This fact sheet explains a 42 CFR Part 2 Program and how healthcare providers can determine how Part 2 applies to them.

Introduction

Title 42 of the Code of Federal Regulations (CFR) Part 2: Confidentiality of Substance Use Disorder Patient Records (Part 2) was first promulgated in 1975 to address concerns about the potential use of Substance Use Disorder (SUD) information in non-treatment based settings such as administrative or criminal hearings related to the patient. Part 2 is intended to ensure that a patient receiving treatment for a SUD in a Part 2 Program does not face adverse consequences in relation to issues such as criminal proceedings and domestic proceedings such as those related to child custody, divorce or employment. Part 2 protects the confidentiality of SUD patient records by restricting the circumstances under which Part 2 Programs or other lawful holders^[1] can disclose such records.

Part 2 Programs are federally assisted^[2] programs.^[3] In general, Part 2 Programs are prohibited from disclosing any information that would identify a person as having or having had a SUD unless that person provides written consent. Part 2 specifies a set of requirements for consent forms, including but not limited to the name of the patient, the names of individuals/entities that are permitted to disclose or receive patient identifying information, the amount and kind of the information being disclosed, and the purpose of the disclosure (see §2.31).^[4] In addition to Part 2, other privacy laws such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA)^[5] have been enacted. HIPAA generally permits the disclosure of protected health information for certain purposes without patient authorization, including treatment, payment, or health care operations.

To help stakeholders understand their rights and obligations under Part 2, the Office of the National Coordinator for Health Information Technology (ONC) and the Substance Abuse and Mental Health Services Administration (SAMHSA) have released two fact sheets illustrating how Part 2 might apply in various settings. This fact sheet focuses on helping health care providers determine how Part 2 applies to them by depicting scenarios they might encounter when caring for patients. Each scenario illustrates whether Part 2 applies to a theoretical disclosure of patient health information, and if so, what a provider would need to do to properly disclose the information according to Part 2.^[6]

SCENARIO 1: OPIOID TREATMENT PROGRAM

ABC Treatment Center (ABC) is a SAMHSA-certified Opioid Treatment Program that provides Medication-Assisted Treatment (MAT) for persons diagnosed with an opioid use disorder (OUD). ABC is accredited by a SAMHSA-approved accrediting body to dispense opioid treatment medications. Dr. Van Buren works at ABC and is registered with the Drug Enforcement Administration (DEA) to prescribe controlled substances for the treatment of OUD.

Charlie is a 33-year-old who hurt his back at work. He went to his primary care provider, Dr. Harrison, and was prescribed an opioid painkiller to manage his pain. Charlie became dependent on the painkiller and began illegally obtaining and using opioids after his prescription ran out. Charlie sought help from ABC and is now receiving methadone treatment for an OUD.

Charlie is seeing Dr. Harrison in two weeks to follow up about his back injury. Dr. Van Buren asked Charlie if he wanted his treatment information sent to his primary care provider, Dr. Harrison. Charlie agreed in a written consent to let Dr. Van Buren share his OUD treatment information with Dr. Harrison.

• Step 1 – Is ABC covered? Does Part 2 apply? Yes. ABC meets the definition of a program because it is an entity (other than a general medical facility) that holds itself out (e.g. through advertisements) as providing and provides SUD treatment services. Additionally, ABC is federally assisted because it has been certified by SAMHSA as an Opioid Treatment Program. Therefore, ABC meets the definition of a Part 2 Program.
• Step 2 – Can ABC disclose patient-identifying information? If so, how? Yes. As a Part 2 Program, ABC can disclose patient-identifying information if it obtains written patient consent. Because ABC Treatment Center holds itself out as a facility that provides SUD diagnosis, treatment, or referral for treatment, any patient information coming from ABC could identify the patient as having or having had a SUD.

To share Charlie’s record with Charlie’s primary care provider, Dr. Van Buren would need to obtain written consent from Charlie. The consent form would need to comply with all of the requirements specified in §2.31 of the Part 2 regulations, including identifying the SUD information in the “Amount and Kind” section and stating the purpose of the disclosure. Charlie’s information would also need to be accompanied by a notice of prohibition on redisclosure (described at §2.32) so that Dr. Harrison recognizes the information as Part 2- protected and does not further disclose the information without Charlie’s consent. See Figure 1, above, for an illustration.

