To protect patients seeking addiction treatment, the federal government passed strict regulations limiting the disclosure of substance abuse patient records. Substance abuse treatment programs must not only comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) but also 42 CFR Part 2.

Is Your Substance Abuse or Mental Health Facility in Compliance With 42 CFR Part 2?

While nearly every healthcare professional receives HIPAA training, they often move practices and facilities, and you cannot assume their previous practice provided compliance training for 42 CFR Part 2.

If you are involved in substance-use disorder treatment, ask yourself the following questions:

• Are you confident that your facility is in compliance with 42 CFR Part 2?
• Are you confident that your staff is aware of the stricter standard?

If the answer to either of these questions is no, you need to take steps to keep your facility and your staff compliant today.

What is 42 CFR Part 2?

Title 42 of the Code of Federal Regulations Part 2 (42 CFR Part 2) is a federal law that protects the privacy rights of people seeking treatment for substance abuse disorders. The law is designed to reassure patients that sharing information about past or current drug use will not result in adverse consequences related to criminal proceedings or domestic proceedings, such as those related to child custody, divorce, or employment.

How Do I Know if 42 CFR Part 2 Applies to Me?

Part 2 only applies to federally assisted substance use programs, known as “Part 2 programs.”

• “Federally assisted”, as defined by § 2.12 (b), generally encompasses any program that receives federal funding, is conducted by the federal government, is considered tax exempt by the IRS, is registered with the DEA to dispense controlled substances for the treatment of substance abuse, or receives Medicaid or Medicare reimbursement.
• A “program” is defined as
  • An individual/entity other than general medical facility which holds itself out as providing and provides alcohol/drug diagnosis, treatment, or referral for treatment; or
  • An identified unit within a general medical facility which holds itself out as providing and provides alcohol/drug diagnosis, treatment, or referral for treatment; or
  • Medical personnel or other staff in a general medical care facility whose primary function is the provision of alcohol/drug diagnosis, treatment, or referral for treatment and who are identified as such.

What Are the Requirements for Providers Under 42 CFR Part 2?

Under 42 CFR Part 2, substance use treatment providers may not share a substance abuse disorder patient’s record, nor disclose any information within those records, without express written permission from the patient. Patient consent must always be written and include explicit information about the records to be shared and list the names of individuals or entities who will receive the information.

Of course, some exceptions apply.For example, providers can disclose patent information without written consent in:

• Internal communications
• Medical emergencies
• Reports of crimes on the provider’s premises or against provider personnel
• Allegations of child abuse or neglect (when required by state law)
• Qualified audits or evaluations
• Research
• Communication with qualified service organizations (that provide services to the provider)

Keep in mind that providers CANNOT share records with law enforcement without a special court order – even if officers have a general court order, a subpoena, or a general court order.

How Does 42 CFR Part 2 Differ From HIPAA?

The Federal Coronavirus Aid, Relief, and Economic Security (CARES) Act signed March 27, 2020, amended 42 CFR Part 2 to align more closely with HIPAA. However, distinct and important differences remain:

• HIPAA allows care providers to make disclosures when working with other healthcare professionals to coordinate treatment; 42 CFR Part 2 does not.
• Law enforcement cannot access treatment records covered by 42 CFR Part 2 without a special court order that depends on the satisfaction of higher standards. HIPAA generally allows law enforcement to access treatment records.
• Part 2’s privacy protections follow the records after they are disclosed. A notice prohibiting re-disclosure must accompany the records and the recipient of the disclosed records must also abide by 42 CFR Part 2.
• HIPAA applies to most types of patient information, while 42 CFR Part 2 only protects substance use disorder information.

Beware: Just because something is allowed under HIPAA does not mean it is allowed under 42 CFR Part 2. When in conflict, the more restrictive law always prevails.

What Are the Penalties for Violating 42 CFR Part 2?

Violating 42 CFR Part 2 has historically resulted in exposure to criminal fines under Title 18 of the United States Code. Pursuant to the CARES Act, penalties for violations of Part 2 now align with penalties for violations of HIPAA.

Fines are outlined in Title 18 of the U.S. Code.