\-

HIPAA Privacy Rule and 42 CFR Part 2

Frequently Asked Questions (FAQs)

1.  If my agency is a substance abuse program, as defined by 42 C.F.R.
    Part 2, do we also need to comply with the HIPAA Privacy Rule?

> A substance abuse "program" as defined in 42 C.F.R. Part 2 is not
> automatically a covered entity under the HIPAA Privacy Rule ("HIPAA").
> However, a substance abuse provider might be both a "program" that
> needs to comply with 42 C.F.R. Part 2 and a "covered entity" that
> needs to comply with HIPAA.
>
> Under HIPAA, a "covered entity" is:

-   A health plan which is an individual or group plan that provides, or
    pays the cost of, medical care, including a group health plan,
    health insurance issuer, HMO, Medicare, Medicaid, CHAMPUS or
    Medicare + Choice;

-   A health care clearinghouse which is a public or private entity that
    processes or facilitates processing of health information received
    from another entity in a nonstandard format into a standard format,
    or receives a standard transmission from another entity and
    processes or facilitates processing of health information into a
    nonstandard format; and

-   A health care provider, which is a provider of medical or health
    services and any other person or organization that furnishes, bills
    or is paid for health care in the normal course of business if the
    provider transmits health information in electronic form in
    connection with a transaction for which HHS has adopted a HIPAA
    standard (a "covered transaction" e.g., billing a health plan
    electronically).

> Most likely, a substance abuse treatment provider would fall within
> the definition of a health care provider. However, in order to be a
> covered entity the provider must also transmit health information in
> connection with certain transactions in electronic form. In other
> words, if the provider does not transmit any health information
> electronically, the provider is not a covered entity under the Privacy
> Rule.
>
> If you transmit health information in connection with covered
> transactions electronically (via Internet, extranet, private networks,
> e-mail or by transmissions that are physically removed from one
> location to another using magnetic tape, disk or compact disk, etc.,
> including if you have another entity do this on your behalf), and you
> otherwise meet the definition of a health care provider, then you are
> subject to the HIPAA Privacy Rule, even if you keep all other
> information in paper form.

2.  When a substance abuse provider faxes billing information in paper
    form to either a private insurer or Medicaid, does this constitute a
    transmission of health information in electronic form that triggers
    the HIPAA privacy standards?

No. Sending billing information in paper form via facsimile does not
subject a provider to the HIPAA transaction or privacy regulations.

3.  **When do the confidentiality and privacy protections of protected
    health information (PHI) begin for someone seeking substance abuse
    treatment?**

Assuming the treatment agency is both a "program" under 42 C.F.R. Part 2
and a "covered entity" under the HIPAA Privacy Rule, PHI becomes
protected upon its creation or receipt by the substance abuse provider.
This means the person does not have to be admitted as a patient. If a
person calls and makes an inquiry and the substance abuse agency
documents identifying information about the individual, the information
would be considered PHI. This applies to any PHI in any form, whether it
is stored electronically, in written form or verbal. This information
remains protected for as long as the covered entity transmits or
maintains the information.

Under 42 C.F.R. Part 2, the confidentiality protections extend to
"patients" in a program. A patient means any individual who has applied
for or been given diagnosis or treatment for alcohol or drug abuse at a
federally assisted program. It also includes an individual who is
identified as an alcohol or drug user for the purpose of determining
eligibility to participate in a program after the individual has been
arrested on a criminal charge. The diagnosis means any reference to an
individual's alcohol or drug abuse or to a condition which is identified
as having been caused by that abuse which is made for the purpose of
treatment or referral for treatment. Once an individual becomes a
patient, all individually identifiable information about that patient is
protected. Applicants for substance abuse treatment services are
included whether or not they are admitted to the program. However, a
person who does not show up for an appointment for an assessment to
determine whether a substance abuse problem exists is not a patient.
Former patients and deceased patients remain protected as well.

4.  **Can an entity that received protected health information (PHI)
    pursuant to a consent redisclose that information?**

Redisclosure of protected health information is prohibited under 42
C.F.R. Part 2. Specifically, 42 C.F.R. Part 2 requires that all written
consents for disclosure must be accompanied by a written statement that
provides: "This information has been disclosed to you from records
protected by Federal confidentiality rules (42 C.F.R. Part 2). The
Federal rules prohibit you from making any further disclosure of this
information unless further disclosure is expressly permitted by the
written consent of the person to whom it pertains or as otherwise
permitted by 42 C.F.R. Part 2. A general authorization for the release
of medical or other information is NOT sufficient for this purpose. The
Federal rules restrict any use of the information to criminally
investigate or prosecute any alcohol or drug abuse patient." On the
contrary, the HIPAA Privacy Rule does not prohibit redisclosure of
information by entities to whom a covered entity discloses PHI.

