Confidentiality is a fundamental aspect of the physician-patient relationship, and it is especially important for patients with addiction.
Unfortunately, because of the legal and social ramifications associated with addiction, patients are often reluctant to tell their doctor that they may have addiction or consent to the disclosure of information about their addiction treatment. This is an unfortunate aspect of the stigma that surrounds this disease, and it exacerbates the addiction treatment gap that exists in this country.
To address this issue, federal regulations known as "42 CFR Part 2" protect the confidentiality of addiction treatment records of any person who has sought treatment for or been diagnosed with addiction at a federally assisted program. 42 CFR Part 2 aims to encourage people to seek treatment without fear of legal or social consequences. Improper sharing of a patient's addiction treatment information can lead to: negative perceptions and discrimination; criminal legal consequences, such as probation or jail time; and civil legal consequences, such as loss of child custody, employment or housing.
ASAM appreciates the heightened need for confidentiality protections of a patient's addiction treatment records as well as the need for complete and accurate medical information to be shared among a patient's treating clinicians. ASAM strives to strike this critical balance in its advocacy activities and will continue to call for needed privacy protections as 42 CFR Part 2 regulations and the underlying statute are updated.
Interoperability and Information Blocking
The 21st Century Cures Act encourages interoperability by penalizing healthcare providers and others who take part in information blocking. Below are helpful resources for addiction treatment professionals looking to learn more:
- Office of the National Coordinator for Health Information Technology (ONC):
- AMA two-part educational resource:
- Legal Action Center/ Center of Excellence for Protected Health Information:
- American Psychiatric Association:
Health Privacy Rule 42 CFR Part 2 Is Revised, Modernizing Care Coordination for Americans Seeking Treatment for Substance Use Disorders
On July 13, 2020, the Substance Abuse and Mental Health Services Administration (SAMHSA) announced the adoption of the revised Confidentiality of Substance Use Disorder Patient Records regulation, 42 CFR Part 2. The adoption of this revised rule aims to expand care coordination and quality through the Deputy Secretary’s Regulatory Sprint to Coordinated Care. A fact sheet summarizing the major revisions can be found here.
The Legal Action Center has provided new sample forms regarding substance use treatment confidentiality which can be found by clicking here.
ASAM, in collaboration with the American Academy of Addiction Psychiatry and the American Psychiatric Association, developed a webinar to help clinicians navigate the new regulation. You can view it here. The slides from the presentation can be found here. An FAQ document answering questions posed during the webinar can be found here.
For a helpful overview of federal laws, regulations, and trends for addiction treatment data, visit Legal Action Center/ Center of Excellence for Protected Health Information’s 2023 Privacy Update: Federal Laws, Regulations, and Trends for Substance Use Disorder and Mental Health Treatment Data.
Changes to 42 CFR Part 2 in the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020
The CARES Act includes the Protecting Jessica Grubb’s Legacy Act, which makes substantial changes to the statute underlying the substance use disorder (SUD) treatment record confidentiality regulations at 42 CFR Part 2:
- Initial Consent: Once prior, written consent from a patient is obtained, the content of a patient's SUD treatment record may be used or disclosed by a covered entity, business associate, or program subject to Part 2 for the purposes of treatment, payment, and health care operations permitted by theHealth Insurance Portability and Accountability Act (HIPAA).
- Redisclosure: Any information disclosed pursuant to the initial written consent may be redisclosed in accordance with HIPAA regulations.
- Revocation of Consent: It is permissible for a patient’s prior written consent to be given once for all such future uses or disclosures for purposes of treatment, payment, and health care operations, until such time as the patient revokes such consent in writing.
- Disclosure of De-Identified Information to a Public Health Authority: Information may be shared with a public health authority as long as requirements for de-identification of protected health information are met as established under the HIPAA privacy regulation.
- Patient Education: The Secretary of Health and Human Services (HHS) is directed to update regulations within one year so that covered entities and entities creating or maintaining SUD patient records provide notice, written in plain language, of privacy practices including a statement of the patient's rights and a description of each purpose for which the covered entity is permitted or required to use or disclose protected health information without the patient’s written authorization.
- Requirement for Breach Notification: Enforcement moves under Office for Civil Rights (OCR) in HHS and penalties for breach will be assessed in accordance with HIPAA.
- Use of Records in Criminal, Civil, or Administrative Investigations or Proceedings: Except when authorized by a court order or patient consent, records may not be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, State, or local authority with respect to the following activities:
- evidence in any criminal prosecution or civil action before a Federal or State court;
- proceeding before a Federal, State, or local agency;
- for a law enforcement purpose or to conduct any law enforcement investigation; and
- any application for a warrant
- Anti-Discrimination: Expands existing patient protections to prevent discriminatory behavior towards patients suffering from a substance use disorder in relation to:
- admission, access to, or treatment for health care;
- hiring, firing, or terms of employment, or receipt of worker’s compensation;
- the sale, rental, or continued rental of housing; and
- social services and benefits provided by Federal, State or local governments.
The final regulations that are necessary to implement and enforce these changes have yet to be published.
- SAMHSA has two fact sheets regarding 42 CFR Part 2 regulations, issued prior to the July 13, 2020 announced revisions:
- Does Part 2 Apply to me?
- This fact sheet explains a 42 CFR Part 2 Program and how healthcare providers can determine how Part 2 applies to them.
- How do I exchange Part 2 data?
- This fact sheet describes how 42 CFR Part 2 applies to the electronic health records with a Part 2 Program.
- It is permissible for state laws, for the disclosure of confidential information on substance use disorder care, to be more restrictive than these federal regulations. However, state laws may not override them. If a state law is not stricter and conflicts with federal regulations, then the state law must yield to the federal regulations. The below resources from the George Washington University’s Hirsh Health Law and Policy Program and the Robert Wood Johnson Foundation's website, Health Information and the Law, can help treatment clinicians know if their state laws are more restrictive than the federal regulations.