Confidentiality is the cornerstone of the Administrative Simplification sections of HIPAA and its amendments. In many cases, certain records require more protection than HIPAA and/or state laws provide. Those records include behavioral health records and the subset of behavioral health records related to substance use disorder. Congress passed legislation codified at 42 C.F.R. Part 2 to provide that level of protection. In 2020, Congress revised the regulations regarding the release of records involving behavioral health as well as substance use disorder. Given the increase in the number of addiction medicine programs, both independent programs and those under the auspices of a hospital, this article will discuss the regulations found in Part 2 and the newest regulations regarding substance use disorder and treatment records.
To grant greater protections to substance use disorder and treatment records, Congress created the regulations found in Part 2 in 1975. These regulations addressed concerns about substance use disorder diagnosis and treatment information for nontreatment reasons. Individuals receiving treatment for substance use disorder no longer had to be concerned that that information could be released and used against them in criminal or domestic proceedings, including divorces, child custody hearings, or employment matters.
Part 2 substance use disorder program
So, what is a Part 2 substance use disorder program? The program is defined at 42 C.F.R. § 2.11 as:
(1) An individual or entity (other than a general medical facility) who holds itself out as providing, and provides; substance use disorder diagnosis, treatment, or referral for treatment; or
(2) An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
(3) Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.[1]
To qualify for Part 2 protections, the entity providing the substance use disorder services must also be federally assisted, i.e., it must be managed by a federal office or agency and have receipt of federal funding. Many facilities receive federal funding through Medicare, Medicaid, Tricare, or the Children’s Health Insurance Program (CHIP) and, therefore, meet the requirements to be “federally assisted.”[2]
Under the regulations revised in 2017, specific requirements are set for obtaining consent to release an individual’s records from a Part 2 program.[3] When determining the best way to release information, especially information for minors, it is necessary to consult state law. Many states have regulations incorporating the Part 2 regulations into state law or providing even greater protection; however, some states have weaker laws. Ohio is the one state whose state law is stricter than the Part 2 regulations.[4] One key item in Part 2 consent is the requirement to have specific language for release of substance use disorder so that the individual understands those records and agrees to that release.
HIPAA & HITECH alignment
In 2020, Congress revised the substance use disorder regulations yet again. This time they attempted to bring the regulations more in line with HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act. These new regulations were released as part of the Coronavirus Aid, Relief and Economic Security (CARES) Act and were effective August 14, 2020.[5] The changes needed to fully implement the regulations were passed in March 2021. Importantly, CARES Act provisions were not included in the regulations when they were published in July 2020. The CARES Act simply made changes to the enabling sections of Part 2. Significant changes to Part 2 made based on those enabling section changes include:
-
Releasing records without consent for treatment, payment, or healthcare operations when recipients are other Part 2 programs, covered entities, or business associates (as defined by HIPAA).
-
Allowing disclosure of information to another Part 2 program or other substance use disorder provider during federal- or state-declared natural or other disasters.
-
Allowing release of de-identified substance use disorder records to public health authorities.
-
Prohibiting use of substance use disorder records in civil, criminal, legislative, or administrative proceedings other than by court order or patient consent.
-
Providing additional protections against discrimination from intentional or inadvertent disclosure of substance use disorder records.
-
Integrating elements of HIPAA, including:
-
Redisclosure as allowed under HIPAA
-
HIPAA fines and penalties in lieu of criminal enforcement
-
HIPAA breach notification requirements
-
Accounting of Disclosures replaces the previous List of Disclosures
-
Right to request restrictions on use or disclosure
-
While the rules around consent for treatment, payment, and healthcare operations have been relaxed, all other releases still require consent, as established by Part 2. Consent must be in writing and obtained before any disclosure. Individuals can revoke their consent at any time. This revocation must also be in writing and does not impact any release that occurred before the revocation was received. One concern is what happens to those entities that received the information prior to revocation. Questions left to be answered include:
-
Is there an obligation on the part of the originating facility to notify other entities that received that information of the revocation?
-
Does the patient have an obligation to notify those other entities? If so, does this mean an accounting of disclosures must be provided to the patient when a revocation notification is received?
