[The Confidentiality of Alcohol and Drug Abuse Patient Records
Regulation]{.smallcaps}

[and the HIPAA Privacy Rule:]{.smallcaps}

[Implications for Alcohol and Substance Abuse Programs]{.smallcaps}

[June 2004]{.smallcaps}

![](media/image1.jpeg){width="0.8in" height="0.825in"}

TABLE OF CONTENTS

[I. Applicability 3](#__RefHeading___Toc69793935)

[A. Programs to which the Privacy Rule applies
3](#__RefHeading___Toc69793936)

[B. Information that is protected under Part 2 and the Privacy Rule
3](#__RefHeading___Toc69793944)

[C. When protections begin for someone seeking substance abuse treatment
4](#__RefHeading___Toc69793947)

[II. How the Privacy Rule affects disclosures of information
4](#__RefHeading___Toc69793949)

[A. The General Rule 4](#__RefHeading___Toc69793950)

[B. When disclosures are permitted 4](#__RefHeading___Toc69793953)

[1. Part 2 Consent^11^ and Privacy Rule Authorization
5](#__RefHeading___Toc69793954)

[2. Other permissible disclosures under Part 2
7](#__RefHeading___Toc69793978)

[a. When little or no changes may be needed
7](#__RefHeading___Toc69793980)

[i. Internal program communications 7](#__RefHeading___Toc69793982)

[ii. Crimes on program premises or against program personnel
8](#__RefHeading___Toc69793984)

[iii. Child abuse reporting 8](#__RefHeading___Toc69793986)

[iv. Medical emergencies 8](#__RefHeading___Toc69793988)

[v. Subpoenas and court-ordered disclosures
9](#__RefHeading___Toc69793995)

[b. When some change is required 9](#__RefHeading___Toc69793998)

[i. Disclosures that do not reveal patient-identifying information
9](#__RefHeading___Toc69793999)

[ii. Disclosures to agencies that provide services to programs
10](#__RefHeading___Toc69794004)

[iii. Audit and evaluation 11](#__RefHeading___Toc69794012)

[iv. Research 12](#__RefHeading___Toc69794017)

[III. Other Changes Required by the Privacy Rule^18^
12](#__RefHeading___Toc69794019)

[A. Patient Notice/Notice of Privacy Practices
12](#__RefHeading___Toc69794020)

[1. Notice content 12](#__RefHeading___Toc69794022)

[2. Distribution of the Notice 14](#__RefHeading___Toc69794048)

[B. Patient rights 15](#__RefHeading___Toc69794052)

[1. Right to request a restriction of uses and disclosures
15](#__RefHeading___Toc69794054)

[2. Right to access PHI 15](#__RefHeading___Toc69794057)

[3. The right to amend PHI 18](#__RefHeading___Toc69794084)

[4. Right to an accounting of disclosures of PHI
19](#__RefHeading___Toc69794108)

[C. Administrative Requirements 21](#__RefHeading___Toc69794141)

[1. Complaints about the program's privacy practices
21](#__RefHeading___Toc69794142)

[2. Other administrative requirements 22](#__RefHeading___Toc69794145)

[D. Security of information 23](#__RefHeading___Toc69794157)

[Conclusion 23](#__RefHeading___Toc69794160)

[For more information about the HIPAA Standards
24](#__RefHeading___Toc69794162)

> This is an educational document from the Substance Abuse and Mental
> Health Services Administration and the U.S. Department of Health and
> Human Services. It was prepared by SAMHSA staff and contractors in
> consultation with the Office of the General Counsel, the Office for
> Civil Rights and other offices and agencies within the U.S. Department
> of Health and Human Services, Washington, D.C.

The Confidentiality of Alcohol and Drug Abuse Patient Records Regulation

and the HIPAA Privacy Rule:

Implications for Alcohol and Substance Abuse Programs

**Introduction**

In the early 1970's, Congress recognized that the stigma associated with
substance abuse and fear of prosecution deterred people from entering
treatment and enacted legislation that gave patients a right to
confidentiality. For the almost three decades since the Federal
confidentiality regulations (42 CFR Part 2 or Part 2) were issued,
confidentiality has been a cornerstone practice for substance abuse
treatment programs across the country.

In December, 2000, the Department of Health and Human Services (HHS)
issued the "Standards for Privacy of Individually Identifiable Health
Information" final rule (Privacy Rule), pursuant to the Administrative
Simplification provisions of the Health Insurance Portability and
Accountability Act of 1996 (HIPAA), 45 CFR Parts 160 and 164, Subparts A
and E.[^1] Substance abuse treatment programs that are subject to HIPAA
must comply with the Privacy Rule.[^2] [^3] Substance abuse treatment
programs that already are complying with Part 2 should not have a
difficult time complying with the Privacy Rule, as it parallels the
requirements of Part 2 in many areas. Programs subject to both sets of
rules must comply with both, unless there is a conflict between them.
Generally, this will mean that substance abuse treatment programs should
continue to follow the Part 2 regulations. In some instances, programs
will have to establish new policies and procedures or alter existing
policies and practices. In the event a program identifies a conflict
between the rules, it should notify the Substance Abuse and Mental
Health Services Administration of HHS immediately for assistance in
resolving the conflict.

This guidance is for substance abuse treatment programs that are subject
to and already complying with the confidentiality requirements of Part
2.[^4] It explains which programs must also comply with the Privacy Rule
and outlines what compliance will require. The guidance is not a legal
opinion. To comply with the Privacy Rule, programs should apply this
guidance to their individual situations; programs may also want to call
upon State agencies, provider organizations and legal counsel for
assistance in establishing and implementing the practices and policy
changes required by the Privacy Rule.

[]{#__RefHeading___Toc69793935 .anchor}**I. Applicability**

A.  []{#__RefHeading___Toc69793936 .anchor}**Programs to which the
    Privacy Rule applies**

The Privacy Rule applies to "covered entities" which are health plans,
health care clearinghouses and health care providers[^5] who transmit
health information in electronic form (*i.e.*, via computer-based
technology) in connection with transactions for which HHS has adopted a
HIPAA standard in 45 CFR Part 162. See 45 CFR §160.103. HIPAA
transactions that a substance abuse treatment program[^6] might engage
in include:

-   Submission of claims to health plans

-   Coordination of benefits with health plans

-   Inquiries to health plans regarding eligibility, coverage or
    benefits or status of health care claims

-   Transmission of enrollment and other information related to payment
    to health plans

-   Referral certification and authorization (*i.e.,* requests for
    review of health care to obtain an authorization for providing
    health care or requests to obtain authorization for referring an
    individual to another health care provider)

If a substance abuse treatment program transmits health information
electronically in connection with one or more of these Part 162
transactions, then it must comply with the Privacy Rule. Part 162 may be
amended in the future to cover additional transactions.[^7]

[]{#__RefHeading___Toc69793944 .anchor}**B. Information that is
protected under Part 2 and the Privacy Rule**

Part 2 protects any and all information that could reasonably be used to
identify an individual and requires that disclosures be limited to the
information necessary to carry out the purpose of the disclosure. See 42
CFR §§2.11 and 2.13(a). Under the Privacy Rule, a program may not use or
disclose "protected health information" (PHI) except as permitted or
required by the Rule.[^8] See 45 CFR §164.502(a). Neither rule applies
to information that has been de-identified.[^9] See 45 CFR §164.514(a)
(de-identification of PHI) and 42 CFR §2.11 (definition of "patient
identifying information"). The Privacy Rule permits programs to assign a
code or other means of record identification to allow information that
has been de-identified to be re-identified, as provided in 45 CFR
§164.514(c).

