Psychiatrists are well aware of their duty to safeguard protected health information pursuant to HIPAA. Many, however, may be unaware that they are held to a higher standard of care regarding records containing information about substance use treatment. Under federal law 42 CFR, Part 2, “Confidentiality of Substance Use Disorder Patient Records” (Part 2), psychiatrists, psychologists, licensed clinical social workers, mental health professionals, and substance use treatment programs must be cognizant of the heightened protections that restrict disclosure of substance use treatment records. The Substance Abuse and Mental Health Services Administration (SAMHSA) recently updated Part 2, effective on March 21, 2017 (Part 2 Final Rule).

This article provides an overview pertaining to Part 2’s restrictions on disclosure of such records and communications between patients and their substance use treatment providers and programs. This article does not address individual state laws, which may vary. Psychiatrists will benefit from consulting with an attorney or their risk management professional prior to responding to requests for records pertaining to substance use treatment.

Identifying Protected Information

In short, Part 2 provides protection to patient records and identifying information maintained in connection with any federally assisted alcohol or drug use treatment program. The goal of the law is to encourage persons with substance use issues to seek help without fearing disclosure of their private information related to their treatment. This law pertains to the records of any individual who has received a diagnosis or sought treatment for alcohol or drug use at a federally assisted program, even those who were identified with such substance use issues following arrest, and applies to any information that directly identifies a patient as an alcohol or drug abuser, or that links the patient to an alcohol or drug treatment program.¹ Thus, medical information that does not link the patient to current or past substance use, or identify the patient as a participant in a Part 2 program, is not subject to the Part 2 requirements, but would still be subject to HIPAA and state privacy laws.

With respect to treatment providers, this law applies to any individual provider or entity that is federally assisted and holds itself out as providing alcohol or drug abuse diagnosis, treatment, or referral for treatment. Thus, for a psychiatrist to be considered covered by the law, they must be (1) “federally assisted” and (2) meet the definition of a program under 42 CFR § 2.11.

Under the updated Part 2 regulations, a “program” is defined as:

1. An individual or entity (other than a general medical facilities) who holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
2. An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
3. Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.”²

Programs are considered “federally assisted” if they have a license or other authorization from any U.S. department or agency, including, but not limited to (1) a certification of Medicare provider status; (2) authorization to conduct treatment for methadone; or (3) registration to dispense a substance used in medication assisted treatment (MAT) under the Controlled Substances Act. Programs are also considered federally assisted if they receive any federal financial assistance—regardless of whether this assistance goes toward substance or alcohol abuse treatment—or permit tax deductions through granting tax exempt status to the program.

As with most regulations, state laws may vary.   Part 2 restrictions on disclosure/re-disclosure will not preempt state law, but will control in the absence of a stricter standard. That is, if a state otherwise prohibits disclosure permitted by Part 2, then the state’s more stringent law will govern the disclosure.

Disclosure of Protected Information

Part 2 requires providers to advise their patients in writing that federal laws protect the confidentiality of alcohol and drug use treatment records.³ Records protected under Part 2 may be disclosed (1) if the patient provides written consent or (2) under certain conditions in which the benefits of disclosure outweigh the risk to the patient.

A patient may provide written consent for disclosure of their records to a third party so long as the disclosure indicates the patient’s name and signature, purpose of the disclosure, scope of disclosure, date of consent, that the consent is subject to revocation at any time, and a termination date for the consent. Additionally, Part 2 now allows for additional options for patients to complete the “To Whom” section. Patients may now include:

• The name of an individual;
• Name of an entity that has a “treating provider relationship” with the patient;
• Name of an entity that the patient does not have a treating provider relationship with, but is a third-party payer;
• Name of an entity that does not have a treating provider relationship, is not a third party, but includes either:
• The name of specific participants; or
• The name of the entity participants that have a treating provider relationship; or
• A general designation (“all treating providers”).⁴

Programs may release a patient’s records directly to the patient even absent written consent. The goal is to protect the patients, not to obfuscate the patients’ access to their own treatment records. However, from a risk management standpoint, it is important to have documentation of the request retained in the patient’s record, and before releasing records directly to the patient consider seeking guidance.

Absent a patient’s written consent, a program and/or provider may disclose substance use treatment records to third parties under the following situations: (1) to medical personnel in a medical emergency; (2) to qualified personnel for purposes of conducting scientific research, management or financial audits, or program evaluation so long as the individual identities of the patients are not disclosed in any manner; or (3) if authorized by court order.⁵

Production of Records

If production of substance use records is authorized by one of the circumstances discussed above, the program/provider must document the nature and extent of the disclosure including (1) the name of the person to whom the information was disclosed; (2) the name of the person at the program who disclosed the information; (3) the date and time of the disclosure; and (4) why the information was disclosed absent the patient’s written consent. The program and/or provider should communicate to both the patient and the third-party receiving the documents that such disclosure is made pursuant to the protections of 42 CFR, Part 2.

Re-Disclosure Considerations

Under Part 2, substance use records may not be re-disclosed absent the patient’s written consent. The prohibition on re-disclosure applies to information that would identify directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder, such as indicated through standard medical codes, descriptive language, or both, and allows other health-related information shared by the Part 2 program to be re-disclosed, if permissible under the applicable law.⁶

In addition, records produced pursuant to a patient’s written consent must include the following statement verbatim as a means of advising the recipient of the records of their duty to safeguard the records and the prohibition against re-disclosure:⁷

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is not sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient. 

Part 2 and Prescriptions

Providers must also exercise caution when issuing prescriptions for patients covered by Part 2 regulations. For example, a provider may only send prescription information to a pharmacy electronically if the patient provides consent since this is considered disclosure of Part 2 protected information. Pharmacies, in turn, must also receive consent from a patient to send information back to a prescription drug monitoring program (PDMP). However, if the patient takes a paper prescription to a pharmacy, the pharmacy is permitted to report the information to a PDMP because the law surmises that the patient chose to forgo the privacy protection at that point. Thus, there are occasions when Buprenorphine may be reported to a PDMP, while Methadone, on the other hand, is not reported to PDMPs because it is not permitted to be prescribed (only dispensed).

Considerations When Treating Minors and Patients With Diminished Capacity

When working with minors or those who have a guardian or conservator, the psychiatrist must determine whether the minor patient acted alone in obtaining substance use treatment. If so, that minor is the only person who may provide written consent for disclosure of records protected under Part 2. This means that the provider is restricted from providing even the parents of the minor with information even to obtain financial reimbursement. A program may, however, refuse to treat a minor until the minor provides consent necessary to obtain reimbursement for the services provided.

If the patient lacks the capacity to make rational decisions, then the psychiatrist may disclose information relevant to reducing a threat to the life or physical well-being of the minor or other individual to a parent or guardian who is authorized to act on the patient’s behalf.

Psychiatrists must also be aware, however, that state laws requiring parental, guardian/conservator consent prior to treatment and disclosure of information may vary. Should you have questions about consent to treatment, contact your risk management professional or attorney.

Conclusion

Where applicable, it is the psychiatrist’s duty to adhere to 42 CFR, Part 2 regarding disclosure of substance use records. Psychiatrists and programs must maintain substance use records in a secure location to ensure confidentiality and, if all requirements are met, produce only the limited records required. Attorneys and risk management professionals can help substance use programs and substance use treatment providers navigate the requirements set forth in this law.