Part 2 substance use disorder program

So, what is a Part 2 substance use disorder program? The program is defined at 42 C.F.R. § 2.11 as:

(1) An individual or entity (other than a general medical facility) who holds itself out as providing, and provides; substance use disorder diagnosis, treatment, or referral for treatment; or

(2) An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or

(3) Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.^[1]

To qualify for Part 2 protections, the entity providing the substance use disorder services must also be federally assisted, i.e., it must be managed by a federal office or agency and have receipt of federal funding. Many facilities receive federal funding through Medicare, Medicaid, Tricare, or the Children’s Health Insurance Program (CHIP) and, therefore, meet the requirements to be “federally assisted.”^[2]

Under the regulations revised in 2017, specific requirements are set for obtaining consent to release an individual’s records from a Part 2 program.^[3] When determining the best way to release information, especially information for minors, it is necessary to consult state law. Many states have regulations incorporating the Part 2 regulations into state law or providing even greater protection; however, some states have weaker laws. Ohio is the one state whose state law is stricter than the Part 2 regulations.^[4] One key item in Part 2 consent is the requirement to have specific language for release of substance use disorder so that the individual understands those records and agrees to that release.

HIPAA & HITECH alignment

In 2020, Congress revised the substance use disorder regulations yet again. This time they attempted to bring the regulations more in line with HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act. These new regulations were released as part of the Coronavirus Aid, Relief and Economic Security (CARES) Act and were effective August 14, 2020.^[5] The changes needed to fully implement the regulations were passed in March 2021. Importantly, CARES Act provisions were not included in the regulations when they were published in July 2020. The CARES Act simply made changes to the enabling sections of Part 2. Significant changes to Part 2 made based on those enabling section changes include:

• Releasing records without consent for treatment, payment, or healthcare operations when recipients are other Part 2 programs, covered entities, or business associates (as defined by HIPAA).

• Allowing disclosure of information to another Part 2 program or other substance use disorder provider during federal- or state-declared natural or other disasters.

• Allowing release of de-identified substance use disorder records to public health authorities.

• Prohibiting use of substance use disorder records in civil, criminal, legislative, or administrative proceedings other than by court order or patient consent.

• Providing additional protections against discrimination from intentional or inadvertent disclosure of substance use disorder records.

• Integrating elements of HIPAA, including:

  • Redisclosure as allowed under HIPAA

  • HIPAA fines and penalties in lieu of criminal enforcement

  • HIPAA breach notification requirements

  • Accounting of Disclosures replaces the previous List of Disclosures

  • Right to request restrictions on use or disclosure

While the rules around consent for treatment, payment, and healthcare operations have been relaxed, all other releases still require consent, as established by Part 2. Consent must be in writing and obtained before any disclosure. Individuals can revoke their consent at any time. This revocation must also be in writing and does not impact any release that occurred before the revocation was received. One concern is what happens to those entities that received the information prior to revocation. Questions left to be answered include:

• Is there an obligation on the part of the originating facility to notify other entities that received that information of the revocation?

• Does the patient have an obligation to notify those other entities? If so, does this mean an accounting of disclosures must be provided to the patient when a revocation notification is received?