher level of security to it (art. 9.2), with internal access only on a need-to-know basis.

At the Brazilian level, Lei 13.709/2018 (LGPD, the General Data Protection Act) defines “data concerning health” as sensitive personal data (art. 5, II) and allows its processing only in the cases listed in art. 11. For the ABCD, the most fitting legal basis is compliance with a legal or regulatory obligation (art. 11, II, “a”), since the General Sports Act entrusts it with issuing exemptions; even so, the principles of purpose, adequacy and necessity in art. 6 apply, as does the duty under art. 46 to adopt security measures “capable of protecting personal data from unauthorized access”. The Brazilian Anti-Doping Code incorporates the same logic: art. 346 authorizes the ABCD and WADA to process the data provided by the athlete “in compliance with data protection legislation”, and art. 337 requires the information to be disclosed only “to strictly relevant persons who need to know it, and their confidentiality must be ensured”.

The consequence is objective: the athlete hands over the report for one purpose, the assessment of the exemption, and that purpose defines who may read it. Club, sponsor and press are not part of that circuit. Within the club, the physician’s confidentiality towards club officials follows rules of its own under the Código de Ética Médica (the Code of Medical Ethics; art. 73 deals with professional secrecy), examined in the article on the club physician and the athlete’s confidentiality (in Portuguese). Disclosing the diagnosis publicly, as Biles did, is the data subject’s choice; no one is obliged to expose a report or a dose to dispel insinuations. It is worth reading the Athlete Declaration that accompanies the ABCD form before signing, because it is the document that describes the authorized recipients.

Three countries, three ways of requiring proof

The standard is global, but national agencies translate the diagnostic criterion in different ways. In the United States, USADA’s checklist for stimulants to treat ADHD starts from a requirement of documentary sufficiency: the file must allow the panel of psychiatrists and psychologists to reach the same diagnosis without ever seeing the patient. It is not enough, the text says, for the physician to state that he or she diagnosed ADHD; the clinical notes must indicate which DSM criteria are present, which are not, and how this is known. The agency also asks for statements from the athlete, a family member and a teacher or coach on the onset of symptoms before age 12 and their presence in more than one setting, and requires exhaustion, overtraining and dietary restriction to be ruled out.

The United Kingdom opted for standardization. The UK Anti-Doping policy on TUEs for ADHD (May 2023) requires a specific form and a report from a specialist with declared experience in ADHD, and accepts only certain diagnostic instruments (ACE+, CAADID or DIVA-5 for adults) and severity scales based on the DSM. Renewal depends on an annual review letter with current symptoms, a re-administered scale, the effects over the past year and a plan for the next; incomplete applications may be referred for a second opinion from a psychiatrist on a register kept by the agency itself.

France tiered the process by level. According to the regulatory framework published on the basis of the rules of the French agency (AFLD), an international-level athlete applies to the international federation and a national-level athlete applies to the AFLD, whose committee of experts examines the case, with a complete file thirty days before the first competition and a retroactive TUE only in an emergency, an acute condition or exceptional circumstances; for athletes below national level, a prior TUE is not mandatory and the retroactive route is available without conditions. The three paths converge on one point: what is assessed is the quality of the file.

When the file leaks: who is liable

The 2016 case forces us to consider what happens when confidentiality fails. At the international level, the ISPPPI provides that, in the event of a security breach likely to significantly affect the rights of those concerned, the responsible organization must inform them as soon as reasonably possible, describing the nature of the breach, its possible consequences and the remedial measures, and must keep a record of the incident (art. 9.5). In Brazil, the LGPD requires the controller to notify the Autoridade Nacional de Proteção de Dados (ANPD, the National Data Protection Authority) and the data subject of any incident that may entail relevant risk or harm (art. 48); the deadline and form of that notification are examined in the article on leaks of patient data (in Portuguese).

Civil liability comes next. Art. 42 of the LGPD requires a controller or processor who, in breach of data protection legislation, causes material or moral damage to compensate it, with joint and several liability in the cases of § 1. Art. 44 deems irregular any processing that “does not provide the security that the data subject can expect”, and its sole paragraph holds liable whoever, by failing to adopt the measures of art. 46, causes the damage. A criminal intrusion by a third party does not, in itself, settle the question of what security measures were adopted; the answer depends on a concrete investigation. If the leak comes from someone in the athlete’s circle, such as a club official or a professional who had access to the report, the duty of professional secrecy and the confidentiality rules of the Brazilian Code also come into play.

Before deciding

Treating ADHD is not doping, but the stimulant used in treatment is prohibited in competition and, with continuous use, calls for a prior exemption; a prescription and a TUE belong to different regimes. The Brazilian TUE and the authorization for an international competition may be distinct things, and recognition should be checked at the time of the call-up. The file submitted to the ABCD is health data with a defined purpose. In my view, an athlete with ADHD should prepare the application as if it were to be read by a committee that has never examined him or her, because that is exactly what happens, and keep a copy of everything submitted, so as to reconstruct the chain of access if the data turns up where it should not. Which substance, which dose and whether there is a permitted alternative are clinical decisions; when the problem is already an adverse analytical finding, the path is a different one, discussed in the article on doping caused by prescribed medication. If you are an athlete whose TUE was denied, whose international recognition is pending or whose medical data was exposed without authorization, get in touch with the firm: the firm reads the application, the decision and the deadlines before saying whether anything can be done.

About the author

Ramon Martins Andrade (OAB/RJ 188.374) is a lawyer who graduated from UFRJ in 2011, with master’s degrees from Université Sorbonne Nouvelle and from the Naval War College (EGN, Brazilian Navy). He is currently a researcher in Human Rights and Health at ENSP/Fiocruz.

This content is for information and education only. It does not constitute legal advice, advertising of results or any guarantee of outcome, under Rule 205/2021 of the Brazilian Bar Association (OAB).