The two regulations have some differences in the definition of what
information is protected. For instance, the Privacy Rule treats medical
record numbers as PHI, subject to all the same requirements as other
PHI. Part 2 would permit a program to disclose a medical record number
because the regulation does not apply to "a number assigned to a patient
by a program, if that number does not consist of, or contain numbers . .
. which could be used to identify a patient with reasonable accuracy and
speed from sources external to the program." See 42 CFR §2.11. Programs
subject to both rules must follow the Privacy Rule's protection of a
medical record number.

[]{#__RefHeading___Toc69793947 .anchor}**C. When protections begin for
someone seeking substance abuse treatment**

Part 2 protects all information about any person who has applied for or
been given diagnosis or treatment for alcohol or drug abuse at a
federally assisted program. See 42 CFR §2.11 (definition of a
"patient"). Information is subject to the Privacy Rule if it is
individually identifiable information created, received, or maintained
by the covered entity. Former patients and deceased patients are
protected under both Part 2 and the Privacy Rule. See 42 CFR §§2.11 and
2.15 and 45 CFR §§164.501 and 164.502(f). Programs should generally
continue to follow Part 2, but note that if PHI is received prior to a
patient applying to a program, under the Privacy Rule, such information
is protected.

[]{#__RefHeading___Toc69793949 .anchor}**II. How the Privacy Rule
affects disclosures of information**

[]{#__RefHeading___Toc69793950 .anchor}**A. The General Rule**

The "general rules" established by Part 2 and the Privacy Rule regarding
uses and disclosures of patient health information are very
different.[^10]^0^

Substance abuse treatment programs must comply with both rules.
Generally, this will mean that they will continue to follow Part 2's
general rule and not disclose information unless they can obtain consent
or point to an exception to that rule that specifically permits the
disclosure. Programs must then make sure that the disclosure is also
permissible under the Privacy Rule.

[]{#__RefHeading___Toc69793953 .anchor}**B. When disclosures are
permitted**

1.  []{#__RefHeading___Toc69793954 .anchor}**Part 2 Consent**[^11]**^1^
    and Privacy Rule Authorization**

Substance abuse treatment programs most often make disclosures after a
patient has signed a consent form that meets the requirements of 42 CFR
§2.31. Note that a disclosure under Part 2 includes the acknowledgment
that someone has applied to or is enrolled in the program, and thus is
only permitted if the patient has signed a consent form (or another of
the regulations' narrow exceptions applies). See 42 CFR §§2.11 and 2.13.
A Part 2 consent form must include the following elements:

-   Name or general designation of the program or person permitted to
    make the disclosure;

-   Name or title of the individual or name of the organization to which
    disclosure is to be made;

-   Name of the patient;

-   Purpose of the disclosure;

-   How much and what kind of information is to be disclosed;

-   Signature of patient (and, in some States, a parent or guardian);

-   Date on which consent is signed;

-   Statement that the consent is subject to revocation at any time
    except to the extent that the program has already acted on it; and

-   Date, event, or condition upon which consent will expire if not
    previously revoked.

When programs operating under Part 2 disclose information pursuant to a
consent form, they must include a written statement that the information
cannot be redisclosed. See 42 CFR §2.32.

The core required elements for the Privacy Rule written authorization
are similar to those of Part 2. However, to comply with the Privacy Rule
authorization requirements, the Part 2 consent must also contain a
statement reflecting the ability or inability of the substance abuse
treatment program to condition treatment on whether the patient signs
the form as described in 45 CFR §164.508(c)(2)(ii). In addition, the
consent may be signed by a personal representative, and if so, must
include a description of such representative's authority to act for the
patient. See 45 CFR §164.508(c)(1)(vi). Finally, the consent must be
written in plain language. See 45 CFR §164.508(c)(3).

The requirements above must be met with respect to the Part 2 consent
form when the purpose of the disclosure is *not* for "treatment, payment
or health care operations" or for any other permitted or required
disclosure under the Privacy Rule. See 45 CFR §164.502(a).[^12]^2^ The
statements would have to be added when the consent form authorizes a
program to make a disclosure for which an authorization is required
under the Privacy Rule, e.g., those disclosures addressed by 45 CFR
§164.508.

The Privacy Rule imposes three additional steps programs must take when
disclosing information pursuant to a patient's written consent:

-   Programs must ensure that the consent complies with the applicable
    requirements of 45 CFR §164.508.

-   Programs must give patients a copy of the signed form (45 CFR
    §164.508(c)(4)).

-   Programs must keep a copy of each signed form for six (6) years from
    its expiration date (45 CFR §164.508(b)(6)).

Therefore, substance abuse treatment programs should generally continue
to use the consent form for disclosures subject to Part 2. If the
Privacy Rule requires authorization for the disclosures, the substance
abuse treatment program may use the Part 2 consent form with additional
elements required by the Privacy Rule as listed above.

[Minors]{.underline}

The Privacy Rule defers to requirements in other applicable laws
regarding the use or disclosure of health information regarding minors
and, thus, does not change the rules in Part 2 regarding minors and
consent. See 45 CFR §164.502(g). A minor must always sign the consent
form for a program to release information even to his or her parent or
guardian (42 CFR §2.14).[^13]^3^ Some States require programs to obtain
parental permission before providing treatment to a minor. In these
States only, programs must get the signatures of both the minor and a
parent, guardian, or other person legally responsible for the minor (42
CFR §2.14(c)(2)).

[Revocation of Consent]{.underline}

Part 2 permits a patient to revoke consent orally (see 42 CFR
§2.31(a)(8)); the Privacy Rule requires written revocation of an
authorization (45 CFR §164.508(b)(5)). Substance abuse treatment
programs must continue to honor verbal revocations but may want to
obtain written revocation when possible or at a minimum document the
revocation in the patient's record. Both Part 2 and the Privacy Rule
allow the program to make a disclosure for services already rendered in
reliance on a signed consent or authorization form. See 42 CFR
§2.31(a)(8) and 45 CFR §164.508(b)(5)(i).

[]{#__RefHeading___Toc69793978 .anchor}**2. Other permissible
disclosures under Part 2**

Substance abuse treatment programs are accustomed to complying with Part
2's general rule prohibiting disclosure, unless the patient has
consented in writing or the disclosure falls within one of the
regulations' limited exceptions (*e.g.*, child abuse reporting, medical
emergencies). In some instances, the Privacy Rule does not require a
change in these practices. In others, the Privacy Rule will require some
modification of programs' practices.