Key areas for compliance/privacy to review
Other similarities to HIPAA include providing a Notice of Privacy Practices, the model of which was to be developed one year after the enactment of the CARES Act. The question is, in a hospital-based setting, is this Notice of Privacy Practices necessary, or is the one already in place at the hospital or medical facility sufficient? Compliance and/or privacy personnel should review their institution’s Notice of Privacy Practice and revise it if appropriate.
As with HIPAA, a breach-risk analysis must be conducted if patient information is acquired, accessed, used, or disclosed inappropriately. A breach is presumed unless:
-
The disclosure is the result of an unintentional, good faith acquisition, access, or use by a workforce member or person under the authority of a covered entity or business associate if there is no further unpermitted use or disclosure
-
It was an inadvertent disclosure by and to a person with authorized access at a covered entity or business associate if there is no further unpermitted use or disclosure
-
The covered entity can demonstrate through a risk assessment there is a low probability the protected health information has been compromised[6]
When a breach is determined to have occurred, the same steps of notification to the individual involved and to the Department of Health & Human Services Office for Civil Rights found in HIPAA apply.
Revisions to Part 2 in the 2020 regulations
Part 2 and the newest regulations provide additional protections through antidiscrimination rules and prohibitions on use in court proceedings. The 2020 regulations provide specific protections against discrimination based on Part 2 records or information about the individual disclosed either inadvertently or intentionally if those records relate to:
-
Admission, access to, or treatment for healthcare
-
Hiring, firing, or terms of employment, or receipt of worker’s compensation
-
Sale, rental, or continued rental of housing
-
Access to courts at any level
-
Access to, approval of, or maintenance of social services and benefits provided or funded by federal, state, or local governments
-
No recipient of federal funds may discriminate against the patient based upon the Part 2 records in affording access to the services provided with such funds
The recent regulations also change the penalties and enforcement of violations of Part 2. Previously, the penalties were criminal in nature. With these new regulations, the penalties and enforcement found under HIPAA apply to violations of Part 2.
For proceedings in court, any substance use disorder records require a court order or patient consent to be entered into evidence. These records cannot be disclosed or used in any civil, criminal, administrative, or legislative proceeding conducted by any federal, state, or local authority against a patient, including:
-
The record or testimony shall not be entered into evidence in any criminal prosecution or civil action before a federal or state court.
-
The record or testimony shall not form part of the record for decision or otherwise be considered in any proceeding before a federal, state, or local agency.
-
The record or testimony shall not be used by any federal, state, or local agency for a law enforcement purpose or to conduct any law enforcement investigation.
Minors consent for substance use disorder treatment records
Adolescents’ and other minors’ ability to access substance use disorder and addiction services is based on state law. For instance, in Ohio, adolescents at age 12 may consent to treatment for a substance use disorder or substance treatment program without parental consent. If a minor has consented to their own treatment, they are the only one who can consent to releasing the information in those records or revoking that consent. Parental/legal guardian authorization is still required to release all other records. This can cause friction between the parent and minor child, so providers must understand the regulations and support the minor and the parent as necessary. Under 42 C.F.R. § 2.14 in states that allow a minor to consent:
If a minor patient acting alone has the legal capacity under the applicable state law to apply for and obtain substance use disorder treatment, any written consent for disclosure authorized under subpart C of this part may be given only by the minor patient. This restriction includes, but is not limited to, any disclosure of patient identifying information to the parent or guardian of a minor patient for the purpose of obtaining financial reimbursement. These regulations do not prohibit a part 2 program from refusing to provide treatment until the minor patient consents to the disclosure necessary to obtain reimbursement, but refusal to provide treatment may be prohibited under a state or local law requiring the program to furnish the service irrespective of ability to pay.
In states where the minor cannot consent to their own treatment, 42 C.F.R. § 2.14 says:
(1) Where state law requires consent of a parent, guardian, or other individual for a minor to obtain treatment for a substance use disorder, any written consent for disclosure authorized under subpart C of this part must be given by both the minor and their parent, guardian, or other individual authorized under state law to act in the minor’s behalf.
