Substance Abuse Disorder Treatment:
42 CFR Part 2 and HIPAA
42 CFR Part 2 (“Part 2”) is a federal regulation that requires substance abuse disorder treatment providers to observe privacy and confidentiality restrictions with respect to patient records. The HIPAA Privacy Rule also limits use and disclosures of information found in patient records.
What Regulations Apply to Substance Abuse Disorder Treatment Programs?
Substance abuse disorder treatment programs are subject to the privacy regulations imposed under 42 CFR Part 2, AND the HIPAA Privacy Rule. Covered entities must comply with each. When one regulation imposes a stricter standard than the other, the covered entity must follow the stricter standard. Generally, 42 CFR Part 2 imposes more strict standards than HIPAA.
42 CFR Part 2’s general rule places privacy and confidentiality restrictions upon substance use disorder treatment records.
Under the Part 2 general rule, providers may not disclose information in a substance abuse disorder (SUD) patient’s record, unless the provider can either obtain consent, or identify an exception to the general rule that specifically authorizes the disclosure.
When Can Substance Abuse Disorder Medical Record Information be Disclosed under 42 CFR Part 2?
As noted above, SUD medical record information may be disclosed if the patient consents to the disclosure.
Substance abuse disorder treatment programs most often make disclosures after a patient has signed a consent form that meets the requirements of 42 CFR Part 2. In light of HIPAA, a Part 2 consent form must include the following elements:
- Name or general designation of the program or person permitted to make the disclosure;
- Name or title of the individual or name of the organization to which disclosure is to be made;
- Name of the patient;
- Purpose of the disclosure;
- How much and what kind of information is to be disclosed;
- Signature of the patient (and, in some states, a parent or guardian);
- The date on which signed consent is given;
- A statement that the consent is subject to revocation at any time except to the extent that the program has already acted on it; and
- The date, the event, or condition upon which consent will expire if consent has not been previously revoked.
In addition, when substance abuse disorder programs operating under Part 2 disclose information pursuant to a consent form, they must include a written statement that the information cannot be redisclosed.
If consent cannot be obtained, a provider must rely upon a Part 2 exception permitting disclosure. Under Part 2, exceptions permitting disclosures include:
- When there is a patient medical emergency.
- When state law requires the reporting of incidents of suspected child abuse and neglect to the appropriate state or local authorities.
- When there are communications from part 2 program personnel to law enforcement agencies or officials which are directly related to a patient’s commission of a crime on the premises of the part 2 program or against part 2 program personnel, or to a threat to commit such a crime.
- When an individual determined by the part 2 program to be qualified to conduct an audit or evaluation of the part 2 program, or other lawful holder, is conducting an audit or evaluation that encompasses record review.
- Research requests.
- When communications between a part 2 program and a qualified service organization of information are needed by the qualified service organization to provide services to the program.
- When a valid court order authorizing disclosure and use of patient records is issued.
What are the Differences Between When Disclosures Can be Made Under Part 2, and When Disclosures Can be Made Under HIPAA?
There are two main differences between Part 2 substance abuse disorder disclosure limitations and the HIPAA Privacy Rule disclosure limitations.
The HIPAA Privacy Rule permits disclosures without patient consent for treatment, payment, or healthcare operations. However, for patients with substance abuse disorders, such disclosures may lead to stigma and discrimination by healthcare providers, the potential loss of insurance, and even loss of employment.
As noted above, Part 2 substance use disorder treatment regulations require either that a patient consent, or that the disclosure be permitted under a specific exception.
The two regulations also differ in the amount of privacy protections afforded or patient records in criminal and civil legal proceedings.
Under HIPAA, a HIPAA-covered health care provider or health plan may share protected health information if it has a court order, or, if it receives a valid subpoena from a party to the litigation requesting medical records. Part 2’s requirements are much stricter. Part 2 requires that a specific court order authorize disclosure of SUD records. Persons having a legally recognized interest in the disclosure – and only those persons- may apply for the court order.