[]{#__RefHeading___Toc69793980 .anchor}**a. When little or no changes
may be needed**

Programs should generally continue to follow the rules in Part 2
regarding:

[]{#__RefHeading___Toc69793982 .anchor}**i. Internal program
communications**

Both Part 2 and the Privacy Rule allow for communications within
programs on a "need to know" basis. Part 2 requires that the
communication of information within the program (or to an entity with
direct administrative control over the program)[^14]^4^ be limited to
those persons who have a need for the information in connection with
their duties that arise out of the provision of diagnosis, treatment or
referral for treatment of alcohol or drug abuse. See 42 CFR §2.12(c)(3).
Similarly, the Privacy Rule requires programs to identify the staff
persons or classes of persons in its workforce who need access to PHI,
the categories of PHI they need access to, and any conditions
appropriate to such access. See 45 CFR §164.514(d)(2)(i). The program
must then make reasonable efforts to limit access of such persons or
classes of persons to PHI based on these determinations. See 45 CFR
§164.514(d)(2)(ii). Substance abuse treatment programs subject to the
Privacy Rule will have to establish written policies to comply with the
minimum necessary requirement of the Privacy Rule, although in practice,
the programs should be able to operate as they have under Part 2 in this
regard.

[]{#__RefHeading___Toc69793984 .anchor}**ii. Crimes on program premises
or against program personnel**

Part 2 permits programs to disclose limited information to law
enforcement officers. Such disclosures must be directly related to
crimes and threats to commit crimes on program premises or against
program personnel and must be limited to the circumstances of the
incident and the patient's status, name, address and last known
whereabouts. See 42 CFR §2.12(c)(5). The Privacy Rule permits programs
to disclose to law enforcement officials PHI that the program believes
in good faith constitutes evidence of a crime that occurred on the
program's premises. See 45 CFR §164.512(f)(5). It also permits any
member of the program's staff who is the victim of a crime to report
certain information about the suspected perpetrator to law enforcement
officials. See 45 CFR §164.502(j)(2). Programs should continue to follow
the rules established by Part 2.

[]{#__RefHeading___Toc69793986 .anchor}**iii. Child abuse reporting**

Part 2 permits programs to comply with State laws that require the
reporting of child abuse and neglect. See 42 CFR §2.12(c)(6). The
Privacy Rule also permits such reporting. See 45 CFR §164.512(b)(1)(ii).
However, Part 2 limits programs to making only an initial report; it
does not allow programs to respond to follow-up requests for information
or to subpoenas, unless the patient has signed a consent form or a court
has issued an order that complies with the rule (see "Subpoenas and
court-ordered disclosures," below). Programs should continue to follow
the rules established by Part 2.

[]{#__RefHeading___Toc69793988 .anchor}**iv. Medical emergencies**

Part 2 allows patient-identifying information to be disclosed to medical
personnel who have a need for the information about a patient for the
purpose of treating a condition which poses an immediate threat to the
health of any individual and which requires immediate medical
intervention. See 42 CFR §2.51. A program can disclose information only
to medical personnel and must limit the amount of information to that
which is necessary to treat the emergency medical condition. Immediately
following the disclosure, the program must document the following in the
patient's records:

-   The name and affiliation of the medical personnel to whom disclosure
    was made;

-   The name of the individual making the disclosure;

-   The date and time of the disclosure; and

-   The nature of the emergency.

    These practices are not affected by the Privacy Rule.

    []{#__RefHeading___Toc69793995 .anchor}**v. Subpoenas and
    court-ordered disclosures**

Part 2 permits programs to release information in response to a subpoena
if the patient signs a consent permitting release of the information
requested in the subpoena. When the patient does not consent, Part 2
prohibits programs from releasing information in response to a subpoena,
unless a court has issued an order that complies with the rule. See 42
CFR Part 2, Subpart E. Subpart E sets out the procedure the court must
follow, the findings it must make, and the limits it must place on any
disclosure it authorizes.

The Privacy Rule permits a program to disclose PHI pursuant to a
subpoena without a prior written authorization, if it receives
satisfactory assurance from the party seeking the information that
reasonable efforts have been made to ensure that the individual has been
given notice of the request for PHI and the opportunity to object, or
reasonable efforts have been made to secure a qualified protective
order. See 45 CFR §164.512(e)(1)(ii). The Privacy Rule has different
requirements regarding court orders, but programs can comply with both
Part 2 and the Privacy Rule by continuing to follow the Part 2's court
order requirements. Unless the disclosure requires authorization under
the Privacy Rule, the Part 2 consent form can be used.

[]{#__RefHeading___Toc69793998 .anchor}**b. When some change is
required**

[]{#__RefHeading___Toc69793999 .anchor}**i. Disclosures that do not
reveal patient-identifying information**

Part 2 permits a substance abuse treatment program to disclose
information about a patient if the disclosure does not identify the
patient as an alcohol or drug abuser or as someone who has applied for
or received substance abuse assessment or treatment services. See 42 CFR
§§2.11 and 2.12(a). This allows a program that is part of a larger
entity, such as a hospital, to disclose information about a patient so
long as it does not explicitly or implicitly disclose the fact that the
patient is an alcohol or drug abuser. For example, a program that is
part of a hospital could disclose to a public health department that a
named patient has TB by identifying itself only as part of the hospital
and not as a substance abuse treatment program and by taking care not to
mention that the patient is in substance abuse treatment.

Many programs that are part of larger entities are accustomed to using
this exception in Part 2 to gather information about patients from, for
example, other health care providers, schools, and employers, or to
refer patients to other providers.[^15]^5^ Some of these practices by
programs that are part of larger entities will continue to be
permissible under the Privacy Rule, which does not require patients to
authorize disclosures for purposes of treatment, payment or health care
operations. The Privacy Rule also permits programs to share information
about an individual's treatment or payment related to the individual's
health care with persons involved in the individual's care. See 45 CFR
§164.510(b).

The Privacy Rule also allows for certain disclosures to be made without
authorization that are not for treatment, payment or health care
operations. See 45 CFR §164.512. For example, the Privacy Rule permits a
program to disclose, without the patient's prior authorization, to a
public health department that the patient has TB when the health
department is authorized to collect such information. However, any
program that is accustomed to making "non-patient identifying"
disclosures of information that do not identify the subject as a
substance abuser and that are not for treatment purposes should consult
the Privacy Rule directly to determine whether those disclosures
continue to be permissible.

Part 2 does not permit freestanding programs to make inquiries about
patients or refer patients to other providers without written consent.
The Privacy Rule does not change this prohibition.

[]{#__RefHeading___Toc69794004 .anchor}**ii. Disclosures to agencies
that provide services to programs**

[Disclosures to Qualified Service Organizations]{.underline}

Both Part 2 and the Privacy Rule recognize that substance abuse
treatment programs sometimes need to disclose information about patients
to persons or agencies that provide services to the program, such as
legal or accounting services. The Part 2 regulations call such service
providers "qualified service organizations" and permit programs to sign
"qualified service organization agreements" (QSOAs) allowing them to
disclose patient-identifying information needed by the organization to
provide services to the program. See 42 CFR §2.12(c)(4). In the
agreements, the outside service providers acknowledge that in receiving,
storing, processing or otherwise dealing with patients' records they are
fully bound by Part 2 and promise to safeguard the information,
including resisting in judicial proceedings any effort to obtain access
to the information, except as permitted by the Part 2 regulations.

Under the Privacy Rule, such outside service providers are "business
associates" of the substance abuse treatment program and the program
must have a business associate agreement with the business associate in
order to share PHI needed by the organization to provide services (see
45 CFR §§160.103 and 164.502(e)).[^16]^6^ The Privacy Rule has different
requirements regarding the content of the business associate contract
(the HHS Office for Civil Rights has published sample contract
language). See 67 Federal Register 53264 (August 14, 2002).

Substance abuse treatment programs must meet the requirements of both
Part 2 and the Privacy Rule if they are going to continue to share
information with lawyers, accountants and others that provide services
to the program.