However, if the redisclosure is by a covered entity, such redisclosure
would be a violation of 42 C.F.R. Part 2 and may additionally be a
violation of the Privacy Rule, and is prohibited.

5.  **Do patients have the right to access their own substance abuse
    records?**

Under the HIPAA Privacy Rule, patients have the right to access their
own records. The following exceptions apply:

-   Patients do not have a right to access psychotherapy notes;

-   Patients do not have a right to access information compiled in
    reasonable anticipation of, or for use in, a civil, criminal, or
    administrative action or proceeding;

-   Patients do not have a right to access PHI maintained by a covered
    entity that is subject to the Clinical Laboratory Improvement
    Amendments of 1988 ("CLIA") to the extent it would be prohibited by
    law or if such information is exempt from CLIA;

-   In certain situations, a covered entity that is a correctional
    institution or a covered health care provider acting under the
    direction of the correctional institution may deny an inmate's
    request to obtain a copy of PHI;

-   Access to PHI created or obtained by a provider in the course of
    research that includes treatment may be temporarily suspended for as
    long as the research is in progress, subject to certain conditions;

-   Access to PHI contained in records that are subject to the Privacy
    Act may be denied, if the denial of access under the Privacy Act
    would meet the requirements of that law;

-   Access may be denied if the PHI was obtained from someone other than
    a health care provider under a promise of confidentiality and the
    access requested would be reasonably likely to reveal the source of
    the information; and

-   Access may be denied if such access may cause harm under specific
    circumstances provided in the Privacy Rule.

42 C.F.R. Part 2 does not prohibit a substance abuse program from giving
a patient access to their own records, but it also does not mandate
access. Neither the Privacy Rule nor 42 C.F.R. Part 2 requires a consent
for disclosure to a patient of the patient's own protected information.
Additionally, under 42 C.F.R. Part 2, patient identifying information
obtained by patient access is subject to the restriction on use of this
information to initiate or substantiate any criminal charges against the
patient or to conduct any criminal investigation of the patient. Because
42 C.F.R. Part 2 does not prohibit patients access to their own records,
while the Privacy Rule requires patient access, providers must follow
the mandates of the Privacy Rule and allow patients access to their PHI.
However, providers must comply with the restrictions on the use of such
information to conduct any criminal investigation of the patient as
discussed in 42 C.F.R. Part 2.

6.  **Can PHI be disclosed by a provider for the purpose of reporting
    child abuse?**

42 C.F.R Part 2 and HIPAA both allow a provider to make an initial
report to the appropriate state or local authorities to report suspected
child abuse. 42 C.F.R. Part 2 states that the restrictions on disclosure
and use of patient identifying information do not apply to the reporting
under State law of incidents of suspected child abuse and neglect to
appropriate State or local authorities. However, the restrictions
continue to apply to the original patient records maintained by the
program including their disclosure and use for civil or criminal
proceedings which may arise out of the report of suspected child abuse
and neglect. In other words, after an initial report is made to
authorities concerning suspected child abuse or neglect, additional
information that may be requested as a follow-up to the report may not
be disclosed except in accordance with 42 C.F.R. Part 2 (i.e. with
written consent or a court order). No such qualification is made under
the HIPAA Privacy Rule.

Because the disclosure of PHI is more restrictive under 42 C.F.R. Part
2, providers should continue to follow this rule when disclosing PHI in
connection with the reporting of child abuse.

7.  **Under 42 C.F.R. Part 2, any disclosures made under the regulations
    must be limited to that information which is necessary to carry out
    the purpose of the disclosure. Is there a similar limitation on
    disclosures under the HIPAA Privacy Rule?**

Yes. Under the HIPAA Privacy Rule, a covered entity generally must make
reasonable efforts to limit using, disclosing, or requesting PHI to the
minimum necessary to accomplish the intended purpose of the use,
disclosure or request.

8.  **Are all business associates as defined by HIPAA also considered
    qualified service organizations ("QSOs") as defined under 42 C.F.R.
    Part 2?**

Not necessarily. The definitions of business associate and qualified
service organizations are complicated. However, business associates
could include other covered entities and are generally defined more
broadly than those organizations that would be considered QSOs.
Likewise, the definition of QSO includes some entities, such as those
that provide services to prevent or treat child abuse or neglect, that
would not be business associates. Therefore, a provider cannot assume
that a business associate is a QSO and vice versa. If it is not clear
that a particular partner with which you would like to share patient
records satisfies both definitions, be sure to seek legal counsel.

