Addiction Treatment Record Protections to Conform with HIPAA Requirements

By: Jeffrey Lynne March 21, 2024 1:04 am

By:  Jeffrey Lynne, Esq. and Laura Stinson, University of Miami School of Law (2L)

On February 16, 2024, the Department of Health and Human Services (HHS), through the Substance Abuse and Mental Health Administration (SAMSHA), released a final rule on changes of 42 CFR Part 2, also known as Part 2, to align with the process contained in the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Part 2 is most known for its codification of confidentiality for Substance Use Disorder (SUD) patient records. Through Part 2, certain records related to services covered under Part 2 programs are not attainable by police, landlords, employers, judges, or others unless specifically requested.

Changes to this rule include the separation of Part 2 information in patient records from the general electronic health record available to non-part-2 providers.  This aims to facilitate the coordination of care activities by non-Part 2 providers and ensures that new records from non-Part 2 providers will not be subject to Part 2. In addition, this rule permits SUD patients to consent to the disclosure and use of their records to an entity, such as a federal agency, without a specific person named as the disclosure recipient.

Significantly, this rule also permits non-opioid treatment programs and non-central registry treating providers to query a central registry and determine whether their patients are already receiving opioid treatment through a member program. This provision aims to prevent duplicative enrollments in SUD treatment medication and care. Other changes from this rule relate to expansions of protection for Part 2 program patients in relation to undercover agents and informants, the disposition of Part 2 patient records, research disclosures, clarification of audit and evaluation disclosures, and specifics related to declared emergencies resulting from natural disasters. 

Part 2 has very specific requirements and guidelines for turning over SUD patient records to any third party. Merely receiving a subpoena or court order is not sufficient. A very specific process must be adhered to and followed otherwise liability may arise for the treatment program.

For more information, please contact Jeffrey Lynne, Esq., at jlynne@bmulaw.com

Latest Post