42 CFR Part 2 and HIPAA Care Coordination

Federal regulations at 42 CFR Part 2 (Part 2) protect patient records created by federally assisted programs for treatment of substance use disorders (SUDs). Part 2 generally requires a patient’s written consent before a Part 2 program provider can disclose patient records to another party.

Typically, when a patient consents to share Part 2 records, the recipient may only redisclose those records to a third party if the patient specifically consents to the redisclosure. Critics of Part 2’s redisclosure requirements maintain that the “no redisclosure” rule can deny patients life-saving care. What if, these critics say, information barred from redisclosure is needed by, say, a patient’s primary care physician who prescribes the patient medications that have harmful interactions with the substance to which a patient may be addicted?

HHS has responded to the criticism by issuing a Notice of Proposed Rulemaking (Proposed Rule) in November of 2022. The proposed rule updates Part 2 to allow Part 2 programs to use and share patients’ records following a single signed consent “for all future uses and disclosures for treatment, payment, and healthcare operations.” In other words, the proposed rule allows provider sharing of records in a similar manner to which HIPAA permits such sharing. More information about 42 CFR Part 2 and HIPAA care coordination is provided below.

42 CFR Part 2 and HIPAA Care Coordination: What’s in the Proposed Rule?

The proposed rule allowing for enhanced 42 CFR Part 2 and HIPAA care coordination permits Part 2 records to be redisclosed in any manner currently permitted by the HIPAA Privacy Rule, with certain exceptions. Per HHS Secretary Xavier Becerra, this change to Part 2 would “improve coordination of care for patients receiving treatment… To help ensure individuals do not forego life-saving care due to concerns about records disclosures.”

Lifting the existing re-disclosure rule allows for sharing of a significant amount of information that cannot currently be redisclosed. 

Part 2 currently prevents re-disclosure of records that relate to “the identity, diagnosis, prognosis, or treatment of any patient” regarding programs that involve: 

  • SUD education;
  • Prevention;
  • Training;
  • Treatment;
  • rehabilitation; 
  • or research that are run or overseen directly or indirectly by any U.S. government department or agency.

Make Sure You’re HIPAA Compliant

Rules for disclosing patient information can be confusing.

We can help you comply with all HIPAA rules!