9.  **Can a substance abuse program disclose PHI to law enforcement if
    they produce a search warrant?**

A search warrant is not sufficient to compel a provider to disclose PHI
to law enforcement personnel under 42 C.F.R. Part 2. An appropriate
court order which meets the specific requirements outlined in 42 C.F.R.
Part 2 is also required. However, HIPAA is more permissive and allows
such disclosure of PHI to law enforcement personnel pursuant to a search
warrant. In this case, because 42 C.F.R. Part 2 is more stringent,
providers must follow 42 C.F.R. Part 2 and not disclose PHI to law
enforcement with only a search warrant.

10. **Can PHI be disclosed to law enforcement if they are investigating
    a crime on the substance abuse program's premises?**

42 C.F.R. Part 2 allows disclosure of PHI to law enforcement officers
when a crime is committed on program premises or against program
personnel or there is a threat to commit such a crime. However, this
disclosure must be directly related to the patient's commission of a
crime, or to a threat to commit such a crime, and the information
disclosed must be limited to the circumstances of the incident including
the patient's status, name and address, and last known whereabouts.

HIPAA also allows for disclosure of PHI to law enforcement officers as
long as the provider believes in good faith that the information
provided constitutes evidence of criminal conduct that occurred on
program premises.

As to crimes that occur on program premises, because 42 C.F.R. Part 2
only allows disclosures if the crime is threatened or committed by a
patient, disclosures regarding crimes committed by others would not be
permitted. Moreover, the limitations included in both 42 C.F.R. Part 2
and the HIPAA Privacy Rule as to what information can be disclosed must
be followed.

Unlike 42 C.F.R. Part 2, the Privacy Rule would not permit disclosure of
threats to commit a crime on the premises unless the threat itself is a
crime or the provider, in good faith, believes the use or disclosure is
necessary to prevent or lessen a serious and imminent threat to the
health or safety of a person or the public and the use or disclosure is
to a person or persons reasonably able to prevent or lessen the threat,
including the target of the threat. If the Privacy Rule does not permit
a disclosure, a provider cannot make the disclosure even if it is
permitted by 42 C.F.R. Part 2.

11. **How should a provider respond to a subpoena for substance abuse
    treatment records of a mother in a divorce proceeding to determine
    child custody matters?**

A provider may not release substance abuse treatment records in response
to a subpoena under 42 C.F.R. Part 2 because a subpoena alone is not
sufficient. A subpoena must be issued in conjunction with a court order
by a judge in accordance with the requirements contained in 42 C.F.R.
2.64 in order to compel production of the records. Records may also be
released with the patient's consent.

Providers should continue to follow 42 C.F.R. Part 2. Providers must
also follow the requirement in the Privacy Rule that only PHI expressly
authorized by such order be disclosed.

12. **Are substance abuse treatment providers allowed to release
    confidential communications with a court order?**

If a court of competent jurisdiction issues a court order accompanied by
a subpoena, a provider is compelled to disclose PHI under 42 C.F.R. Part
2. Court orders may only be issued by a judge in accordance with
specific procedural requirements outlined in the regulations. When a
provider receives a court order, it should consult with legal counsel
prior to release in order to ensure that the appropriate procedures have
been followed. The criteria for issuance of a court order authorizing
disclosure of confidential communications made by a patient in the
course of diagnosis, treatment or referral is met only if:

-   The disclosure is necessary to protect against an existing threat to
    life or of serious bodily injury;

-   The disclosure is necessary in connection with investigation or
    prosecution of an extremely serious crime; or

-   The disclosure is in connection with litigation or an administrative
    proceeding in which the patient offers testimony or other evidence
    pertaining to the content of the confidential communications.

The HIPAA Privacy Rule requirements allow for disclosure of PHI with a
valid court order for judicial and administrative proceedings or for law
enforcement purposes. Only the PHI expressly authorized by the order may
be disclosed. While under certain circumstances a subpoena without a
court order is sufficient for compliance with the Privacy Rule, in order
to be in compliance with 42 C.F.R. Part 2, providers may only disclose
information upon receipt of a court order that meets the requirements of
42 C.F.R. Part 2.

