SAMHSA Part 2 Providers must obtain consent to disclose confidential information

January 27, 2020

We all know it’s important to protect patients’ personal health information. Federal and state privacy laws and regulations govern the interaction between providers, members, and plans.

Regulations enacted by the Substance Abuse and Mental Health Services Administration (SAMHSA) address the confidentiality of health records for people seeking treatment for substance use disorders from federally assisted substance abuse programs. They are known as “Part 2 Programs” or “Part 2 Providers.”

The SAMHSA Part 2 regulations are in addition to and separate from the Health Insurance Portability and Accountability Act (HIPAA) privacy rules and other state privacy laws and regulations. Unlike HIPAA violations, violations of the Part 2 regulations may result in criminal penalties pursuant to the Federal Code. The Part 2 regulations apply to the use and disclosure of patient identifiable information for patients receiving diagnosis, treatment, or referral for treatment for a substance use disorder that is created by a Part 2 Program.

Part 2 regulations

42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records) governs how certain patient-identifiable information may be used, disclosed, and re-disclosed. Specifically, the regulations require that information subject to Part 2, including patient identifiable information from Part 2 Providers, may only be used or disclosed for payment and/or health care operations purposes subject to:

  1. a valid patient consent, and;
  2. a notice that prohibits re-disclosure of the information that is subject to the regulations.

Part 2 Providers must obtain consent from patients to disclose covered information, including for disclosures to payers for payment. Information that is further disclosed to third parties requires a separate and distinct consent.

Learn more

To learn more about SAMHSA and Part 2 Providers, visit the SAMHSA website.