**Transition Provisions:** The Privacy Rule permits programs to continue
to use current contracts with service providers until April 14, 2004, if
the contract existed prior to October 15, 2002, and the contract is not
subsequently renewed or modified. Any contract that is renewed or
modified after October 15, 2002, must comply with the business associate
contract requirements. See 45 CFR §164.532(d).

[Disclosures to accreditation bodies]{.underline}

Part 2 permits disclosures to accreditation bodies such as the Joint
Commission on Accreditation of Healthcare Organizations (JCAHO) under
either the QSO provision or the "audit and evaluation" exception,
discussed below. The Privacy Rule, however, considers accreditation
bodies business associates conducting health care operations on behalf
of the covered entity. See 45 CFR §§160.103; 164.501. Substance abuse
treatment programs subject to the Privacy Rule who undergo accreditation
will have to sign business associate contracts with accreditation
organizations. Additionally, substance abuse treatment programs must
comply with Part 2, either by ensuring that the business associate
contract contains all the requirements of a QSOA or by fulfilling the
mandates of the audit and evaluation provisions.

[]{#__RefHeading___Toc69794012 .anchor}**iii. Audit and evaluation**

Both Part 2 and the Privacy Rule permit programs to disclose
patient-identifying information to qualified persons who are conducting
an audit or evaluation of the program, without patient consent, provided
that certain safeguards are met. The Privacy Rule requires that uses and
disclosures be limited to the minimum necessary to accomplish the audit
or evaluation. Each rule has its own additional requirements. Substance
abuse treatment programs subject to both Part 2 and the Privacy Rule
must combine those requirements. Three options result:

-   If the audit or evaluation is conducted by a program or its
    employees, it is permissible under both sets of regulations; no
    patient consent or authorization is required. See 42 CFR §2.12(c)(3)
    and 45 CFR §164.502(a)(1)(ii).

-   If the audit or evaluation is conducted by a "health oversight
    agency,"[^17]^7^ the program may disclose patient-identifying
    information so long as the health oversight agency makes the written
    commitments required by 42 CFR §2.53(d) and the disclosure meets the
    requirements in 45 CFR §164.512(d). If the health oversight agency
    copies or removes patient records from the program, it must agree in
    writing to abide by the requirements of 42 CFR §2.53(b).

-   If an audit or evaluation is conducted by an outside entity on
    behalf of the program as opposed to a "health oversight agency," the
    program must have a signed a business associate contract with the
    auditor or evaluator that satisfies the requirements of both the
    Privacy Rule and Part 2 by incorporating either the necessary QSO
    agreement requirements (as discussed above in II.B.2.b.ii) or the
    appropriate provisions of 42 CFR §2.53.

    []{#__RefHeading___Toc69794017 .anchor}**iv. Research**

The Part 2 regulations and the Privacy Rule have different requirements
for disclosures of health information to researchers. See 42 CFR §2.52
and 45 CFR §164.512(i). This will be the subject of additional guidance.

[]{#__RefHeading___Toc69794019 .anchor}**III. Other Changes Required by
the Privacy Rule**[^18]**^8^**

[]{#__RefHeading___Toc69794020 .anchor}**A. Patient Notice/Notice of
Privacy Practices**

Part 2 requires that programs notify patients that Federal law and
regulations protect the confidentiality of alcohol and drug abuse
patient records and give them a written summary of the regulations'
requirements. See 42 CFR §2.22. The Privacy Rule requires that patients
be given a notice of the program's privacy practices as well as their
rights under the Privacy Rule. See 45 CFR §164.520. Programs subject to
both rules can combine their requirements into a single notice.

1.  []{#__RefHeading___Toc69794022 .anchor}**Notice content**

Accordingly, the combined notice must contain all the elements required
by 42 CFR §2.22, and in addition, contain the following:

-   A statement, prominently displayed stating: "THIS NOTICE DESCRIBES
    HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW
    YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY;"

-   A description in sufficient detail of the types of uses and
    disclosures that the program may make without the patient's consent
    or authorization.[^19]^9^ For substance abuse treatment programs,
    these would include uses and disclosures:

    -   In connection with treatment, payment or health care operations
        (include at least one example of each);

    -   To qualified service organizations or business associates who
        provide services to the program's treatment, payment or health
        care operations;

    -   In medical emergencies;

    -   Authorized by court order;

    -   To auditors and evaluators;

    -   To researchers if the information will be protected as required
        by Federal regulations;

    -   To report suspected child abuse or neglect; and

    -   To report a crime or a threat to commit a crime on program
        premises or against program personnel.

```{=html}
<!-- -->
```
-   A statement that other disclosures will be made only with the
    patient's written consent or authorization which can be revoked,
    unless the program has taken action in reliance on the consent or
    authorization. ;[^20]^0^

-   A statement that the program may contact the patient to provide
    appointment reminders or information about treatment alternatives or
    other health-related benefits and services that may be of interest
    to the patient;[^21]^1^

-   A statement that it is required by law to maintain the privacy of
    PHI and to notify patients of its legal duties and privacy
    practices, including any changes to its policies;

-   A statement that the program must abide by the terms of the notice
    currently in effect; a statement that the program reserves the right
    to change the terms of its notice and to make the new notice
    provisions effective for all information it maintains;[^22]^2^ and a
    statement describing how it will provide patients with a revised
    notice of its practices;

-   The name or title and telephone number of a person or office the
    patient can contact for further information;

-   A statement of the patient's rights with respect to PHI and a brief
    description of how the patient may exercise those rights, including:

    -   The right to request restrictions on certain uses and
        disclosures of PHI, including the statement that the program is
        not required to agree with requested restrictions;

    -   The right to receive confidential communications of PHI (such as
        having mail and telephone calls be limited to home or office
        location);

    -   The right to access and amend PHI;

    -   The right to receive an accounting of the program's disclosures
        of PHI;

    -   The right to complain---free from retaliation---to the program
        and to the Secretary of Health and Human Services (HHS) about
        violations of privacy rights, and information on how to file a
        complaint with the program; and

    -   The right to obtain a paper copy of the notice upon request.

```{=html}
<!-- -->
```
-   The effective date of the notice.

See 45 CFR §164.520(b).

[]{#__RefHeading___Toc69794048 .anchor}**2. Distribution of the Notice**

Part 2 requires that programs provide the notice at the time of
admission or as soon thereafter as the patient is capable of rational
communication. See 42 CFR §2.22(a). The Privacy Rule requires that the
substance abuse treatment program must provide the notice to a patient
on the date of the first service delivery, including service delivered
electronically, after April 14, 2003.[^23]^3^ The program must also have
the notice available on site for patients to request to take with them
and posted in a clear and prominent location where it is reasonable to
expect patients to be able to read it. Whenever there is a material
change to the notice, the notice must be promptly revised, made
available upon request, and re-posted as previously referenced. See 45
CFR §§164.520(c)(2); 164.530(i)(4)(i)(C).

The program must make a good faith effort to obtain patients' written
acknowledgment of receipt of the notice, except in an emergency
treatment situation, on the date of the first service delivery. If
written acknowledgment is not obtained, the program must document its
efforts and the reason it was not able to obtain the acknowledgement.
See 45 CFR §164.520(c)(2)(ii).

