Richard Chapman (richard.chapman@uky.edu) is Chief Privacy Officer and Litany Webster (litany.webster@uky.edu) is Corporate Compliance Manager at UK HealthCare in Lexington, KY.
42 CFR Part 2 (Part 2) was enacted in 1975 to protect the confidentiality of patient records related to substance use disorder treatment from applicable Part 2 programs. The purpose of Part 2’s additional confidentiality safeguards is to reduce the risk of harmful consequences for individuals who seek treatment, such as loss of employment, prosecutions and incarceration, health treatment discrimination, and child custody issues if the patient’s treatment record is not protected.[1] From 1987 to 2017, the regulation remained substantially unchanged. However, amidst criticism that the regulation was no longer in tune with the current state of modern healthcare, the regulation was updated in 2017 and 2018 with the goal to better align it with the Health Insurance Portability and Accountability Act (HIPAA), the modern integrated healthcare model, and electronic health information exchanges (HIE).
These revisions left intact the overarching purpose of Part 2. Providing a complete overview of Part 2 and the 2017–2018 revisions would take several articles. Accordingly, the purpose of this article is to provide a foundational understanding of the fundamentals of 42 CFR Part 2. This article will discuss Part 2’s use and disclosure restrictions, how to determine Part 2 program applicability, disclosure consent form requirements, notice prohibiting re-disclosure, and security policy and procedure requirements for electronic health records.
Part 2’s restrictions on use and disclosure of patient information
To maintain the confidentiality of patient information pertaining to substance use disorder treatment, Part 2 imposes restrictions on the use and disclosure of patient records obtained by and from Part 2 programs. The term “substance use disorder treatment” in this article encompasses the treating of a substance use disorder, diagnosing the disorder, and/or the referral for substance use disorder treatment. Accordingly, the disclosure of any information identifying a patient as having received substance use disorder treatment from a Part 2 program is restricted, barring any codified exceptions or exclusions in the regulation, unless express written consent is obtained from the patient or legal guardian.[2] Further, the regulation prohibits using this information to initiate or substantiate criminal charges or to conduct a criminal investigation against the patient.[3] These restrictions do not apply to a diagnosis made solely for the purpose of obtaining evidence for law enforcement or a diagnosis for an overdose or alcohol intoxication that evidences the patient is not suffering from a substance use disorder.[4]
Determining the applicability of Part 2 to your entity
How can an organization determine if it qualifies as a “Part 2 program” and is thus subject to the use and disclosure requirements? In order to make this determination, the program must undertake a two-part analysis by first determining whether it receives federal assistance and then determining whether the Part 2 regulation’s “program” definition applies.[5]
For the first part of the analysis, the regulation provides four instances where a program qualifies as receiving federal assistance.[6] A program receives federal assistance if it:
-
Is conducted in some degree by a division of the United States;
-
Is carried out pursuant to a license, certification, registration, or other authorization from a United States’ department or agency (e.g., participating in the Medicare program, holding a DEA registration for dispensing controlled substances used to treat substance use disorder, being federally authorized to conduct a withdrawal management program);
-
Is supported by funds from a division of the United States, or is conducted by a local government unit that receives federal funds that may be spent on substance use disorder programs (even if the funds are not used for the program/substance use disorder treatment); or
-
Receives assistance from the IRS in the form of income tax deductions for contributions or the granting of tax-exempt status.[7]
The second part of the applicability determination, pertaining to the “program” definition in the regulation, is the slightly more difficult part of the analysis. When evaluating an individual or entity not in a general medical facility or an identified unit in a general medical facility, the program definition applies if the individual/entity/unit holds itself out as providing substance use disorder treatment and actually does provide such services.[8] Similarly, if medical personnel or staff in a general medical facility has the primary function of providing substance use disorder treatment and is identified as providing such services, the program definition is applicable.[9]
The complexity of determining Part 2 program applicability becomes apparent when you consider the multiple scenarios where substance use disorder treatment may occur, especially when considering large medical facilities with emergency room (ER), inpatient, and outpatient services. The Part 2 regulation, as well as Substance Abuse and Mental Health Services Administration (SAMHSA), has provided several scenarios to help facilitate organizations in making their own applicability determinations.[10] For example, if an ER provider in a general medical facility makes a referral for substance use disorder treatment, the referral is not subject to Part 2 restrictions unless the ER provider’s primary function is substance use disorder treatment/referrals and is identified as such in the community or the ER, as a unit, has advertised itself as providing such services.[11]
The analysis is the same if an ER provider provides a prescription for a medication to assist in treating substance use disorder. Alternatively, a similar referral or prescription from a private practitioner, rehabilitation program, or medical facility unit that participates in the Medicare program and advertises itself as providing substance use disorder treatment will be subject to Part 2 restrictions and the private practice, program, or unit is considered a qualifying Part 2 program.
Finally, if upon completing the applicability analysis, the determination is that the individual or program does not qualify as a Part 2 program, it is important to recognize that there are still scenarios where the use and disclosure restrictions are applicable. The same use and disclosure restrictions are applicable to any individual or entity that receives patient-identifying records from a Part 2 program.[12] To this end, the regulation requires Part 2 programs to provide a notice of prohibition on re-disclosing substance use disorder treatment information when disclosing such information pursuant to a valid patient consent. (A more detailed discussion on Part 2’s prohibition on re-disclosing applicable records is included below.)