13. **Are providers allowed to circulate a list to all program staff
    which contains the names of all patients who are admitted and
    discharged?**

According to 42 C.F.R. Part 2, personnel within a program or within an
entity with direct administrative control can share PHI about a patient
as long as the information relates to their duties that arise out of the
provision of diagnosis, treatment or referral for treatment and they
need that information to perform their duties. Similarly, HIPAA allows
providers to disclose the minimum necessary amount of PHI to other staff
for the purpose of carrying out their duties. Under HIPAA the provider
must identify the staff persons or classes of persons who need access,
the categories of PHI they need access to and any conditions appropriate
to such access. The provider must also make reasonable efforts to limit
access based on these determinations. The provider would have to comply
with both rules. The treatment agency policies should identify the
minimum necessary amount of information based upon job function and
delineate which staff persons or classes of persons need to have a list
of patients.

14. **If a patient has tuberculosis, can a substance abuse treatment
    provider disclose this information to the Department of Public
    Health?**

Under the Privacy Rule, providers would be allowed to disclose that a
patient has tuberculosis to a public health authority (including a
person or entity granted authority by a public health authority) that is
authorized by law to collect or receive such information.

42 C.F.R. Part 2 does not contain a specific exemption for reporting a
communicable disease to public health authorities. In order to disclose
the PHI in this scenario, the provider can only disclose this
information pursuant to a written consent, court order or under a
qualified service organization agreement or if disclosure can be made
without identifying an individual as an alcohol or drug abuser.
Limitations on what may be disclosed and how the public health agency
may use and redisclose the information apply. Applying 42 C.F.R. Part 2
and the Privacy Rule, the provider should follow 42 C.F.R. Part 2
provided that the health department is authorized by law to receive such
information or the consent used by the provider meets the Privacy Rule
authorization requirements.

15. **What must be included in a patient's privacy notice?**

According to 42 C.F.R. Part 2, at the time a patient is admitted (or as
soon thereafter as the patient can communicate rationally), a program
must inform the patient that federal law and regulations protect the
confidentiality of alcohol and drug abuse patient records and provide a
written summary of the federal law and regulations. The notice to the
patient must contain:

-   A general description of the limited circumstances under which a
    program may acknowledge that an individual is present at a facility
    or disclose outside the program information identifying a patient as
    an alcohol or drug abuser;

-   A statement that violation of the law and regulations is a crime and
    that suspected violations may be reported to authorities;

-   A statement that information related to a patient's commission of a
    crime on premises or against program personnel is not protected;

-   A statement that reports of suspected child abuse and neglect made
    under state law to appropriate state or local authorities are not
    protected; and

-   A citation to the federal law and regulations.

The regulation provides a sample notice at 42 C.F.R. 2.22. A covered
entity under HIPAA is required to give a patient notice and a full
description of the covered entity's use and disclosure practices
(generally any use or disclosure of PHI not described in this notice is
prohibited). The notice must be written in plain language and include
the following elements:

-   The following statement as a header or otherwise prominently
    displayed: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU
    MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS
    INFORMATION. PLEASE REVIEW IT CAREFULLY."

-   A description, including at least one example, of the types of uses
    and disclosures that the covered entity is permitted to make for
    treatment, payment or health care operations purposes.

```{=html}
<!-- -->
```
-   A description of each of the other purposes for which the covered
    entity is permitted or required to use or disclose protected health
    information without the individual's consent or authorization.

-   If the use or disclosure is prohibited or materially limited by
    other applicable law, the description of such use or disclosure must
    reflect the more stringent law.

-   For each purpose described in bulletpoints two and three, the
    description must include sufficient detail to place the individual
    on notice of the uses and disclosures that are permitted or required
    by the Privacy Rule and other applicable laws (e.g., 42 C.F.R. Part
    2).

-   A statement that other uses and disclosures will be made only with
    the individual's written authorization and that the individual may
    revoke such authorization.

> The notice must also include separate statements for certain uses or
> disclosures. If the covered entity intends to engage in any of the
> following activities the notice must include a separate statement
> that:

-   The covered entity may contact the individual to provide appointment
    reminders or information about treatment alternatives or other
    health related benefits and services of interest to the individual,
    if applicable.

-   The covered entity may contact the individual to raise funds for the
    covered entity, if applicable.

-   A group health plan, or a health insurance issuer or HMO with
    respect to a group health plan, may disclose protected health
    information to the sponsor of the plan, if applicable.

> The notice must also include a description of individual rights with
> respect to protected health information as follows:

-   A statement of the individual's right to request restrictions on
    certain uses and disclosures of protected health information,
    including a statement that the covered entity is not required to
    agree to a requested restriction.

```{=html}
<!-- -->
```
-   A statement of the individual's right to receive confidential
    communications of protected health information.

```{=html}
<!-- -->
```
-   A statement of the individual's right to inspect and copy protected
    health information.

-   A statement of the individual's right to amend protected health
    information.

-   A statement of the individual's right to receive an accounting of
    disclosures of protected health information.