Any program that maintains a web site that provides information about
its services or benefits must prominently post its notice on the site
and make it available electronically through the site. When patients
agree, the program can provide the notice by e-mail. See 45 CFR
§164.520(c)(3).

[]{#__RefHeading___Toc69794052 .anchor}**B. Patient rights**

The Privacy Rule provides patients with new Federal privacy rights,
including the right to request restrictions of uses and disclosures of
PHI, and the right to access, amend, and receive an accounting of
disclosures of PHI. See 45 CFR §§164.522, 164.524, 164.526,164.528.

1.  []{#__RefHeading___Toc69794054 .anchor}**Right to request a
    restriction of uses and disclosures**

The Privacy Rule requires that programs allow patients to request that
the program restrict uses or disclosures of PHI for the purpose of
treatment, payment or health care operations and for involvement in the
patient's care and notification under 45 CFR §164.510(b). The program is
not required to agree to a requested restriction. If, however, a program
agrees to a restriction, the program may not then violate the
agreed-upon restriction, except for emergency treatment purposes, so
long as the program requests that the emergency treatment provider not
further use or disclose the PHI. A covered entity may terminate the
agreement to a restriction, effective after the patient has been
informed of the termination. See 45 CFR §164.522(a).

The Privacy Rule gives the individual the right to request that
communication of PHI be done by alternative means or to alternative
locations (confidential communications). See 45 CFR §164.522(b)(1)(i).
This might include the right to request that mail and telephone calls be
limited to home or office location. The Privacy Rule requires programs
to accommodate reasonable requests.

[]{#__RefHeading___Toc69794057 .anchor}**2. Right to access PHI**

Neither Part 2 nor the Privacy Rule requires programs to obtain written
consent from individuals before permitting them to see their own
records. Likewise, neither rule prohibits a program from giving a
patient access to his or her own records, including the opportunity to
inspect and copy any records that the program maintains about the
patient. 42 CFR §2.23. However, the Privacy Rule permits programs to
require that such requests be in writing. See 45 CFR §164.524(b)(1). The
Privacy Rule provides patients with a right of access to inspect and
obtain a copy of their PHI. See 45 CFR §164.524(a)(1).[^24]^4^ Certain
information, however, is exempt from this right of access:

-   Psychotherapy notes;[^25]^5^

```{=html}
<!-- -->
```
-   Information compiled in reasonable anticipation of or for use in a
    civil, criminal, or administrative action or proceeding; and

```{=html}
<!-- -->
```
-   Information that may be subject to or exempt from certain Clinical
    Laboratory Improvement Amendment (CLIA) provisions.

See 45 CFR §164.524(a)(1).

The Privacy Rule requires that programs respond to a patient's request
for access within 30 days after receipt of the request (within 60 days
if the information is not maintained or accessible on-site). The program
may extend the deadline once by not more than 30 days, if within 30 days
of the receipt of the request (or 60 days of receipt if the information
is not on-site), the patient is provided with a written statement
containing the reasons for the delay and the date by which it will
permit access. See 45 CFR §164.524(b). If the program does not maintain
the requested information, but knows where the requested information is
maintained, it must inform the patient where to direct his or her
request. See 45 CFR §164.524(d)(3).

If a program grants the patient's request for access to his or her
records*,* it can charge the patient a reasonable, cost-based fee,
consistent with the restrictions on fees as provided in the Privacy
Rule. See 45 CFR §164.524(c)(4).[^26]^6^

**Denial of Access**

The Privacy Rule allows a program to deny a patient access without
providing an opportunity for review of the denial, on the following
grounds:

-   The information is specifically exempted from the right of access by
    the Privacy Rule. See 45 CFR §164.524(a)(1);

-   The program is a correctional institution or a provider acting under
    the direction of the correctional institution and denies in whole or
    in part an inmate's request to obtain a copy of his or her records
    if doing so would jeopardize the health, safety, security, custody,
    or rehabilitation of the individual or of other inmates, or the
    safety of an officer, employee or other person at the correctional
    institution or responsible for transporting the inmate. See
    §164.524(a)(2)(ii));

-   The requested information was created or obtained by a program in
    the course of research that includes treatment. The individual's
    access to such information may be temporarily suspended for as long
    as the research is in progress, provided that the individual has
    agreed to the denial of access when consenting to participate in the
    research and the program has informed him or her that the right of
    access will be reinstated upon completion of the research. See 45
    CFR §164.524(a)(2)(iii);

-   The requested information is subject to the Privacy Act and would be
    denied under the access provisions of the Privacy Act, 5 USC §522a.
    See 45 CFR §164.524(a)(2)(iv); or

```{=html}
<!-- -->
```
-   The requested information was obtained under a promise of
    confidentiality from someone other than a health care provider and
    such access would be likely to reveal the source of the information.
    See 45 CFR §164.524(a)(2)(v).

The Privacy Rule permits a program to deny patient access, provided that
the patient is given the right to have such a denial reviewed, on the
following grounds:

-   A licensed health care professional has determined, in the exercise
    of professional judgment, that the access requested is reasonably
    likely to endanger the life or physical safety of the patient or
    another person;

-   The information makes reference to another person (other than a
    health care provider) and a licensed health care professional has
    determined, in the exercise of professional judgment, that the
    access is reasonably likely to cause substantial harm to such other
    person; or

-   The request for access is made by the patient's personal
    representative and a licensed health care professional has
    determined, in the exercise of professional judgment, that the
    provision of access to such personal representative is reasonably
    likely to cause substantial harm to the patient or another person.

See 45 CFR §164.524(a)(3).

If the program's denial is based on one of the last three reasons, the
patient has the right to have that denial reviewed by a licensed health
care professional who is designated by the program to act as a reviewing
official and who did not participate in the original decision to deny
access. See 45 CFR §164.524(a)(4).

If the program denies a patient access to all or parts of his or her
PHI, it must give the patient a timely denial written in plain language
containing:

-   The basis for the denial;

-   If applicable, a statement of the patient's review rights, including
    a description of how the patient may exercise those rights; and

-   A description of how the patient may complain to the program or to
    the Secretary of HHS. The description must include information
    regarding how the patient may complain to the program pursuant to
    the program's complaint procedures or to the Secretary, and must
    include the name or title, and telephone number of the contact
    person or office designated by the program to receive complaints.

See 45 CFR §164.524(d)(2).

A program that denies a patient access in part must give the patient
access to any other PHI requested after excluding the information to
which the program had reason to deny access. See 45 CFR §164.524(d)(1).

[]{#__RefHeading___Toc69794084 .anchor}**3. The right to amend PHI**

The Privacy Rule gives patients the right to have the program amend
their PHI or a record about the patient in a designated record set. See
45 CFR §164.526. The program must act on a patient's request for
amendment within 60 days after it receives the request. The program may
extend the deadline once by not more than 30 days if, within the 60
days, the patient is provided with a written statement of the reasons
for the delay and the date by which it will respond. See 45 CFR
§164.526(b)(2).

A program that accepts a patient's request to amend PHI must:

-   Timely inform the patient of its decision to accept the amendment;

-   Make the appropriate amendment by identifying the records in the
    designated record set that are affected by the amendment and
    appending or otherwise providing a link to the location of the
    amendment; and

-   If the patient agrees, make reasonable efforts to notify and provide
    the amendment within a reasonable period of time to:

    -   Persons identified by the patient as having received the
        patient's PHI and needing the amendment; and

    -   Persons, including business associates, that the program knows
        to have received the PHI that is the subject of the amendment
        and that may have relied, or could foreseeably rely on such
        information to the detriment of the patient.

