HIPAA and substance abuse patients PHI

HIPAA applies to all protected health information, including substance abuse treatment information, while 42 CFR Part 2 provides additional, more stringent protections specifically for substance use disorder patient records. Healthcare providers and organizations should be aware of both sets of regulations and comply with them to safeguard substance abuse treatment information.

Confidentiality of substance abuse treatment information

HIPAA

The Privacy Rule defines protected health information (PHI) as any individually identifiable health information held or transmitted by a covered entity. This includes information related to an individual's past, present, or future physical or mental health condition, the provision of healthcare services, and payment for healthcare services, among other identifiers. Under HIPAA, substance abuse treatment information is considered PHI and receives the same privacy protections as other medical information. 

See also: HIPAA Compliant Email: The Definitive Guide

42 CFR Part 2

42 CFR Part 2 imposes stricter confidentiality requirements than HIPAA for substance abuse treatment information. These regulations are specifically designed to encourage individuals to seek treatment without fear of stigma or legal consequences. Substance abuse treatment information covered by 42 CFR Part 2 must be kept separate from other medical records and should be clearly labeled with specific notices about its confidentiality protections.

Patient consent

HIPAA requires healthcare providers to obtain patient consent to disclose substance abuse treatment information for purposes beyond treatment, payment, and healthcare operations. Patient consent is generally a requirement in order to disclose substance abuse treatment information, except in cases where HIPAA permits disclosure without consent, such as reporting abuse or harm to the patient or others.

42 CFR Part 2 requires written patient consent for the disclosure of substance use disorder treatment information. Patients have the right to revoke their consent at any time, except to the extent that action has already been taken based on the original consent. The revocation must be in writing.

Related: The elements of patient consent for email marketing

Exemptions to patient consent

Exemptions under HIPAA

1. Treatment, payment, and healthcare operations (TPO): HIPAA permits covered entities to use and disclose PHI for TPO purposes without the need for patient consent. Healthcare providers can share relevant information with other providers involved in the patient's treatment for billing and payment purposes.
2. Public health activities: HIPAA allows the disclosure of PHI to public health authorities for activities such as disease surveillance, reporting of communicable diseases, and public health investigations.
3. Health oversight activities: PHI can be disclosed to government agencies for health oversight activities, such as audits, investigations, and inspections of healthcare providers.
4. Law enforcement purposes: Covered entities can disclose PHI to law enforcement under certain circumstances, such as to comply with a court order or warrant, or in response to specific legal requirements.
5. Abuse or neglect reporting: HIPAA permits disclosures of PHI to appropriate authorities when there is reasonable suspicion of child abuse, elder abuse, or neglect.

Exemptions under 42 CFR Part 2

1. Medical emergencies: In situations requiring immediate medical attention to prevent harm, substance use disorder (SUD) treatment information can be disclosed without patient consent. The disclosure must be limited to those involved in the medical emergency.
2. Audit and evaluation activities: SUD treatment information can be disclosed for audit and evaluation purposes to ensure program compliance, quality improvement, and effectiveness.
3. Research, management, and administrative activities: Under certain conditions, SUD treatment information may be used by qualified personnel for research, management, and administrative purposes within the same organization that provided the treatment.
4. Central registries: Some states operate central registries for tracking and monitoring individuals receiving SUD treatment. 42 CFR Part 2 permits disclosure to these registries, but the consent requirements vary by state.
5. Court orders: A court may issue an order for the disclosure of SUD treatment information in certain legal proceedings. Patients must be given notice and an opportunity to raise objections before the disclosure occurs.

See also: What are the penalties for HIPAA violations?