-   A statement of the individual's right to obtain a paper copy of the
    notice from the covered entity upon request, even if the individual
    has agreed to receive an electronic notice.

```{=html}
<!-- -->
```
-   A statement that the covered entity is required by law to maintain
    the privacy of protected health information and to provide
    individuals with notice of its legal duties and privacy practices
    with respect to protected health information.

```{=html}
<!-- -->
```
-   A statement that the covered entity is required to abide by the
    terms of the notice currently in effect.

-   A statement that the covered entity reserves the right to change the
    terms of the notice and to make the new notice provisions effective
    for all protected health information that it maintains. The
    statement must also describe how it will provide individuals with a
    revised notice.

```{=html}
<!-- -->
```
-   A statement that individuals may complain to the Secretary of the
    Department of Health and Human Services if the individual believes
    that their privacy rights have been violated, a brief description of
    how the individual may file a complaint with the covered entity, and
    a statement that the individual will not be retaliated against for
    filing a complaint.

-   The name, or title, and telephone number of a person or office to
    contact for further information.

-   The effective date on which the notice is first in effect.

Whenever there is a material change to the notice, the notice must be
promptly revised and made available and posted by health care providers.
Providers should follow both rules. Neither 42 CFR Part 2 nor the
Privacy Rule prohibits a single privacy notice form that incorporates
the requirements of both rules.

16. **How should a provider respond when a patient requests a correction
    of information in their record?**

42 C.F.R. Part 2 does not require that patients be allowed to amend or
correct their protected information. The Privacy Rule generally mandates
that patients be allowed to amend or correct their PHI that is in a
designated record set or to provide a statement of disagreement. Covered
entities must provide a patient an opportunity to review their PHI
unless an exception applies (see the answer to Question 5). The patient
may then submit a request to amend or correct their PHI. However, the
covered entity is given the discretion to make the final determination
as to whether or not the PHI will be amended or corrected. The covered
entity may deny a request for amendment if the covered entity determines
the PHI:

-   Was not created by the covered entity unless the originator of the
    PHI is no longer available;

-   Is not part of the designated record set;

-   Would not be available for inspection; or

-   Is accurate and complete.

The covered entity is required to act on the patient's request no later
than 60 days after receipt of the request. If the entity denies the
request, it must provide the individual with a written denial. The
covered entity may extend the time for a response by 30 days but must
provide the patient with a written statement of the reasons for the
delay. The covered entity is only entitled to one 30 day extension for
action on a request for an amendment. If the entity does make the
requested amendment, the entity must inform the individual and make a
reasonable effort to inform other classes of persons described in the
Privacy Rule of the amendment.

Providers will be required to follow the Privacy Rule requirements and
allow patients to request amendments or corrections to the PHI.

17. **What are the penalties for violation of either 42 C.F.R. Part 2 or
    HIPAA?**

Any person violating 42 C.F.R. Part 2 or its implementing statutes can
be fined no more than \$500 for the first offense, and no more than
\$5,000 for each subsequent offense. It is enforced by the U.S.
Attorney's office.

The Secretary of the Department of Health and Human Services (HHS)
delegated the enforcement of the HIPAA Privacy Rule to DHHS' Office for
Civil Rights. Under HIPAA, the Secretary may impose civil monetary
penalties of not more than \$100 per violation and up to \$25,000 for
violations of each requirement or prohibition within a single calendar
year. In addition, criminal penalties are established under HIPAA for
certain knowing violations including knowing disclosures of individually
identifiable health information that violates the Privacy Rule, which,
upon conviction, could result in fines of not more than \$50,000 and/or
imprisonment for up to one year. Offenses committed under false
pretenses are punishable by a fine up to \$100,000 and/or 5 years
imprisonment. Offenses committed with intent to sell, transfer or use
PHI for commercial or personal gain or malicious harm are punishable by
a fine not to exceed \$250,000 and/or 10 years of imprisonment.

18. **Is a client I.D. number assigned by a substance abuse treatment
    program considered PHI?**

Under 42 C.F.R. Part 2, protected patient identifying information does
not include a number assigned to a patient by a program, if that number
does not consist of, or contain numbers (such as a social security
number or driver's license number) which could be used to identify a
patient with reasonable accuracy and speed from sources external to the
program. The Privacy Rule, on the other hand, states that medical record
numbers, account numbers, and any other unique identifying number,
characteristic or code, are considered PHI. Therefore, substance abuse
programs subject to the Privacy Rule must consider the client I.D.
number to be identifying information. A client I.D. number could not be
used or disclosed except as otherwise allowed under the Privacy Rule.