See 45 CFR §164.526(c).

A program must obtain patient consent on forms that comply with 42 CFR
§2.31 before it provides any copies of the amendment to other persons or
organizations.

**Denial of Amendment**

A program may deny a patient's request for amendment if it determines
that:

-   It did not create the information, unless the patient provides a
    reasonable basis to believe that the originator of the PHI is no
    longer available to act on the requested amendment;

-   The information or record is accurate and complete; or

-   The information that is the subject of the request is not part of a
    designated record set or would not otherwise be available for
    inspection under the Privacy Rule's request for access provisions.

See 45 CFR §164.526(a)(2).

If a program denies a patient's request to amend records, it must give
him or her a timely denial, written in plain language, and contain:

-   The basis for the denial;

-   Notice of the patient's right to file a written statement of
    disagreement with the denial and how the patient may file such a
    statement;

-   Notice that, if the patient does not submit a statement of
    disagreement, the patient may request that the program include his
    or her request for amendment and its denial with any future
    disclosures of the PHI that is subject to the amendment; and

-   A description of how the patient may complain about the program's
    actions to the program or to the Secretary of HHS. The description
    must include information regarding how the individual may complain
    to the program pursuant to its complaint procedures or to the
    Secretary, and must include the name or title, and telephone number
    of the contact person or office designated by the program to receive
    complaints.

See 45 CFR §164.526(d)(1).

The program may prepare a written rebuttal to the patient's statement of
disagreement. If it prepares such a rebuttal, it must provide a copy to
the patient who submitted the statement of disagreement. This
information (e.g. the statement of disagreement and rebuttal), or in
some cases, a summary, must all be included in any subsequent
disclosures of the information to which the disagreement relates as
provided in 45 CFR §164.526(d)(3), (4), and (5).

The program must document the titles of the persons or offices
responsible for receiving and processing requests for amendment. It must
retain the documentation for six (6) years from the date it was created
or last effective, whichever is later. See 45 CFR §164.526(f).

[]{#__RefHeading___Toc69794108 .anchor}**4. Right to an accounting of
disclosures of PHI**

The Privacy Rule provides individuals with the right to obtain an
accounting of certain disclosures of PHI made by a program during the
six (6) years prior to the request. See 45 CFR §164.528(a).

A program does not have to provide an accounting for any disclosures
that were made:

-   For treatment, payment, and health care operations as provided in 45
    CFR §164.506;

-   To the patient as provided in 45 CFR §164.502;

-   Incident to a use or disclosure that is otherwise permitted as
    provided in 45 CFR §164.502;

-   Pursuant to the patient's written consent (an "authorization"
    meeting the Privacy Rule's requirements at 45 CFR §164.508);

-   For the facility's directory or to persons involved in the patient's
    care or other notification purposes as set forth by the rule at 45
    CFR §164.510;

-   For national security or intelligence purposes as provided by the
    rule at 45 CFR §164.512(k)(2);

-   To correctional institutions or law enforcement officials having
    custody of an inmate or individual and as specified under 45 CFR
    §164.512(k)(5);

-   As part of a limited data set in accordance with the rule at 45 CFR
    §164.514(e); and

-   Before April 14, 2003.

See 45 CFR §164.528(a)(1). In addition, a program must temporarily
suspend a patient's right to receive an accounting of disclosures to a
health oversight agency or law enforcement official if the program
receives notification that it would be reasonably likely to impede the
activities of the agency or official. See 45 CFR §164.528(a)(2).

The accounting must be in writing[^27]^7^ and include:

-   The date of each disclosure;

```{=html}
<!-- -->
```
-   The name and address (if known) of the entity or person who received
    the PHI;

-   A brief description of the PHI disclosed; and

-   A brief statement of the purpose of the disclosure that reasonably
    informs the individual of the basis for the disclosure, or a copy of
    a written request for disclosure, if any.

See 45 CFR §164.528(b)(2).

For substance abuse treatment programs, the following disclosures are
typically made without patient consent and must therefore be included in
an accounting of disclosures:

-   Disclosures to health oversight agencies;

-   Disclosures to researchers that include patient-identifying
    information;[^28]^8^

-   Disclosures to public health authorities;[^29]^9^

-   Court-ordered disclosures;

-   Reports of patient crimes on program premises or against program
    personnel; and

-   Child abuse and neglect reports.

Programs should establish mechanisms to document all disclosures for
which they must account.

The accounting must be made within 60 days of the program's receipt of
the request. The program may extend the deadline once by not more than
30 days if, within the 60 days, the patient is provided with a written
statement of the reasons for the delay and the date by which it will
provide the accounting. A program must respond to a patient's request
for one accounting within any 12-month period without charge. For any
subsequent request within a 12-month period, it may charge a patient a
reasonable, cost-based fee. If the program imposes a fee, it must inform
the patient of the fee in advance and give the patient an opportunity to
withdraw or modify the request. See 45 CFR §164.528(c).

The program must also document the following:

-   The information it was required to provide the patient;

-   The written accounting it provided the patient; and

-   The titles of the persons or offices responsible for receiving and
    processing requests for an accounting.

This documentation must be retained for six (6) years from the date
created or last effective, which ever is later. See 45 CFR §164.528(d).

[]{#__RefHeading___Toc69794141 .anchor}**C. Administrative
Requirements**

1.  []{#__RefHeading___Toc69794142 .anchor}**Complaints about the
    program's privacy practices**

Part 2 allows violations of those regulations to be reported to the
United States Attorney for the judicial district in which the violation
occurs. See 42 CFR §2.5.

The Privacy Rule establishes a process for individuals to file a
complaint with the Secretary of HHS if they believe a program violated
the Privacy Rule. The complaint must be written, either on paper or
electronically, and filed with HHS' Office for Civil Rights within 180
days of when the complainant knew, or should have known, that the act or
omission complained of occurred, unless a waiver is granted. The
complaint must name the program and describe the violation of the
Privacy Rule. See 45 CFR §160.306. Programs must also establish a
process for individuals to make complaints about the program's privacy
policies and procedures or the program's compliance with such policies
and procedures or with the requirements of the Privacy Rule. See 45 CFR
§164.530(d).

2.  []{#__RefHeading___Toc69794145 .anchor}**Other administrative
    requirements**

Programs subject to the Privacy Rule are required to meet administrative
requirements including:

-   Designate a privacy official who is responsible for the development
    and implementation of its policies and procedures and a contact
    person or office responsible for receiving complaints and able to
    provide further information. See 45 CFR §164.530(a).

-   Train all members of the workforce on the program's policies and
    procedures. Each new member of the workforce must receive training
    within a reasonable period of time after s/he joins the workforce.
    Whenever a workforce member's functions are affected by a material
    change in privacy policies or procedures, that person must receive
    additional training within a reasonable period of time after the
    material change becomes effective. The program must document all
    training and retain the records for a period of six (6) years after
    the training. See 45 CFR §164.530(b).

