We all know it’s important to protect patients’ personal health
information. Federal and state privacy laws and regulations govern the
interaction between providers, members, and plans.
Regulations enacted by the Substance Abuse and Mental Health Services
Administration (SAMHSA) address the confidentiality of health records for
people seeking treatment for substance use disorders from federally assisted
substance abuse programs. They are known as “Part 2 Programs” or
“Part 2 Providers.”
The SAMHSA Part 2 regulations are in addition to and separate from the
Health Insurance Portability and Accountability Act (HIPAA) privacy rules and
other state privacy laws and regulations. Unlike HIPAA violations, violations
of the Part 2 regulations may result in criminal penalties pursuant to the
Federal Code. The Part 2 regulations apply to the use and disclosure of patient
identifiable information for patients receiving diagnosis, treatment, or
referral for treatment for a substance use disorder that is created by a Part 2
Program.
Part 2 regulations
42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records)
governs how certain patient-identifiable information may be used, disclosed,
and re-disclosed. Specifically, the regulations require that information
subject to Part 2, including patient identifiable information from Part 2
Providers, may only be used or disclosed for payment and/or health care
operations purposes subject to:
- a valid patient consent, and;
- a notice that prohibits re-disclosure of the information that is subject to
the regulations.
Part 2 Providers must obtain consent from patients to disclose covered
information, including for disclosures to payers for payment. Information that
is further disclosed to third parties requires a separate and distinct
consent.
Learn more
To learn more about SAMHSA and Part 2 Providers, visit the SAMHSA website.