SCENARIO 2: MIXED-USE FACILITY

Acme Community Mental Health Center (Acme) provides both SUD treatment services and mental health services. Acme recently installed an Electronic Health Record (EHR) system for the entire health center.

Dr. Tyler, an addiction specialist at Acme, only treats patients with SUDs. Typically, Dr. Tyler uses controlled substances for detoxification or maintenance treatment of a patient’s SUD.

Dr. Zachary, a psychiatrist at Acme, specializes in treating patients with mental disorders. Dr. Zachary does not treat patients for SUD.

Brenda has bipolar disorder and a SUD. She has been going to Acme for the past five years and sees Dr. Zachary for treatment of her bipolar disorder and Dr. Tyler for treatment of her SUD. At Brenda’s most recent visit, Dr. Tyler added to Brenda’s record that Brenda was suffering from migraines and had relapsed in her recovery from her SUD.

• Step 1 – Is Acme covered? Does Part 2 apply? Yes. Dr. Tyler meets the definition of a Part 2 Program because Dr. Tyler works at a general medical facility where her primary function is for the provision of diagnosis, treatment, or referral for treatment of patients with SUDs. Additionally, Dr. Tyler is considered federally assisted because she is registered with the DEA to prescribe controlled substances for detoxification or maintenance treatment of a SUD. Therefore, Dr. Tyler is considered a Part 2 Program.
• Step 2 – Can Acme disclose patient-identifying information? If so, how? This scenario is complex, with three types of health information to consider: SUD, migraines, and bipolar disorder.
  • SUD: Because Dr. Tyler meets the definition of a Part 2 Program, she needs to obtain Brenda’s consent to disclose information that would identify her as a patient with a SUD. This includes disclosures to other providers at Acme. Therefore, if Brenda’s SUD patient records are available to other providers at Acme through the facility’s EHR system, Brenda’s consent form must name Acme or individual providers at Acme if she wants to share her records with them (see Figure 2 for an illustration). The consent form would need to comply with all of the requirements specified in §2.31 of the Part 2 regulations (i.e., identify the SUD information in the Amount and Kind section, identify the purpose of the disclosure, etc.). Brenda’s information would also need to be accompanied by a notice of prohibition on re-disclosure (described at §2.32).
  • Migraines: In other circumstances, information about Brenda’s migraines would not identify her as a patient with a SUD and could potentially be disclosed without her consent. However, in this scenario, Dr. Tyler is a Part 2 Program. She only treats patients with a SUD and is recognized as such. Therefore, any information disclosed by Dr. Tyler would identify a patient as having or having had a SUD. Dr. Tyler would need to obtain Brenda’s consent to disclose any personally identifying information related to her care, even if that information would not otherwise indicate that she had a SUD.
  • Bipolar disorder: Dr. Zachary does not meet the definition of a Part 2 Program and Brenda’s diagnosis of bipolar disorder would not identify her as a patient with a SUD. Therefore, Part 2 does not prohibit Dr. Zachary from disclosing information related to Brenda’s treatment for bipolar disorder without her consent; however, state laws may restrict the disclosure of mental health information without patient consent or authorization.

Part 2 permits providers at Acme to acknowledge that Brenda is a patient at Acme without her consent. Because Acme is a mixed-use facility that provides services other than diagnosis, treatment, or referral for treatment for a SUD, acknowledging the presence of a patient at Acme would not necessarily identify that patient as having or having had a SUD. However, Acme providers could not disclose that Brenda is a patient of a Part 2 Program (e.g., that Brenda is a patient of Dr. Tyler) without her consent because that would identify her as having or having had a SUD. See figure 2, above, for an illustration.

SCENARIO 3: ACCOUNTABLE CARE ORGANIZATION (ACO)

Accountable care organizations (ACOs) and other value-based payment arrangements create incentives for health care providers to work together to deliver high quality, coordinated care for patients. ACOs are often composed of a variety of different providers and care settings.