-   Have in place appropriate administrative, technical, and physical
    safeguards to protect the privacy of PHI. See 45 CFR §164.530(c).

```{=html}
<!-- -->
```
-   Establish written policies and procedures that identify the staff
    persons or classes of persons who need access to patients' PHI, the
    categories of PHI they need access to, and any conditions
    appropriate to such access. The program must make reasonable efforts
    to limit access based on these determinations. See 45 CFR
    §164.514(d)(2).

-   Establish policies and procedures to ensure that, for disclosures of
    information that occur on a routine and recurring basis, reasonable
    efforts are made to limit disclosures to the minimum necessary to
    accomplish the intended purpose of the disclosure. See 45 CFR
    §§164.502(b) and 164.514(d)(3)(i). For "all other disclosures," the
    program must develop criteria designed to limit the information it
    discloses to the information reasonably necessary to accomplish the
    purpose for which disclosure is sought and review requests for
    disclosure on an individual basis in accordance with those criteria.
    See 45 CFR §164.514(d)(3)(ii). Programs must also develop policies,
    procedures and criteria to ensure that requests to other entities
    subject to the Privacy Rule for PHI are limited to information
    "which is reasonably necessary to accomplish the purpose for which
    the request is made." See 45 CFR §164.514(d)(4). The written polices
    and procedures must be retained for six (6) years after the last
    time they were effective. See 45 CFR §164.530(j).

-   Establish and apply appropriate sanctions against members of its
    workforce who fail to comply with its privacy policies and
    procedures. See 45 CFR §164.530(e).

-   Mitigate, to the extent practicable, any harmful effect that is
    known to the program that results from a use or disclosure in
    violation of its policies and procedures. See 45 CFR §164.530(f).

-   Refrain from taking intimidating, threatening, coercing,
    discriminating, or other retaliatory action against any individual
    who exercises rights under the Privacy Rule, including filing a
    complaint, assisting in an investigation, compliance review,
    proceeding or hearing pursuant to the Privacy Rule, as well as any
    individual who opposes any act or practice made unlawful by the
    Privacy Rule, provided that he or she has a good faith belief that
    the practice is unlawful and the manner of opposition is reasonable
    and does not invoke an impermissible disclosure of PHI. See 45 CFR
    §164.530(g).

-   Not require patients to waive their rights to complain to the
    Secretary of HHS or their other rights under the Privacy Rule as a
    condition of treatment, payment, enrollment in a health plan, or
    eligibility for benefits. See 45 CFR §164.530(h).

-   Implement policies and procedures regarding PHI that are designed to
    comply with the standards, implementation specifications, and other
    requirements of the Privacy Rule, and maintain the policies and
    procedures in written or electronic form for six years from the date
    the document was created, or last effective, whichever is later. See
    45 CFR §164.530(i) and (j).

    []{#__RefHeading___Toc69794157 .anchor}**D. Security of
    information**

Part 2 requires programs to maintain patient written records in a secure
room, locked file cabinet, safe or other similar container. The
regulations also require programs to adopt written procedures to
regulate access to patients' records. See 42 CFR §2.16.

Section 164.530(c) of the Privacy Rule requires programs to maintain
reasonable and appropriate administrative, technical and physical
safeguards to protect the privacy of PHI. The issue of security has been
addressed in more detail through a separate Security Rule issued by HHS
on February 20, 2003 that established the physical and technical
security standards required to guard the integrity, confidentiality and
availability of confidential information that is electronically stored,
maintained or transmitted. See 68 Federal Register 8334. Covered
entities must be in compliance with the Security Rule by April 20, 2005,
except small health plans which have until April 20, 2006.

[]{#__RefHeading___Toc69794160 .anchor}**Conclusion**

Compliance with Part 2 has given the substance abuse treatment programs
extensive experience with protecting patient confidentiality. Although
substance abuse programs will need to make some changes to their
business practices, they have a good starting point to work from in
achieving compliance with the HIPAA Privacy Rule. Substance abuse
treatment programs should contact their respective State substance abuse
agencies and/or provider organizations, as well as legal counsel for
assistance in implementing practices that will comply with both Part 2
and the Privacy Rule.

[]{#__RefHeading___Toc69794162 .anchor}**For more information about the
HIPAA Standards**

[http://www.hipaa.samhsa.gov](http://www.hipaa.samhsa.gov/) is the
SAMHSA website which provides information and links for all HIPAA
standards.

**Standards for Privacy of Individually Identifiable Health
Information** (45 CFR Parts 160 and 164)

More information can be obtained from the Office for Civil Rights HIPAA
website <http://hhs.gov/ocr/hipaa>

**Standards for Electronic Transactions** (45 CFR Parts 160 and 162)

The Standards for Electronic Transactions can be obtained from the
Center for Medicare and Medicaid Services (CMS) website at
<http://cms.gov/hipaa/hipaa2/default.asp>

**Standard Unique Employer Identifier** (45 CFR Parts 160 and 162)

<http://cms.gov/hipaa/hipaa2/default.asp>

**Security Standards** (45 CFR Parts 160, 162 and 164)
<http://cms.gov/hipaa/hipaa2/default.asp>

![](media/image1.jpeg){width="0.8in" height="0.825in"}

[^1]: In August 2002, HHS adopted modifications to the Privacy Rule.

[^2]: The compliance date for the Privacy Rule was April 14, 2003.
    However, small health plans, as defined by the Privacy Rule, are not
    required to be in compliance until April 14, 2004.

[^3]: This guidance applies to substance abuse treatment programs that
    are also covered entities as defined by the Privacy Rule. Programs
    should seek legal counsel for assistance in determining whether they
    are covered entities.

[^4]: The Part 2 regulations apply to substance abuse treatment
    "programs" as defined by 42 CFR §2.11 that are "federally assisted"
    as defined by 42 CFR §2.12(b).

[^5]: The Privacy Rule generally defines a health care provider to
    include a person or organization who furnishes, bills or is paid for
    health care in the normal course of business, which would include
    substance abuse treatment programs.

[^6]: ^6^ A substance abuse treatment program is defined as an
    individual or entity that provides alcohol or drug abuse diagnosis,
    treatment or referral. For the purposes of this document, the term
    "program" includes both individual substance abuse providers and
    substance abuse provider organizations.

[^7]: ^7^ Neither Part 2 nor the Privacy Rule protects employment
    records held by a program in its role as employer. Note that while
    42 CFR Part 2 arguably applies to substance abuse patient records
    covered by the Family Educational Rights and Privacy Act (FERPA) (20
    USC §1232g; 34 CFR Part 99), the Privacy Rule does not.

[^8]: ^8^ PHI is defined as individually identifiable health information
    held or transmitted by a covered entity or its "business associate,"
    with limited exceptions. See 45 CFR §160.103.

[^9]: ^9^ The Privacy Rule includes numerous elements that make
    information identifiable, such as, but not limited to, information
    regarding employers, relatives and household members that are not
    necessarily identifiable information under Part 2. Such information
    should be protected consistent with the Privacy Rule requirements.

[^10]: ^10^ Part 2 uses the term "disclosure" to cover what the Privacy
    Rule refers to as "uses" and "disclosures." See the definition of
    these terms in 45 CFR §160.103. Some Privacy Rule provisions differ
    for "uses" and "disclosures." For convenience, we generally use the
    Part 2 term "disclosure" throughout to encompass both uses and
    disclosures under the Privacy Rule. In some instances, however,
    specific uses or disclosures are discussed.

