You already know that privacy is important to your patients. But when it comes to treating substance use disorders, privacy and confidentiality is one of patients’ top concerns. That’s where 42 CFR Part 2 comes in: it goes above and beyond HIPAA to extend special privacy protections to substance use disorder (SUD) patients. Why? Fear of PHI disclosure could prevent some patients from seeking help, and Part 2 helps alleviate some of that fear by assuring SUD patients that their PHI won’t be shared without consent.
Recap: 42 CFR Part 2 took effect in 2017. An updated version with additional restrictions went into effect in February 2018. The law adds additional privacy protections (beyond HIPAA) regarding substance abuse disorder patient records.
Unfortunately, there is a lot of confusion surrounding 42 CFR Part 2 and what providers who treat patients with substance use disorder need to do to stay compliant. Below, 4 essential things you must know to ace Part 2 compliance.
- 42 CFR Part 2 is much stricter than HIPAA.
The HIPAA privacy rule spells out how patient PHI can be shared, but 42 CFR Part 2 goes even further by spelling out specifically how the PHI of substance use disorder (SUD) patients may be shared. For example, HIPAA allows providers to release patient records for “treatment, payment, or healthcare operations,” without patient consent. Part 2 does not. Consent from the patient is required to distribute the PHI for these purposes.
- There are several exceptions to the consent rule.
Providers may not release substance abuse patient records without the patient’s consent except in the following circumstances:
- Medical emergencies
- Child abuse/neglect reports (required by state law)
- Reporting a crime against treatment program personnel or on treatment program property
- Certain types of audits or evaluations of the treatment program
- Research requests
- Qualified Service Organization Agreements
- Court orders authorizing disclosure (in response to a subpoena, search warrant, or other law enforcement request)
- Updates to 42 CFR Part 2 are intended to ease care coordination efforts.
Instead of having to consent to the release of their SUD PHI to each treating provider, patients may opt to disclose it to “treating providers” of entities like Health Information Exchanges, accountable care organizations, community health centers, and medical centers. The patient can also opt for a blanket consent for a specific time period.
- 42 CFR Part 2 only applies in specific circumstances.
While HIPAA applies to broadly and in most patient situations, that’s not so with Part 2. In fact, Part 2 only applies to “programs” that receive federal assistance. According to the rule, a program is defined as “any person or organization that holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment, referral for treatment or prevention.”
Part 2 also applies to SUD PHI for patients who receive treatment, diagnosis, or referral for treatment from:
- “An identified unit of a general medical facility that holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment, referral for treatment or prevention.”
- “Medical personnel or other staff in the general medical care whose primary function is to provide [SUD treatment] services.