Safari ACO includes Lion Family Practice (Lions), Tiger Physicians Group (Tigers), Giraffe Hospital (Giraffes), and Bear Community Mental Health Center (Bears). Dr. Fillmore works at Bears, a mixed-use facility. She is recognized as the facility’s lead SUD physician and primarily treats patients with SUDs. Dr. Fillmore often prescribes controlled substances for detoxification or maintenance treatment to his patients, including Pat.

• Step 1 – Is Dr. Fillmore covered? Does Part 2 apply? Yes. Dr. Fillmore meets the definition of a Part 2 Program because she is identified as a provider at a general medical facility whose primary function is to treat patients with SUDs. Additionally, Dr. Fillmore is considered federally assisted because she is registered with the DEA to prescribe controlled substances for detoxification or maintenance treatment of a SUD. Therefore, Dr. Fillmore meets the definition of a Part 2 Program.
• Step 2 – Can Dr. Fillmore disclose patient-identifying information to Pat’s other providers in the ACO? If so, how? Dr. Fillmore would need to obtain written consent from Pat to disclose information about Pat’s treatment for a SUD to any other of her treating providers from Lions, Tigers, Giraffes, or Bears. The consent form would need to comply with all of the requirements specified in §2.31 of the Part 2 regulations (i.e., specifically identify the SUD information in the “Amount and Kind” section, identify the purpose of the disclosure, etc.). Pat’s information would also need to be accompanied by a notice of prohibition on re-disclosure (described at §2.32). Rather than naming each of her treating providers on the consent form, Pat could name Safari ACO and use a general designation (e.g. “all of my treating providers”). If Pat used a general designation, the consent form must include a statement indicating that, upon request, Pat is entitled to receive a list of all entities that have received her information under the general designation. See Figure 3, above, for an illustration.

SCENARIO 4: INTEGRATED CARE SETTING

Today, many patients receive treatment for a SUD in a primary care or integrated care setting. These settings may provide both behavioral and physical health services, and individual providers may address all of a patient’s behavioral or physical health needs. Depending on its particular characteristics, an integrated care setting may not have a Part 2 Program even if it provides some services for the diagnosis, treatment, or referral for treatment of a SUD.

Blue Mountain Physician Group is a group of providers that treats the whole person in an integrated care setting. Although Blue Mountain does not advertise that it provides SUD treatment services, its physicians have received waivers from SAMHSA to prescribe buprenorphine for the treatment of opioid use disorders.

Dr. Pierce is a provider at Blue Mountain and treats a diverse group of patients. Occasionally, Dr. Pierce encounters patients with an opioid dependency and provides MAT with buprenorphine. However, he does this only for a handful of patients and such services do not constitute his primary function at Blue Mountain.

One of his patients, Brooke, came to see him for a respiratory infection. Brooke had previously received treatment for an OUD at an inpatient treatment facility not affiliated with Blue Mountain but recently relapsed. When Dr. Pierce saw Brooke for the respiratory infection, she mentioned that she was experiencing withdrawal symptoms from opioid use. Dr. Pierce prescribed an antibiotic for the infection and started MAT with buprenorphine.

• Step 1 – Is Dr. Pierce covered? Does Part 2 apply? Dr. Pierce is federally assisted because he is registered with the DEA to prescribe controlled substances for the treatment of OUD and has received a physician waiver from SAMHSA to prescribe buprenorphine. However, Dr. Pierce practices at a general medical facility where his primary function is not providing diagnosis, treatment, or referral for treatment for a SUD. Therefore, Dr. Pierce does not meet the definition of a Part 2 Program.
• Step 2 – Can Dr. Pierce disclose patient-identifying information? If so, how? In this case, Dr. Pierce is not a Part 2 Program and therefore is not subject to the disclosure restrictions of Part 2. However, before he discloses Brooke’s information, Dr. Pierce still needs to consider privacy requirements under HIPAA and state privacy laws.

Disclaimer

The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information contained herein.

License and Attribution

Substance Abuse and Mental Health Services Administration. (2018). Disclosure of Substance Use Disorder Patient Records: Does Part 2 Apply to Me? Fact Sheet.

This work resides in the public domain.