Confused by Confidentiality? A Primer
on 42 CFR Part 2
by Susan Awad
Just about anyone who has ever received medical care has heard of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the law that regulates the use and disclosure of Protected Health Information (PHI) held by “covered entities” such as health plans. But far fewer are familiar with the special privacy protections afforded to alcohol and drug abuse patient records by 42 Code of Federal Regulations (“CFR”) Part 2.
The privacy provisions in 42 CFR Part 2 were motivated by the understanding that stigma and fear of prosecution might dissuade persons with substance use disorders from seeking treatment. To add an extra layer of protection on these records, the regulations outline under what limited circumstances information about a patient’s treatment may be disclosed with and without the patient’s consent. Who and what are covered can be confusing, though. Thankfully, the Legal Action Center has developed a handy set of FAQs for the Substance Abuse and Mental Health Services Administration, which are summarized here:
- 42 CFR Part 2 applies to any individual or entity that is federally assisted and holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment (42 CFR § 2.11). Most drug and alcohol treatment programs are federally assisted. For-profit programs and private practitioners that do not receive federal assistance of any kind would not be subject to the requirements of 42 CFR Part 2 unless the State licensing or certification agency requires them to comply. However, any clinician who uses a controlled substance for detoxification or maintenance treatment of a substance use disorder requires a federal DEA registrationand becomes subject to the regulations through the DEA license.
- The regulations restrict the disclosure and use of alcohol and drug patient records which are maintained in connection with the performance of any federally assisted alcohol and drug abuse program (42 CFR § 2.3(a)). The restrictions apply to any information disclosed by a covered program that “would identify a patient as an alcohol or drug abuser …” (42 CFR §2.12(a) (1)). In laymen’s terms, the information protected by 42 CFR Part 2 is any information disclosed by a covered program that identifies an individual directly or indirectly as having a current or past drug or alcohol problem, or as a participant in a covered program.
- With limited exceptions, 42 CFR Part 2 requires patient consent for disclosures of protected health information even for the purposes of treatment, payment, or health care operations. Consent for disclosure must be in writing.