(2) Where state law requires parental consent to treatment, the fact of a minor’s application for treatment may be communicated to the minor's parent, guardian, or other individual authorized under state law to act in the minor’s behalf only if:
(i) The minor has given written consent to the disclosure in accordance with subpart C of this part; or
(ii) The minor lacks the capacity to make a rational choice regarding such consent as judged by the part 2 program director under paragraph (c) of this section.
(c) Minor applicant for services lacks capacity for rational choice. Facts relevant to reducing a substantial threat to the life or physical well-being of the minor applicant or any other individual may be disclosed to the parent, guardian, or other individual authorized under state law to act in the minor’s behalf if the part 2 program director judges that:
(1) A minor applicant for services lacks capacity because of extreme youth or mental or physical condition to make a rational decision on whether to consent to a disclosure under subpart C of this part to their parent, guardian, or other individual authorized under state law to act in the minor’s behalf; and
(2) The minor applicant’s situation poses a substantial threat to the life or physical well-being of the minor applicant or any other individual which may be reduced by communicating relevant facts to the minor’s parent, guardian, or other individual authorized under state law to act to act in the minor’s behalf.
It is important to remember that the above regulations apply to minors who are not emancipated. If a minor is emancipated through court action, marriage, becoming a parent, or in the military, they can then consent to all their own healthcare. One caveat is, in the case of a minor who has a child, some states allow the minor to consent for their child’s healthcare, but the minor’s parent/legal guardian still has the right to make decisions for the minor. In other words, becoming a parent does not necessarily grant emancipation. The major impetus behind allowing adolescents the right to make decisions related to substance use and addiction is that many will not seek treatment if they know their parent or legal guardian will find out.[7] State law determines if an adolescent or other minor has rights to consent to their own healthcare and in what circumstances.
Additional changes include:
-
The definition of “records” is revised to provide an exception for information communicated orally by a Part 2 program to a non-Part 2 provider for treatment with consent from the patient. The exception says that that information does not become a record, even when the non-Part 2 provider reduces the oral information to a writing.[8]
-
If that non-Part 2 provider records the information shared orally about the substance use disorder and provides treatment based on that information, it does not by itself make the medical record subject to 42 C.F.R. Part 2 as long as those records are segregated from other patient records.[9]
-
Patients can consent to disclosure of their information for operations to certain entities without naming a specific individual. There are also special instructions for health information exchanges and research institutions.[10]
-
Non-Part 2 providers do not need to redact information in their or another Non-Part 2 record. Redisclosure is allowed if expressly permitted by written consent of the patient or under Part 2 regulations.[11]
-
Disclosure for care coordination and case management is allowed with written consent.[12]
-
Section 2.67 amends the time period an undercover agent and informant can be court ordered into a Part 2 program to 12 months, which starts when the undercover agent or informant is placed in the program.
Summary
Quite a few changes have come about regarding confidentiality of substance abuse records. The Part 2 regulations have offered additional protections to minors and adults who access services at a substance use disorder or addiction facility. Many regulations were duplicative of HIPAA requirements, so in 2020, Congress brought the regulations more in line with each other. Following HIPAA for all privacy violations will likely allow an organization to comply with the regulations. State law must also be considered to ensure both federal and state regulations are met. Providers and administrators of substance use disorder or addiction services must be aware of these changes to serve their patients/clients better. Communication of protections offered under HIPAA and Part 2, especially to minors and their parents/legal guardians, is vital. Compliance professionals and others involved in compliance and health information management should closely monitor any disclosures of substance use disorder or substance treatment services to ensure those disclosures are consistent with the revised regulations.
Takeaways
-
Confidentiality and consent remain key components of substance use treatment services, even with the regulatory changes implemented in 2020.
-
The 2020 regulatory changes brought 42 C.F.R. Part 2 more in line with HIPAA and its amendments.
-
Compliance and privacy personnel should review the Notice of Privacy Practices requirements under the revised Part 2 regulations and revise their institutions’ notices as necessary.
-
Compliance and privacy personnel should work with their health information management departments and other areas that maintain/release substance use treatment records to ensure policies, procedures, and practices align with the new regulations.
-
When determining who can consent to receive services and release records from a substance use treatment facility, state law must be consulted for adolescents.