Recently, the 42 CFR Part 2 regulations, which serve to protect substance abuse disorder patient records, were revised. Their revised regulation facilitates better coordination of care in response to the opioid epidemic, while maintaining confidentiality of substance abuse records.
How Have the Substance Abuse Records Confidentiality Rules Changed?
The new substance abuse records confidentiality rules do not alter the basic framework for confidentiality protection of substance use disorder (SUD) patient records created by federally assisted SUD treatment programs. 42 CFR Part 2 continues to prohibit law enforcement’s use of SUD patient records in criminal prosecutions against patients, absent a court order. Part 2 also continues to restrict the disclosure of SUD treatment records without patient consent, other than as authorized by law in the context of a medical emergency, or for the purpose of scientific research, audit, or program evaluation.
Do you have an effective HIPAA compliance program?
Find out now by completing the HIPAA compliance checklist.
Changes to 42 CFR Part 2 include the following:
◈ Now, an SUD patient may consent to disclosure of the patient’s Part 2 treatment records to an entity (e.g., the Social Security Administration), without having to name a specific person as the recipient for the disclosure.
◈ Providers may now make disclosures for the purpose of “payment and health care operations,” provided written consent is given. The list of what constitutes payment and health care operations has been expanded under the new rules to include care coordination and case management activities.
◈ Non-OTP (Opioid Treatment Program) and non-central registry treating providers are now eligible to consult a central registry, to determine whether their patients are already receiving opioid treatment through a member program.
◈ Opioid treatment programs are now merited to enroll in a state prescription drug monitoring program (PDMP), and may report data into that program when dispensing controlled substances.
◈ Declared emergencies resulting from natural disasters (e.g., hurricanes) that disrupt treatment facilities and services are now considered “bona fide medical emergencies,” for the purpose of disclosing SUD records without patient consent under Part 2.
◈ Disclosures for research under 42 CFR Part 2 are permitted by a HIPAA-covered entity or business associate, to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule on Research on Human Subjects.
◈ Court-ordered placement of an undercover agent or informant within a 42 CFR Part 2 Program has been extended to a period of 12 months, and courts are now authorized to further extend the period of placement, through a new court order.
The new rules go into effect on August 14, 2020.