[^11]: ^11^ This document uses the term "consent" when referring to any
    written permission provided by a patient for the use or disclosure
    of identifiable health information. The Privacy Rule uses the term
    "authorization" for certain permissions, and also permits, but does
    not require, programs to obtain "consent" for the use and disclosure
    of PHI for purposes of treatment, payment, or health care
    operations.

[^12]: ^12^ See the Privacy Rule's definitions of "treatment,"
    "payment," and "health care operations" at 45 CFR §164.501. When a
    substance abuse treatment program obtains information about a
    patient from a school, relatives, health care providers and health
    plans for treatment or payment activities, when it refers a patient
    to other providers and services and when it coordinates care with
    other health care providers, it almost always makes an implicit
    disclosure that the patient has applied for or has received alcohol
    or drug abuse treatment services and thus the program is required to
    treat these contacts as disclosures and obtain patient consent prior
    to such contact. In most of these instances, the disclosure from the
    program is for treatment purposes and the additional Privacy Rule
    statements would not have to be added to the consent forms. Note
    that programs may add the Privacy Rule statements in all
    circumstances, and programs may find it more convenient to use only
    one kind of consent form.

[^13]: ^13^ The only exception to this rule is when the program director
    determines that a minor applying for services lacks capacity for
    rational choice and that the minor applicant's situation poses a
    substantial threat to life or physical well being of the minor or
    any other person that may be reduced by communicating relevant facts
    to the minor's parent or guardian. See 42 CFR §2.14(d).

[^14]: ^14^ In applying the Privacy Rule, programs should consider
    whether the program and the entity with "direct administrative
    control" over the program are two separate legal entities. If they
    are two separate legal entities, PHI flowing between the program and
    the other entity will generally be governed by the Privacy Rule's
    requirements regarding "disclosure" rather than "use" of PHI.
    However, the Privacy Rule recognizes that health care providers may
    have different organizational arrangements and has established
    different rules to reflect such arrangements. See the Privacy Rule's
    provisions regarding hybrid entities (45 CFR §164.105(a) and (c)),
    affiliated covered entities (45 CFR §164.105(b) and (c)), and
    organized health care arrangements (OHCAs) (45 CFR §160.103
    (definition of "business associate" and "OHCA"), 45 CFR
    §164.506(c)(5), and 45 CFR §164.520(d)).

[^15]: ^15^ As noted above, when a program makes an inquiry about, or
    refers, a patient, it is often making an implicit disclosure that
    the patient is in substance abuse treatment.

[^16]: ^16^ A memorandum of understanding would generally be used
    between government entities rather than a business associate
    contract.

[^17]: ^17^ Under the Privacy Rule, a "health oversight agency" is an
    agency or authority or the United States, a State, a territory, a
    political subdivision of a State or a territory, or an Indian tribe,
    or a person or entity acting under a grant of authority from or
    contract with such a public agency, including the employees or
    agents of such public agency or its contractors or persons or
    entities to whom it has granted authority, that is authorized by law
    to oversee the health care system (whether public or private) or
    government programs in which health information is necessary to
    determine eligibility or compliance or to enforce civil rights laws
    for which health information is relevant (45 CFR §164.501).
    Disclosures to health oversight agencies when an individual is the
    subject of the investigation are prohibited under certain
    circumstances by the Privacy Rule (45 CFR §164.512(d)(2)).

[^18]: ^18^ This last section addresses issues on which Part 2 is
    largely silent. Thus, these can be seen as new requirements imposed
    by the Privacy Rule to which programs now must adhere.

[^19]: ^19^ The Privacy Rule also requires that the notice contain
    information about any more restrictive law. For example, if State
    law further limits disclosure of HIV-related information, that
    restriction should also appear in the notice.

[^20]: ^20^ Programs often need to provide PHI to criminal justice
    agencies that mandate patients into treatment. Under Part 2, such
    disclosures may be made pursuant to a non-revocable consent that
    complies with 42 CFR §2.35. Under the Privacy Rule, such disclosures
    may be made pursuant to an authorization or pursuant to a court
    order. In order to comply with both rules, programs may find it
    helpful to ask the court in such a situation to issue an order that
    the program disclose necessary information to the court and other
    law enforcement personnel.

[^21]: ^21^ A substance abuse treatment program engaging in these kinds
    of activities must be careful in contacting the patient that it does
    not make any patient-identifying disclosures to others. If the
    program does not intend to contact the patient, they do not need to
    include this statement.

[^22]: ^22^ This is also voluntary. However, if this statement is not
    included, any changes in privacy practices described in the notice
    will apply only to PHI the program created or received after issuing
    a revised notice reflecting such changes. 45 CFR
    §164.520(b)(1)(v)(C).

[^23]: ^23^ There is an exception in emergency situations. If treatment
    is provided on an emergency basis, the program must provide the
    notice as soon as practicable after the emergency is resolved. See
    45 CFR §164.520(c)(2)(i)(B).

[^24]: ^24^ The Privacy Rule requires access to information in a
    designated record set for as long as the PHI is maintained in the
    designated record set. "Designated record set" is defined as "\[a\]
    group of records maintained by or for a covered entity that is: (i)
    The medical records and billing records about individuals maintained
    by or for a covered health care provider; (ii) The enrollment,
    payment, claims adjudication, and case or medical management record
    systems maintained by or for a health plan; or (iii) Used, in whole
    or in part, by or for the covered entity to make decisions about
    individuals." 45 CFR §164.501. The program must document the
    designated record sets that are subject to access and the titles of
    the persons or offices responsible for receiving and processing
    requests for access (45 CFR §164.524(e)). It must retain the
    documentation for six (6) years from the date it was last effective,
    whichever is later (45 CFR §164.530(j)). Under Part 2, the
    information need not be contained in a designated record set. Thus,
    programs could permit access to all disclosable patient records.

[^25]: ^25^ The Privacy Rule defines "psychotherapy notes" as "notes
    recorded (in any medium) by a health care provider who is a mental
    health professional documenting or analyzing the contents of
    conversation during a private counseling session or a group, joint,
    or family counseling session and that are separated from the rest of
    the individual's medical record. *Psychotherapy notes* excludes
    medication prescription and monitoring, counseling session start and
    stop times, the modalities and frequencies of treatment furnished,
    results of clinical tests, and any summary of the following items:
    diagnosis, functional status, the treatment plan, symptoms,
    prognosis, and progress to date." 45 CFR §164.501.

[^26]: ^26^ Information obtained by patient access to his or her own
    record is subject to Part 2's restriction on use of the information
    to initiate or substantiate any criminal charges against the patient
    or to conduct any criminal investigation of the patient. See 42 CFR
    §2.23(b).

[^27]: ^27^ There are special provisions under the Privacy Rule that are
    applicable to accounting for recurrent disclosures and certain
    research disclosures. See 45 CFR §§164.528(b)(3) and (b)(4).

[^28]: ^28^ There are special provisions under the Privacy Rule that are
    applicable to accounting for research. See 45 CFR §164.528(b)(4)).

[^29]: ^29^ When a program authorizes access to an entire universe of
    records, e.g., for public health surveillance activities, the
    Privacy Rule's accounting requirement can be met without the program
    having to make a notation in each medical record that has been
    accessed by public health authorities. See Office for Civil Rights,
    Frequently Asked Questions,
    [www.hhs.gov/ocr/hipaa](http://www.hhs.gov/ocr/hipaa).